Load balancing ipfw + NAT
Grégoire Leroy
gregoire.leroy at retenodus.net
Thu Jun 30 01:12:55 UTC 2011
Hi,
I try to use load-balancing with IPFW. I've 3 lines : 2 ADSL and 1 SDSL. I try
to loadbalance http trafic on ADSL1(192.168.7.1) and ADSL2(192.168.6.1).
My gateway has 4 network devices. 1 for each line (em 1 ->192.168.5.10, em2 ->
192.168.6.10, em3 ->192.168.7.10), and one for local network (em0 ->
192.168.4.1)
On my gateway, there are 3 nat instances :
natd -p 8868 -dynamic -interface em3
natd -p 8869 -dynamic -interface em2
natd -p 8868 -dynamic -interface em1
Here is my config relative to the load balanc :
$cmd 300 divert 8868 ip from any to any via $adsl1_if
$cmd 301 divert 8869 ip from any to any via $adsl2_if
$cmd 302 divert 8870 ip from any to any via $sdsl_if
$cmd 00320 check-state
$cmd 0670 prob 0.5 skipto 17000 tcp from $clients to any $tcp_web setup $ks
$cmd 0671 skipto 19000 tcp from $clients to any $tcp_web setup $ks
$cmd 017000 divert 8868 ip from $clients to any in
$cmd 017500 divert 8868 ip from $clients to any out
$cmd 017700 allow all from any to any
$cmd 019000 divert 8869 ip from $clients to any out
$cmd 019500 divert 8869 ip from $clients to any in
$cmd 19700 allow all from any to any
$cmd 17550 fwd $isp1 ip from 192.168.7.10 to any
$cmd 19550 fwd $isp2 ip from 192.168.6.10 to any
$cmd 23500 fwd $isp3 ip from 192.168.5.10 to any
$cmd 65534 allow all from any to any
ipfw show :
00300 16789 17438940 divert 8868 ip from any to any via em3
00301 0 0 divert 8869 ip from any to any via em2
00302 0 0 divert 8870 ip from any to any via em1
00670 6409 7934908 prob 0.500000 skipto 17000 tcp from 192.168.4.2 to any
dst-port 80,443,25,3128 setup keep-state
00671 21464 26576872 skipto 19000 tcp from 192.168.4.2 to any dst-port
80,443,25,3128 setup keep-state
17000 1145 59132 divert 8868 ip from 192.168.4.2 to any in
17500 0 0 divert 8868 ip from 192.168.4.2 to any out
17700 6409 7934908 allow ip from any to any
19000 0 0 divert 8869 ip from 192.168.4.2 to any out
19500 3848 198584 divert 8869 ip from 192.168.4.2 to any in
The skipto seems good, so I don't understand why I don't catch packet with a
tcpdump on em2 : it seems that all web traffic pass by em3.
Can someone explain me what is wrong ?
PS : my work is based on http://lists.freebsd.org/pipermail/freebsd-ipfw/2003-
August/000399.html
Regards,
Grégoire leroy
More information about the freebsd-ipfw
mailing list