How can I link two separate internal networks to two separate
external networks
Michael K. Smith
mksmith at adhost.com
Mon Dec 22 17:54:08 UTC 2008
Hello Geoff:
On 12/22/08 4:06 AM, "Geoff Roberts" <geoff at apro.com.au> wrote:
> Hi,
>
> I have a FreeBSD 7.0 box with pf.
>
> I have two internal networks (intnet0 and intnet1) and two internal networks
> (extnet0 and extnet1).
>
> extnet0 and extnet1 are two different gateways to the internet.
>
> I only have one physical internal (int0) and one physical external (ext0)
> interface.
>
> Traffic from intnet0 needs to go out on extnet0
>
> Traffic from intnet1 needs to go out on extnet1 (consider this a default route
> for any traffic not going out on extnet0).
>
> What are some suggested ways of doing this?
>
> Assume addresses are (these are made up, but hopefully help paint the
> picture):
>
> intnet0 - 192.168.50.0/24
> extnet0 - 10.10.10.8/30
> - extnet0 address 10.10.10.8.10
> - default route 10.10.10.9
> - broadcast 10.10.10.11
>
> intnet1 - 192.168.60.0/24
> extnet1 - 10.10.10.12/30
> - extnet1 address 10.10.10.14
> - default route 10.10.10.13
> - broadcast 10.10.10.15
>
> So far I have created vlans via a switch on each interface to "multiplex" the
> connections:
>
> vlan10 - 192.168.50.0/24 and vlan20 - 192.168.60.0/24 come in on a single
> cable to int0.
>
> vlan50 - 10.10.10.8/30 and vlan60 - 10.10.10.12/30 come in on a single cable
> to ext0.
>
> However, since I have the defaultroute set for 10.10.10.13 all traffic from
> intnet0 is going out on vlan60 whereas i want it to go out on vlan50.
>
> Am I going about this the wrong way?
>
I think this will work. Let's assume:
$vlan10_if -> macro for your tagged VLAN 10 interface
$vlan20_if -> macro for your tagged VLAN 20 interface
$vlan50_if -> macro for your tagged VLAN 50 interface
$vlan60_if -> macro for your tagged VLAN 60 interface
$vlan50_gw = 10.10.10.9
$vlan60_gw = 10.10.10.13
pass in on $vlan10_if route-to ($vlan50_if $vlan50_gw) from any to any
pass in on $vlan20_if route-to ($vlan60_if $vlan60_gw) from any to any
That would be in conjunction with your NAT's and any RDR's as well.
Regards,
Mike
More information about the freebsd-questions
mailing list