I am attempting to use IPFW (and either IPNAT or natd) to do the following:
I have two connections to the outside world coming in to my firewall.
em0 has a static ip and is going to a bridged DSL connection, then
bge1 has a static ip and is going to a a few bonded DS1s. bge0 goes to
my internal network. I am attempting to have NAT on both external
interfaces, and have most outbound traffic move across bge1, while
traffic from/to a particular internal system (We'll call it
internal_system for purposes of this message) to/from a particular
remote system (This we'll call remote_system) port 80 moves across
the DSL line on em0.
Here is an attempt at a pretty ascii picture
ISP 1
[192.168.2.254]
|
|
[bge1:192.168.2.1]
FIREWALL[bge0:10.0.0.1]-------[10.0.0.2]internal_system
[em0:192.168.1.1]
|
|
[192.168.1.254]
ISP 2
Here are the rules I've tried using in congunction with natd:
#Send incoming traffic to natd
00400 divert 8869 ip from any to any in via bge1
00450 divert 8868 ip from any to any in via em0
00500 check-state
#Check for internal_system port 80 traffic
0600 skipto 900 from $internal_system to $remote_system 80
#Send Most Traffic out via bge1
00700 divert 8869 ip from $local_net to any in
00750 divert 8869 ip from $local_net to any out
#Send "special" traffic out via em0
00900 divert 8868 ip from $internal_system to $remote_system 80 in
00950 divert 8868 ip from $remote_system to $remote_system 80 out
#policy route to get traffic to the correct ISP
02000 fwd $isp2_gw ip from $isp2_ip to any
02500 fwd $isp1_gw ip from $isp1_ip to any
Two instances of natd are running, one on port 8868 with an alias
address of $isp1_ip, the other is on port 8869 with an alias address
of $isp2_ip
With the above ipfw rules in place, a
$ping -S $isp2_ip google.com
Should result in a ping across em0 to google, however it acts as
though it cannot even reach the $isp2_gw.
I have been able to get everything to work exactly as I want it to
using pf on FreeBSD, but I've been told that ipfw is preferred within
the organization.
Any suggestions would be greatly appreciated.
Jared Baldridge
Systems Administrator
PFS
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
