LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > *BSD
User Name
Password
*BSD This forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.

Notices

Reply
 
Search this Thread
Old 06-21-2009, 03:38 AM   #1
sarajevo
Member
 
Registered: Apr 2005
Distribution: Debian, OpenBSD,Fedora,RedHat
Posts: 228
Blog Entries: 1

Rep: Reputation: 31
CARP virtual address/interface assignmet


Hi all,

I have an question regarding CARP on OpenBSD.

I have an public address, let say 1.1.1.1/24 --real ip address and I would like to build an redundant par of firewalls.

FW1: ext_if
int_if
sync_if
carp1
carp2


FW2: ext_if
int_if
sync_if
carp1
carp2

I am just wondering if I assing to ext_if=1.1.1.1 ( on both FWs ), what has to be ip address on carp1 on both firewalls ( could it be 1.1.1.2 --as it is virtual ).
Part related to virtual addresses/interfaces is confusing to me, if there is someone who understand this, could you please write what it could be ip assignment for above case where I have an public ip address=1.1.1.1

Thank you in advance

Nice regards,

Last edited by sarajevo; 06-21-2009 at 05:23 AM.
 
Old 06-22-2009, 12:15 AM   #2
ocicat
Member
 
Registered: May 2007
Posts: 207

Rep: Reputation: 46
Quote:
Originally Posted by sarajevo View Post
I am just wondering if I assing to ext_if=1.1.1.1 ( on both FWs ), what has to be ip address on carp1 on both firewalls ( could it be 1.1.1.2 --as it is virtual ).
No, each external interface will be configured with the same address. Study Section 6.11 of the official FAQ for more discussion:

http://openbsd.org/faq/faq6.html#CARP
 
Old 06-23-2009, 07:13 PM   #3
ocicat
Member
 
Registered: May 2007
Posts: 207

Rep: Reputation: 46
Serendipitously, I ran into the following which may be of some help in explaining:

http://openbsd-wiki.org/index.php?ti...nt_caching-DNS

Note that this source states that each CARP member will have a unique address. Which is correct? Re-read the manpage & experiment...
 
Old 06-25-2009, 04:18 AM   #4
sarajevo
Member
 
Registered: Apr 2005
Distribution: Debian, OpenBSD,Fedora,RedHat
Posts: 228
Blog Entries: 1

Original Poster
Rep: Reputation: 31
Quote:
Originally Posted by ocicat View Post
Serendipitously, I ran into the following which may be of some help in explaining:

http://openbsd-wiki.org/index.php?ti...nt_caching-DNS

Note that this source states that each CARP member will have a unique address. Which is correct? Re-read the manpage & experiment...
Thank you all for commnets. I made it like

fxp0 --real interface , its config : cat hostname.fxp0 == up

so I just bring up real interface without assign any ip address to it

for carp interface I made

hostname.carp1
inet real_ip mask broadcast vhid 1 paas PASSWORD carpdev fxp0 advbase 1 advskew 0 state master description " CARP interface on fxp0 to outside network "

same on both firewals FW1 and FW2.

This enabled carp interface to have real ip address which is shared with second firewall.

Rule in pf.conf which enable nat-in to internal network is

nat on $ext_if from !($ext_if) to any -> ($carp_ext)

carp_ext=carp1 ( used macro in pf.conf )

and it works perfectly, firewall failover works super, and I want to say big thank to OpenBSD and CAPR/PF team, and invite all of you out there to support these fantastic projects.

Kind regards,
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
traffic has to go through the virtual interface ip address pudhiyavan Linux - Networking 2 03-27-2008 04:35 AM
Adding virtual interface for IP based virtual host pridefc Linux - General 6 03-16-2008 03:52 PM
how to find physical address of kernel virtual address kushneeraj Programming 0 10-20-2006 07:29 PM
API for mapping Physical Address to Virtual Address Lakshman_smt Linux - Software 2 10-15-2006 09:08 PM
Memory Mapping (same physical address = virtual address) skd.tech Linux - Kernel 7 07-24-2006 11:13 PM


All times are GMT -5. The time now is 11:18 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration