CARP and NAT question

[Julien Cigar]

On Wed, Oct 09, 2019 at 12:50:49PM -0700, Julian Elischer wrote:
> On 10/9/19 2:34 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote:
> >> On 10/8/19 8:58 AM, Julien Cigar wrote:
> >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >>>> Hi Julien,
> >>> Hi Matthew,
> >>>
> >>>> It's not clear why you are trying to assign multiple carp IP address to
> >>>> two different interfaces from within the same IP subnet. Are you trying
> >>>> to fail over a 2nd carp address or are you trying to improve
> >>>> throughput/redundancy? If you just want to fail over a 2nd carp address,
> >>>> assign a 2nd alias to your first interface. If your trying to improve
> >>>> throughput/redundancy, assign both interfaces to a lagg and build your
> >>>> carp interfaces on top of that instead.
> >>>>
> >>> Currently outbound traffic from $net1 and $net2 (two private networks)
> >>> pass through the same network interface (igb0) (as you can see in (1)
> >>> in my previous post) on the router. I'd like to prevent that
> >>> $net2 saturates the interface and slow down traffic from $net1 (which is
> >>> more important). I could lagg and build CARP on top of that but it
> >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
> >>> of course, which I'd like to avoid).
> >>>
> >>>> -Matthew
> >>>>
> >>>> On 10/8/2019 8:48 AM, Julien Cigar wrote:
> >>>>> Hello,
> >>>>>
> >>>>> I'd like to NAT outbound traffic from two different private networks
> >>>>> through two different interfaces, with CARP on top. I have 4 public IPS
> >>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92).
> >>>>>
> >>>>> I have two redundant router/firewall running FreeBSD 12 with CARP and
> >>>>> PF with the following: (1) which works well, but all traffic
> >>>>> goes through the same interface.
> >>>>>
> >>>>> So I'd like to switch to something like (2), which will not work (lines
> >>>>> 5 and 13 are not valid) and I'm wondering if I could use something like
> >>>>> (3) ..?
> >>>>>
> >>>>> Thank you!
> >>>>> Julien
> >>>>>
> >>>>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292
> >>>>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410
> >>>>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db
> >>>>>
> >>>> _______________________________________________
> >>>> freebsd-net at freebsd.org mailing list
> >>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> >>>> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
> >> can you draw it?
> > yes, see https://ibb.co/mv5RPM9
> 
> so, you have several ways of doing this:
> 
> one is to assign a different routing table to each class of traffic.
> 
> Each table has  a different default route, sending data out to a 
> different external interface.
> 
> Each interface out is NAT'd so that the return packets will come back 
> the same way.

I haven't played with multiple FIB(s) yet (which still require a custom
kernel with options ROUTETABLES, I think?) but I'll take a look. As I can
see it's a little bit more more work than the route-to PF route option.

> 
> But you only have a single pipe to the internet, So one wonders how 
> that helps with redundancy?
> 

Adding a second switch and another redundant link is also planned, but 
at the moment by "redundancy" I was talking of router1 and router2, and
the integration with CARP, especially the "real" addresses on
the interfaces as I have only 4 public ones and 3 of them are already
used on the first interface. But I think that starting with FreeBSD 11
(?) real and virtual addresses couldn't be in the same subnet, for
example I think this should work:

###########
# router1 #
###########

ifconfig_igb0="inet 193.1.2.89 netmask 255.255.255.224 -tso"
ifconfig_igb0_alias0="inet vhid 53 advskew 0 pass xxx alias 193.1.2.90/32"

ifconfig_igb1="inet 10.1.2.3 netmask 255.255.255.224 -tso"
ifconfig_igb1_alias0="inet vhid 54 advskew 0 pass xxx alias 193.1.2.92/32"


###########
# router2 #
###########

ifconfig_igb0="inet 193.1.2.91 netmask 255.255.255.224 -tso"
ifconfig_igb0_alias0="inet vhid 53 advskew 100 pass xxx alias 193.1.2.90/32"

ifconfig_igb1="inet 10.1.2.4 netmask 255.255.255.224 -tso"
ifconfig_igb1_alias0="inet vhid 54 advskew 100 pass xxx alias 193.1.2.92/32"

> 
> 

thanks for you help :)
Julien

> 
> >
> >>
> >> _______________________________________________
> >> freebsd-net at freebsd.org mailing list
> >> https://lists.freebsd.org/mailman/listinfo/freebsd-net
> >> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
> 
> 

-- 
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11  6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20191010/4a5b1aa3/attachment.sig>