Article View: bit.listserv.openbsd-pf
Article #236Re: Routing challenges with DHCP and static interfaces
From: Teemu Rinta-aho
Date: Fri, 16 Nov 2012 10:11
Date: Fri, 16 Nov 2012 10:11
26 lines
2661 bytes
2661 bytes
On 16.11.2012, at 7.34, gpontis@spamcop.net wrote: > I recently moved from OpenBSD 4.9 to 5.2, and onto a new machine with an extra enet port for the backup cable modem. DSL with a block of static IPs is the primary external interface. My plan was add rules with route-to to route specific traffic to the cable modem. > > First thing, I can't seem to write a rule that will route anywhere other than to the default interface. For example, a rule such as "pass in quick on em0 from any to 1.2.3.4 keep state route-to ( em2 $em2GatewayAddr )" should do it. But then "telnet 1.2.3.4" causes a packet to go out em1, which is the interface hosting the default route. "pfctl -vvs rules" does show the route-to rule as one would expect, and it is being evaluated, but no packets match. I can't see any reason for packets to not match. > > A second problem is that the cable modem must get an address using DHCP. To route to the cable modem, I assume that route-to rules must contain the gateway address. But it is not clear how to get that from DHCP issued address into a rule. Is there a way to do it, or is my approach incorrect ? > > George Hi George, please check my blog posts http://www.rinta-aho.org/blog/?p=168 (original, without VLANs) and http://www.rinta-aho.org/blog/?p=346 (with VLANs) I faced, and solved, the same problems as you although my goal was a bit different and maybe more complicated (get multiple public IPs from the same ISP). Basically I use pf tables to store the next hop routers and update those from dhclient. Hope it helps! BR, Teemu
Technical Details
Message-ID:
<977FD23D-9B4F-4F86-B684-E4D4DA6227EB@rinta-aho.org>Path:
arc1-ca.pugleaf.net!6ni89336pbd.1!nntp.google.com!news.glorb.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnReferences:
<20121116003433.6oy5ec5x44o0ks88-tcbagvf@webmail.spamcop.net>Show Full Headers
Complete Article Headers
X-Google-Thread: ff4ef,840cf672cc3914fa
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.68.248.34 with SMTP id yj2mr1017251pbc.2.1353060676217;
Fri, 16 Nov 2012 02:11:16 -0800 (PST)
Path: arc1-ca.pugleaf.net!6ni89336pbd.1!nntp.google.com!news.glorb.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: teemu@rinta-aho.org (Teemu Rinta-aho)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: Routing challenges with DHCP and static interfaces
Date: 16 Nov 2012 02:11:15 -0800
Organization: None
Lines: 26
Message-ID: <977FD23D-9B4F-4F86-B684-E4D4DA6227EB@rinta-aho.org>
References: <20121116003433.6oy5ec5x44o0ks88-tcbagvf@webmail.spamcop.net>
NNTP-Posting-Host: tri13.nomadiclab.com
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
NNTP-Posting-Date: 16 Nov 2012 10:11:15 GMT
X-Received-Bytes: 2279
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit