MultiHomed FreeBSD

от ILuxWiki

TODO: по последни дискусий във FreeBSD ipf е ГОЛЯМ проблем и използването му трябва да се избягва. Да пренапиша тази функционалност за pf.

Имам машина с две мрежови карти и следните IP адреси:

 net0: 217.79.66.3 gateway 217.79.66.2 <- default gateway
 net1: 10.210.0.210 gateway 10.210.0.1
 на 10.210.0.210 се прави SNAT и DNAT към 195.138.138.195

От доста време търся решение за policy routing под FreeBSD. Целта ми беше пакетите идващи към 10.210.0.210(195.138.138.195) да се връщат обратно през net1, а не през default-gw 217.79.66.2. В линукс този проблем се решава лесно с използването на iproute2. Оказа се, че и във FreeBSD решението е доста лесно, но трудно намерих нужната информация. В Интернет имаше доста решения с ipfw, но за мене нито едно не се оказа работещо, а този ред за ipf е достатъчен:

 pass out quick on net0 to net1:10.210.0.1 from 10.210.0.210 to any

източник: http://www.bsdnews.org/01/policy_routing.php

Всичко описано по долу не работи /поне за мен/ ако някой сметне, че греша да се обади.

1. Източник: http://www.opennet.ru/base/net/bsd_pbr_route.txt.html
2. Източник: http://lists.virus.org/freebsd-security-0404/msg00068.html

Re: Policy routing with IPFW.

   * To: Stephen Gill <[EMAIL PROTECTED]>
   * Subject: Re: Policy routing with IPFW
   * From: "David G. Andersen" <[EMAIL PROTECTED]>
   * Date: Thu, 15 Apr 2004 15:22:41 -0600
   * Cc: [EMAIL PROTECTED]
   * In-reply-to: <20040415203157.44002.qmail@web60708.mail.yahoo.com>; from gillsr@yahoo.com on Thu, Apr 15, 2004 at 01:31:57PM -0700
   * References: <20040415203157.44002.qmail@web60708.mail.yahoo.com>
   * Sender: [EMAIL PROTECTED] 

Stephen Gill just mooed:
> following:
> 
> - All traffic sourced from Interface 1 (dc0) should go out gateway 1 
> - All traffic sourced from Interface 2 (dc1) should go out gateway 2
> - All traffic destined to Interface 1 (dc0) should return out gateway 1
> - All traffic destined to Interface 2 (dc1) should return out gateway 2
> 
> Gateway 1 is on dc0 and Gateway 2 is on dc1.  I think you get the
> picture.  
> 
> Is this type of thing possible with IPFW?  If not, is there any other
> module that would allow me to do this?  I don't care how ugly it gets,
> just so long as it works.

 sure. 

 options IPFIREWALL
 options IPFIREWALL_FORWARD

As an example from a running system:

00100 allow ip from any to any via lo0
00500 allow ip from IP1 to IP1/IP1-netmask
00501 fwd IP1-GW ip from IP1 to any
00600 allow ip from IP2 to IP2/IP2-netmask
00601 fwd IP2-GW ip from IP2 to any

(where IP1-GW and IP2-GW are the next-hop routers for each
interface, obviously).

Works like a charm - I've got it running on quite a few machines.
The only downside to it sometimes is that you have to write some
script wrappers around things to get dynamic updates (e.g., 
ppp linkup scripts or dhcpd.conf running external scripts on route
changes).

 -Dave

-- 
work: [EMAIL PROTECTED]                          me:  [EMAIL PROTECTED]
     MIT Laboratory for Computer Science           http://www.angio.net/
     I do not accept unsolicited commercial email.  Do not spam me.