Thanks, I'll keep that approach in mind. Unfortunately that still relies
on routing tables to perform outbound routing, unless I misunderstand?
The problem is that my routing setup is a little complex for the routing
tables, so I really need to route using pf. My setup looks roughly like
this:
* Almost 600 IP ranges get routed over one set of links, with load
balancing to get better ADSL line usage (local routes)
* VPN traffic goes out over an IPSec tunnel
* Other traffic gets routed via another ADSL link (International traffic)
Most of the above can be done using routing tables (except for the load
balancing?), but having to maintain both the pf rules and the routing
tables is undesirable, especially since my setup changes quite often.
This is what I've managed so far:
1 - The default route (set to IP of lo1) loops traffic back to the
router. Without pf routing, that traffic loops until the TTL is
exceeded, as expected. But when I try to route it on the incoming
traffic of the loopback (pass in on lo1 route-to ...), the packets go
nowhere and I can't figure out what's happening with tcpdump.
2 - The above setup results in the packets looping back via lo0, despite
setting the default route to lo1. This happens even when I configure lo1
on a unique subnet. When I configure the route via the loopback IP
first, and then use "route change" to set the interface to lo1
explicitly on the default route, I get messages along the line of
"address family not supported by the protocol family" whenever packets
are routed to the loopback. This happens even after I make sure to
assign both IPv4 and IPv6 addresses to lo1.
From the above it seems I'm very close to a solution, but it just
doesn't want to work...
On 2010-01-26 13:07, Frank Behrens wrote:
Stefan<[email protected]> wrote on 26 Jan 2010 12:02:
I've googled this one to bits and pulled out quite a lot of hair:
Basically I need a way to route, using "route-to" filter rules, the
traffic originating on the freebsd router itself. The problem with doing
this is that pf only sees the packets on their way out, when an outbound
interface has already been chosen by the routing tables. Therefore pf's
route-to rules have no effect on locally originating traffic.
I had always some trouble with this approach. I used rules like
nat inet from any to xxx port yyy tag IF2 -> $myaddr
pass out quick on $iface from $myaddr to any tag IF2
pass out quick on $defaultinterface route-to ($iface $hisaddr) tagged IF2
Now I'm using an associated FIB (setfib(8)) for desired processes and it works
very well
without any trouble. Routed traffic is also assigned to the fib with pf's
"rtable" option.
Frank
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[email protected]"
