Hi everyone,
Any one can help me with this configuration?
[LMDS] [ADSL]
\ /
\ /
\ /
[ PF ]
|
|
[Internal Net]
Both LMDS and ADSL routers are doing nat from two public ip addresses to
both external interfaces on Firewall
I want to do some kind of "load Balance" against inside connections to the
Firewall, I mean, If a packet arrives through LMDS line, the firewall with
reply-to have to answer to the same line. If the packet arrives through the
ADSL router, the firewall must answer to that line. This way, I can have
simultaneous connections through both routers.
I have done some tests, but the firewall never answer the packet, It arrives
at the external interface, but never replies to it.
I have OBSD 3.5 as the firewall. And here is part of my pf.conf:
# Macros
ext_if1 = "fxp0"
ext_if2 = "rl1"
int_if = "rl2"
ext_gw1 = "10.10.10.1"
ext_gw2 = "10.10.11.1"
puertos = "{ 21, >1200 }"
# Nat on external interface
nat on $ext_if1 from $int_if:network to any -> $ext_if1
nat on $ext_if2 from $int_if:network to any -> $ext_if2
# Syslog from router
rdr pass on $ext_if1 proto udp from $ext_gw1 to $ext_if1 \
port 514 -> 192.168.0.100
# Antispoof
antispoof for fxp0 inet
antispoof for rl0 inet
antispoof for rl1 inet
# Global
block all
# FTP connections from outside
pass in log quick on $ext_if2 reply-to ($ext_if2 $ext_gw2) \
proto tcp from any to $ext_if2 port $puertos flags S/SA keep state
pass in log quick on $ext_if1 reply-to ($ext_if1 $ext_gw1) \
proto tcp from any to $ext_if1 port $puertos flags S/SA keep state
pass in log quick on $ext_if2 reply-to ($ext_if2 $ext_gw2) \
proto udp from any to $ext_if2 port 20 keep state
pass in log quick on $ext_if1 reply-to ($ext_if1 $ext_gw1) \
proto udp from any to $ext_if1 port 20 keep state
# Outgoing traffic
pass out quick on $ext_if1 route-to ($ext_if2 $ext_gw2) proto tcp from \
$ext_if2 to any modulate state flags S/SA
pass out quick on $ext_if2 route-to ($ext_if1 $ext_gw1) proto tcp from \
$ext_if1 to any modulate state flags S/SA
pass out quick on $ext_if1 route-to ($ext_if2 $ext_gw2) proto udp from \
$ext_if2 to any keep state
pass out quick on $ext_if2 route-to ($ext_if1 $ext_gw1) proto udp from \
$ext_if1 to any keep state
Anyone can help me'??
thanks and regards,
Esteban
