This question was just covered on this list during the last 7 days. Search the questions archives at http://freebsd.rambler.ru/
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Leon Botes Sent: Saturday, February 25, 2006 5:15 AM To: freebsd-questions@freebsd.org Subject: pf binat problem # network diagram # __________ # | | <dsl1_if>---<dsl1_rt> # | | # <pri_net>---<pri_if>| freebsd | <dsl2_if>---<dsl2_rt> # | pf | # <dmz_srv>---<dmz_if>| firewall | <dig_if>----<dig_rt> # | | # (internal nets) |__________| (external nets) Default Gateway is <dig_rt>. When a connection arrives on one of the dsl_if's it is redirected to the correct port on the dms_srv, traced via tcpdump. The dmz_srv responds but tries to send its reply out the default gateway instead of via the interface the connection arrived on. The dmz server is actually a LVS cluster masqueraded. All connections coming in via the dig_if get redirected and work fine. How can i tell pf to return connections out the same interface they arrived on and not use the default route out dig_if? dsl1_if = "rl3" dsl1_rt = "172.16.3.1" dsl1_ip = "172.16.3.2" dsl2_if = "rl1" dsl2_rt = "172.16.4.1" dsl2_ip = "172.16.4.2" dmz_if = "rl0" dmz_srv = "172.16.2.4" dmz_if_ip = "172.16.2.3" pri_if = "rl2" pri_ip = "192.168.254.1" binat on $dig_if from $dmz_srv to any -> $dig_ip binat on $dsl1_if from $dmz_srv to any -> $dsl1_ip binat on $dsl2_if from $dmz_srv to any -> $dsl2_ip nat on $dig_if from <pri_net> to any -> $dig_ip nat on $dsl1_if from <pri_net> to any -> $dsl1_ip nat on $dsl2_if from <pri_net> to any -> $dsl2_ip rdr on $dsl1_if inet proto tcp from any to $dsl1_ip port { 25, 80, 110 } -> $dmz_srv rdr on $dsl2_if inet proto tcp from any to $dsl2_ip port { 25, 80, 110 } -> $dmz_srv Thanks Leon _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]" _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
