hi greg,

There's a number of ways to do this.

Add the extra addresses as aliases to the internet facing interface. E.g

gw2:~ # cat /etc/rc.early /etc/rc.conf | egrep -i 'outside|alias' | sed -e
/sbin/ifconfig rue0 name outside
network_interfaces="lo0 outside inside"
ifconfig_outside="inet xx.yy.zz.251 netmask 0xfffffff8 up"
ifconfig_outside_alias0="inet xx.yy.zz.252 netmask 0xffffffff"
ifconfig_outside_alias1="inet xx.yy.zz.253 netmask 0xffffffff"

i am using aliases, but, atm, only for INTERNAL addresses on the
router/firewall. e.g., in rc.conf,

int_if         = "sis0"
lo_if          = "lo0"
ifconfig_sis0="inet x.x.x.80 netmask mtu 1492 polling"
ifconfig_sis0_alias0="x.x.x.81 netmask mtu 1492 polling"
ifconfig_sis0_alias1="x.x.x.82 netmask mtu 1492 polling"
ifconfig_sis0_alias2="x.x.x.83 netmask mtu 1492 polling"
ifconfig_sis0_alias3="x.x.x.84 netmask mtu 1492 polling"

the $ext_if, "tun0" (pppoe) is not created UNTIL ppp launches -- later.

so, iiuc -- which i may well not -- setting aliases for the ext intfc
would NOT work in rc.conf (early), but only (later) after ppp int'd
the alias ...

don't know what issues that causes for maintaining any/all required
synchronization with pf ... which would be expecting/addressing  those
external intfc aliases on startup.

so, don't think this is a viable option :-/

unless ...

Or. If you have control of the upstream router from your firewall add
static routes for either the entire cidr block or /32 host routes for each
address in the /29 you control.

The routes should point to the external address of the firewall.


i assume you really DO mean the upstream router here, NOT any router
capabilities ON the firewall box itself, yes?

if so, after pppoe setup/connect, ifconfig shows,

 tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1492
         inet x.x.x.1 --> aa.bb.cc.dd netmask 0xffffffff
         Opened by PID 511

and the upstream router, aa.bb.cc.dd, is my ISP's.

checking established routes, as per in "ppp.conf",

 add default HISADDR

checking routes, i see the one,

 netstat -nr | grep aa.bb.cc.dd
   default            aa.bb.cc.dd        UGS         0       19   tun0
   aa.bb.cc.dd        x.x.x.1            UH          1        3   tun0

now, looking at that, i suspect i MIGHT be able to add add'l routes in
the ppp.conf transaction config -- e.g., instead of (just?)

 add default HISADDR

add something 'like'

 set ifaddr x.x.x.1 x.x.x.2 x.x.x.3
 add x.x.x.0/29 HISADDR

but, i have to search/fumble around with the correct pppoe-time syntax.

i assume that this would (?) set up additional external intfcs, which
would then be pf-addressable?


freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to