LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > *BSD
User Name
Password
*BSD This forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.

Notices


Reply
  Search this Thread
Old 03-29-2017, 11:23 AM   #1
IMNOboist
Member
 
Registered: Nov 2003
Location: Seattle
Distribution: OpenBSD, Ubuntu
Posts: 60

Rep: Reputation: 16
OpenBSD pf with dual internet connections


Hi there!

I've been running OpenBSD's pf firewall for a while but I don't know how to do something, or even if it's possible.

Basically, here's the deal: I have dual internet connections. I want some traffic to go through one, and some to go through the other. For example, I want all traffic that goes to IP address 100.100.100.100 to go through axe0, and the rest of the traffic to go through bge0.

Is this possible?

Thanks in advance!
 
Old 03-29-2017, 12:01 PM   #2
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Ubuntu, Devuan, OpenBSD
Posts: 2,363
Blog Entries: 3

Rep: Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045
Wouldn't that be mostly done via route(4) before any configurations in pf.conf(5) there?
 
Old 03-29-2017, 12:05 PM   #3
IMNOboist
Member
 
Registered: Nov 2003
Location: Seattle
Distribution: OpenBSD, Ubuntu
Posts: 60

Original Poster
Rep: Reputation: 16
You're probably right. I'm a sys admin not a network admin so the finer details of networking escape me. :c)

It seems like changing the routing table would work for the OpenBSD box, but I think pf would be required for making the change on the rest of the clients, right? Some sort of match command like:
Code:
match out on egress inet from !(egress:network) to 100.100.100.100 nat-to axe0
 
Old 03-29-2017, 12:14 PM   #4
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 2,290

Rep: Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919
Quote:
Originally Posted by IMNOboist View Post
You're probably right. I'm a sys admin not a network admin so the finer details of networking escape me. :c)

It seems like changing the routing table would work for the OpenBSD box, but I think pf would be required for making the change on the rest of the clients, right? Some sort of match command like:
Code:
match out on egress inet from !(egress:network) to 100.100.100.100 nat-to axe0
OK, you have now changed the question.
On a server, you specify what NIC will handle traffic for a particular subnet using a change in the routing table (use 'route', or the route options in 'ip').
Now tell us about these "clients" of which you speak.

(BTW: every network admin should study the basic network settings in the operating systems they support, and every system admin should study the basics of TCPIP networking. We all end up deep into both for much of our careers.)
 
Old 03-29-2017, 12:20 PM   #5
IMNOboist
Member
 
Registered: Nov 2003
Location: Seattle
Distribution: OpenBSD, Ubuntu
Posts: 60

Original Poster
Rep: Reputation: 16
Well... a firewall usually isn't all by itself. The clients would be the other computers on the network that are using the OpenBSD firewall to access the internet. I want their traffic to 100.100.100.100 to go through one internet connection (on axe0) and all other traffic to go through bge0. Does that clear things up?

(I do pretty well with layer 2 stuff, it's the layer 3 stuff that stumps me.)
 
Old 03-29-2017, 12:37 PM   #6
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 2,290

Rep: Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919Reputation: 919
Quote:
Originally Posted by IMNOboist View Post
Well... a firewall usually isn't all by itself. The clients would be the other computers on the network that are using the OpenBSD firewall to access the internet. I want their traffic to 100.100.100.100 to go through one internet connection (on axe0) and all other traffic to go through bge0. Does that clear things up?

(I do pretty well with layer 2 stuff, it's the layer 3 stuff that stumps me.)
I see, you are not using pf alone on this, it is acting as firewall to your network.
Since I do not use pf myself, I cannot be certain, but I believe that if you make it route all traffic to that subnet through that interface it should work for all traffic that comes through the machine. A network router should take care of the external routing without the internal hosts needing to be aware of the issue at all.
 
Old 03-29-2017, 12:46 PM   #7
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Ubuntu, Devuan, OpenBSD
Posts: 2,363
Blog Entries: 3

Rep: Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045Reputation: 1045
I'd pore over pf.conf(5) as well as the networking and PF parts of the FAQ. Remember that PF is last-match so general rules would come first. My guess:

Code:
match out on egress inet from !(egress:network) to any nat-to bge0
match out on egress inet from !(egress:network) to 100.100.100.100 nat-to axe0
Edit: if both interfaces are actually in the egress group... Otherwise, you may have to name the source netwwork(s) explicitly instead of !(egress:network).

Last edited by Turbocapitalist; 03-29-2017 at 12:56 PM.
 
Old 03-29-2017, 01:30 PM   #8
jggimi
Member
 
Registered: Jan 2016
Distribution: None. Just OpenBSD.
Posts: 94

Rep: Reputation: 35
With OpenBSD, there are three ways to manage multiple ISP connections.
  1. Equal Cost Multipath Routing (ECMP). Provisioning guidance is included in the OpenBSD FAQ.
  2. Directed Routing. You can simply allocate portions of the Internet between your two ISPs with routing table entries as discussed previously in this thread. But a much more common practice is to use PF's route-to directive on pass rules, as described in the Routing section of the pf.conf(5) manual.
A third way would be to use multiple routers in combination with the Common Address Redundancy Protocol (CARP). There is an introduction to carp(4) in the PF User's Guide.

Last edited by jggimi; 03-29-2017 at 01:31 PM. Reason: clarity
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Are there any tutorials to dual boot OpenBSD? php111 *BSD 10 02-22-2011 11:21 AM
How to Control Dual Internet Connections davep911 Linux - Networking 1 03-04-2007 11:19 PM
effective utilisation of dual internet connections. exodist Linux - Networking 1 03-07-2006 10:41 PM
Having trouble dual booting OpenBSD 3.7 chutsu *BSD 1 09-27-2005 10:41 AM
Multiple Connections with OpenBSD and PF IMNOboist Linux - Networking 0 04-29-2005 11:34 PM

LinuxQuestions.org > Forums > Other *NIX Forums > *BSD

All times are GMT -5. The time now is 05:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration