Yes it was exactly this & thanks Soner Tari & Stuart Henderson for Helping me 
(newbie) in so detail that now finally i have succeeded in making  multiple 
external connection & serving them as one.
lush it feels so good ..

Thank you.
I owe you one.

p.s  is it possible to  have a 3rd internet connection join this ? :) 


*:$., 88,.$:*(((*$ Stingray *:$., 88,.$:*((*$
              



----- Original Message ----
From:  <[EMAIL PROTECTED]>
To: S t i n g r a y <[EMAIL PROTECTED]>
Cc: openbsd <misc@openbsd.org>
Sent: Wednesday, January 24, 2007 12:53:40 AM
Subject: Re: multiple external links not working ..

Hi, I'm using two external interfaces myself, and I believe I had the
same problem you describe in your message. I bet when you do:

netstat -rnf inet | grep default

you will see that your (ext_if2 ext_gw2) comes on top. Thus, my theory
is that the kernel is preferring your second external interface due to
your routing table (i.e. the order of your default routes).

Since I don't know how to handle this in pf.conf for connections
originating from my firewall, such as an http proxy running on the
firewall, just as in your case too (otherwise route-to and reply-to work
fine), I change my routing table in rc files.

Specifically, I rearrange the order of my default routes to have my
first external interface/gateway on top:

route add default -ifp ext_if1 -mpath ext_gw1
route add default -ifp ext_if2 -mpath ext_gw2

Accordingly, I removed the similar shell commands in hostname.if(5)
files.

