CARP and NAT question

[Julian Elischer]

On 10/9/19 12:57 PM, Matthew Grooms wrote:
> On 10/9/2019 2:50 PM, Julian Elischer wrote:
>> On 10/9/19 2:34 AM, Julien Cigar wrote:
>>> On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote:
>>>> On 10/8/19 8:58 AM, Julien Cigar wrote:
>>>>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
>>>>>> Hi Julien,
>>>>> Hi Matthew,
>>>>>
>>>>>> It's not clear why you are trying to assign multiple carp IP 
>>>>>> address to
>>>>>> two different interfaces from within the same IP subnet. Are 
>>>>>> you trying
>>>>>> to fail over a 2nd carp address or are you trying to improve
>>>>>> throughput/redundancy? If you just want to fail over a 2nd carp 
>>>>>> address,
>>>>>> assign a 2nd alias to your first interface. If your trying to 
>>>>>> improve
>>>>>> throughput/redundancy, assign both interfaces to a lagg and 
>>>>>> build your
>>>>>> carp interfaces on top of that instead.
>>>>>>
>>>>> Currently outbound traffic from $net1 and $net2 (two private 
>>>>> networks)
>>>>> pass through the same network interface (igb0) (as you can see 
>>>>> in (1)
>>>>> in my previous post) on the router. I'd like to prevent that
>>>>> $net2 saturates the interface and slow down traffic from $net1 
>>>>> (which is
>>>>> more important). I could lagg and build CARP on top of that but it
>>>>> wouldn't prevent $net2 to saturate the interface (unless I'm 
>>>>> plugin ALTQ
>>>>> of course, which I'd like to avoid).
>>>>>
>>>>>> -Matthew
>>>>>>
>>>>>> On 10/8/2019 8:48 AM, Julien Cigar wrote:
>>>>>>> Hello,
>>>>>>>
>>>>>>> I'd like to NAT outbound traffic from two different private 
>>>>>>> networks
>>>>>>> through two different interfaces, with CARP on top. I have 4 
>>>>>>> public IPS
>>>>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92).
>>>>>>>
>>>>>>> I have two redundant router/firewall running FreeBSD 12 with 
>>>>>>> CARP and
>>>>>>> PF with the following: (1) which works well, but all traffic
>>>>>>> goes through the same interface.
>>>>>>>
>>>>>>> So I'd like to switch to something like (2), which will not 
>>>>>>> work (lines
>>>>>>> 5 and 13 are not valid) and I'm wondering if I could use 
>>>>>>> something like
>>>>>>> (3) ..?
>>>>>>>
>>>>>>> Thank you!
>>>>>>> Julien
>>>>>>>
>>>>>>> (1) 
>>>>>>> https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292
>>>>>>> (2) 
>>>>>>> https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410
>>>>>>> (3) 
>>>>>>> https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db
>>>>>>>
>>>>>> _______________________________________________
>>>>>> freebsd-net at freebsd.org mailing list
>>>>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net
>>>>>> To unsubscribe, send any mail to 
>>>>>> "freebsd-net-unsubscribe at freebsd.org"
>>>> can you draw it?
>>> yes, see https://ibb.co/mv5RPM9
>>
>> so, you have several ways of doing this:
>>
>> one is to assign a different routing table to each class of traffic.
>>
>> Each table has  a different default route, sending data out to a 
>> different external interface.
>>
>> Each interface out is NAT'd so that the return packets will come 
>> back the same way.
>>
> How do you classify the traffic based on the source address when 
> using multiple route tables?

use ipfw to set the fib number based on some bits in the address of 
the internal machine.

e.g. ipfw setfib 1 tcp from (some internal pattern) to (the outside) 
in recv (internal interface) keep_state

There are several ways to do this.. this is just one... The above will 
assign a dynamic rule for all packets between the  two machines and 
the table in question will be always used. for that tupple.


>
>> But you only have a single pipe to the internet, So one wonders how 
>> that helps with redundancy?
>>
> I asked a similar question. He believe he mentioned that he was 
> trying to get around the 1Gbit limit of each interface. WRT 
> redundancy, he probably means the use of a backup firewall, carp and 
> probably pfsync.
>
> -Matthew
>
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>
>