Hope this helps,

On Tue, 2007-01-23 at 08:36 -0800, S t i n g r a y wrote:
> Well thanks to everyone who help me coming close to using multiple external 
> links for internet.
> but its still not working, my scenario is that i have 2 ISP's connection  now 
> the main internet connection  is the powerful one which i only want  to use 
> for specific  protocols  which i have defined  in a macro called ports  now 
> rest is supposed to goto to my 2nd internet connection which is a weak & 
> cheap connection basically there to allow p2p applications access.
> Main internet is ext_if1 (xl0)
> slow internet is ext_if2 (xl2)
> LAN is int_if (xl1) 
> now the problem is that when ever i apply my pf.conf file all the traffic 
> goes to 2nd slow internet connection.
> 
> my pf.conf file
> lan_net = "10.0.0.0/16"
> int_if  = "xl1"
> ext_if1 = "xl0"
> ext_if2 = "xl2"
> ext_gw1 = "192.168.0.1"
> ext_gw2 = "203.81.235.1"
> chadd = "10.0.0.1"
> ports = " 22 25 53 80 110 119 123 143 443 465 554 900 995 1755 1863"
> table <allowedclients> persist file "/etc/allowedclients"
> 
> nat on $ext_if1 inet proto {tcp, udp } from <allowedclients> to any port \
> { $ports } -> ($ext_if1)
> nat on $ext_if2 inet proto {tcp, udp } from <allowedclients> to any \
>  -> ($ext_if2)
> 
> rdr on $int_if proto tcp from <allowedclients> to any port 80 -> $chadd port 
> 8080
> 
> pass out log on $int_if from any to $lan_net
> 
> pass in log quick on $int_if from $lan_net to $int_if
> pass in log on $int_if route-to { ($ext_if2 $ext_gw2) } from \
>     $lan_net to any flags S/SA keep state
> pass in log on $int_if route-to { ($ext_if1 $ext_gw1) } inet proto tcp from \
> $lan_net to any port {$ports} flags S/SA keep state
> 
> pass out log on $ext_if2 proto tcp from any to any flags S/SA modulate state
> pass out log on $ext_if2 proto { udp, icmp } from any to any keep state
> pass out log on $ext_if1 proto tcp from any to any flags S/SA modulate state  
> pass out log on $ext_if1 proto { udp, icmp } from any to any keep state
> 
> pass out log on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any 
> pass out log on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
> 
> this is what happens
> 
> bash-3.1# tcpdump -nettipflog0
> tcpdump: WARNING: pflog0: no IPv4 address assigned
> tcpdump: listening on pflog0, link-type PFLOG
> 1169566778.398818 rule 18/(match) pass out on xl2: 203.81.235.185.5698 > 
> 8.7.232.215.80: [|tcp] (DF)
> 1169566778.553623 rule 18/(match) pass out on xl2: 203.81.235.185.13550 > 
> 66.249.91.83.80: [|tcp] (DF)
> 1169566779.005110 rule 18/(match) pass out on xl2: 203.81.235.185.16245 > 
> 209.0.144.87.80: [|tcp] (DF)
> 1169566779.102642 rule 1/(match) pass in on xl1: 10.0.2.41.1601 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566779.105302 rule 18/(match) pass out on xl2: 203.81.235.185.5672 > 
> 216.143.70.77.80: [|tcp]
> 1169566779.167718 rule 1/(match) pass in on xl1: 10.0.1.24.2402 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566779.170640 rule 18/(match) pass out on xl2: 203.81.235.185.11598 > 
> 64.40.101.40.80: [|tcp] (DF)
> 1169566779.457058 rule 2/(match) pass in on xl1: 10.0.2.7.2328 > 
> 125.23.47.31.3460: [|tcp] (DF)
> 1169566779.457112 rule 21/(match) pass out on xl0: 10.0.2.7.2328 > 
> 125.23.47.31.3460: [|tcp] (DF)
> 1169566779.615288 rule 18/(match) pass out on xl2: 203.81.235.185.33595 > 
> 209.0.144.88.80: [|tcp] (DF)
> 1169566779.700708 rule 18/(match) pass out on xl2: 203.81.235.185.42575 > 
> 72.14.209.85.80: [|tcp] (DF)
> 1169566779.994302 rule 1/(match) pass in on xl1: 10.0.2.8.4265 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566780.005425 rule 18/(match) pass out on xl2: 203.81.235.185.31337 > 
> 72.14.209.86.80: [|tcp] (DF)
> 1169566780.174899 rule 18/(match) pass out on xl2: 203.81.235.185.27385 > 
> 8.2.96.67.80: [|tcp] (DF)
> 1169566780.475037 rule 2/(match) pass in on xl1: 10.0.1.19.138 > 
> 10.0.255.255.138: udp 201
> 1169566780.475089 rule 22/(match) pass out on xl0: 10.0.1.19.138 > 
> 10.0.255.255.138: udp 201
> 1169566780.652249 rule 18/(match) pass out on xl2: 203.81.235.185.44777 > 
> 8.7.232.215.80: [|tcp] (DF)
> 1169566780.884663 rule 1/(match) pass in on xl1: 10.0.2.8.4266 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566780.889225 rule 18/(match) pass out on xl2: 203.81.235.185.44736 > 
> 72.14.217.189.80: [|tcp] (DF)
> 1169566780.920559 rule 2/(match) pass in on xl1: 10.0.3.6.3273 > 
> 64.182.172.11.8585: [|tcp] (DF)
> 1169566780.920608 rule 21/(match) pass out on xl0: 10.0.3.6.3273 > 
> 64.182.172.11.8585: [|tcp] (DF)
> 1169566780.927934 rule 18/(match) pass out on xl2: 203.81.235.185.2945 > 
> 66.249.91.18.80: [|tcp] (DF)
> 1169566781.046297 rule 2/(match) pass in on xl1: 10.0.1.11.137 > 
> 10.0.255.255.137: udp 50
> 1169566781.046351 rule 22/(match) pass out on xl0: 10.0.1.11.137 > 
> 10.0.255.255.137: udp 50
> 1169566781.141521 rule 18/(match) pass out on xl2: 203.81.235.185.6110 > 
> 209.0.144.87.80: [|tcp] (DF)
> 1169566781.389933 rule 2/(match) pass in on xl1: 10.0.4.19.137 > 
> 10.0.255.255.137: udp 68
> 1169566781.390009 rule 22/(match) pass out on xl0: 10.0.4.19.137 > 
> 10.0.255.255.137: udp 68
> 1169566781.505436 rule 18/(match) pass out on xl2: 203.81.235.185.12893 > 
> 66.249.91.19.80: [|tcp] (DF)
> 1169566781.634241 rule 18/(match) pass out on xl2: 203.81.235.185.3396 > 
> 209.0.144.88.80: [|tcp] (DF)
> 1169566782.052176 rule 1/(match) pass in on xl1: 10.0.3.6.3274 > 
> 10.0.0.1.53:[|domain]
> 1169566782.145289 rule 17/(match) pass in on xl1: 10.0.1.44.1405 > 
> 64.4.37.22.1863: [|tcp] (DF)
> 1169566782.145340 rule 18/(match) pass out on xl2: 203.81.235.185.60189 > 
> 64.4.37.22.1863: [|tcp] (DF)
> 1169566782.286339 rule 1/(match) pass in on xl1: 10.0.1.32.1054 > 
> 10.0.0.1.53:[|domain]
> 1169566782.773519 rule 19/(match) pass out on xl2: 203.81.235.185.37174 > 
> 192.175.48.42.53:[|domain]
> 1169566783.227876 rule 18/(match) pass out on xl2: 203.81.235.185.12589 > 
> 66.230.155.6.80: [|tcp] (DF)
> 1169566783.565189 rule 1/(match) pass in on xl1: 10.0.2.41.1603 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566783.868916 rule 1/(match) pass in on xl1: 10.0.2.8.4267 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566783.873699 rule 18/(match) pass out on xl2: 203.81.235.185.31607 > 
> 72.14.217.189.80: [|tcp] (DF)
> 1169566783.939254 rule 18/(match) pass out on xl2: 203.81.235.185.3147 > 
> 66.249.91.83.80: [|tcp] (DF)
> 1169566783.944207 rule 1/(match) pass in on xl1: 10.0.2.41.1604 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566783.948180 rule 18/(match) pass out on xl2: 203.81.235.185.39092 > 
> 64.4.15.61.80: [|tcp] (DF)
> 1169566785.695035 rule 1/(match) pass in on xl1: 10.0.0.5.2305 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566785.697572 rule 18/(match) pass out on xl2: 203.81.235.185.22226 > 
> 81.95.147.107.80: [|tcp] (DF)
> 1169566785.776452 rule 1/(match) pass in on xl1: 10.0.2.41.1605 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566785.930252 rule 1/(match) pass in on xl1: 10.0.2.41.1606 > 
> 10.0.0.1.8080: [|tcp] (DF)
> 1169566785.935663 rule 18/(match) pass out on xl2: 203.81.235.185.12836 > 
> 209.191.65.8.80: [|tcp] (DF)
> 1169566786.317411 rule 18/(match) pass out on xl2: 203.81.235.185.16717 > 
> 72.14.209.87.80: [|tcp] (DF)
> 1169566786.626559 rule 2/(match) pass in on xl1: 10.0.2.44.2212 > 
> 65.43.85.53.6667: [|tcp] (DF)
> 1169566786.626613 rule 21/(match) pass out on xl0: 10.0.2.44.2212 > 
> 65.43.85.53.6667: [|tcp] (DF)
> 1169566787.104918 rule 18/(match) pass out on xl2: 203.81.235.185.21187 > 
> 204.13.161.25.80: [|tcp] (DF)
> 1169566787.113192 rule 17/(match) pass in on xl1: 10.0.2.37.2124 > 
> 207.46.26.36.1863: [|tcp] (DF)
> 1169566787.113242 rule 18/(match) pass out on xl2: 203.81.235.185.64047 > 
> 207.46.26.36.1863: [|tcp] (DF)
> 
> my ifconfig command provides
> 
> bash-3.1# ifconfig
> lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
>         groups: lo
>         inet 127.0.0.1 netmask 0xff000000
>         inet6 ::1 prefixlen 128
>         inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
> xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
>         lladdr 00:50:04:03:fa:96
>         media: Ethernet autoselect (100baseTX full-duplex)
>         status: active
>         inet 192.168.0.2 netmask 0xffffff00 broadcast 192.168.0.255
>         inet6 fe80::250:4ff:fe03:fa96%xl0 prefixlen 64 scopeid 0x1
> xl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
>         lladdr 00:50:04:a0:39:9a
>         media: Ethernet autoselect (10baseT half-duplex)
>         status: active
>         inet 10.0.0.1 netmask 0xffff0000 broadcast 10.0.255.255
>         inet6 fe80::250:4ff:fea0:399a%xl1 prefixlen 64 scopeid 0x2
> xl2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
>         lladdr 00:10:5a:22:64:c7
>         groups: egress
>         media: Ethernet autoselect (100baseTX full-duplex)
>         status: active
>         inet6 fe80::210:5aff:fe22:64c7%xl2 prefixlen 64 scopeid 0x3
>         inet 203.81.235.185 netmask 0xffffff00 broadcast 203.81.235.255
> pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
> enc0: flags=0<> mtu 1536
> 
> i did update to OpenBSD current would be great full if you help me out.
> 
> Regards
> 
> 
>  
> 
> *:$., 88,.$:*(((*$ Stingray *:$., 88,.$:*((*$
>               
> 
> 
> 
> 
> 
> 
>  
> ____________________________________________________________________________________
> Need a quick answer? Get one in minutes from people who know.
> Ask your question on www.Answers.yahoo.com
> 






 
____________________________________________________________________________________
Never miss an email again!
Yahoo! Toolbar alerts you the instant new Mail arrives.
http://tools.search.yahoo.com/toolbar/features/mail/





 
____________________________________________________________________________________
Never miss an email again!
Yahoo! Toolbar alerts you the instant new Mail arrives.
http://tools.search.yahoo.com/toolbar/features/mail/

Reply via email to