pf (+ relayd?) as lvs replacement

[Morten Grunnet Buhl]

Our setup:

                    +--------------------+
                    |        Client      |
                    +----------+---------+
                               |
                               |
                               |
+------------------------------+-------------------------------+
|                     The World Wide Web (TM)                  |
+------------+-----------------+------------------+------------+
             |                 | Ext              |
             |          +------+------+           |
             |          |  Gentoo/LVS |           |
             |          +------+------+           |
             | Ext             |                  | Ext
             |                 |                  |
             |      +----------+-----------+      |
             |      |         Int          |      |
           +-+------+-+                 +--+------+-+
           |  FBSD1   |                 |   FBSD2   |
           +----------+                 +-----------+

GentExtif XXX.XXX.XXX.10
GentIntif 10.0.0.10

FBSD1Extif XXX.XXX.XXX.11
FBSD1lo0alias XXX.XXX.XXX.10
FBSD1Intif 10.0.0.11

FBSD2Extif XXX.XXX.XXX.12
FBSD2lo0alias XXX.XXX.XXX.10
FBSD2Intif 10.0.0.12

Gentoo/LSV
manipulates the package from a client and sends it to FBSD(1|2)
FBSD(1|2) then returns data directly to the client


As you can see, all of our machines have external ip's.
This diagram is a scaled down version of our setup. The Gentoo/LVS
machine handles more 'clusters' of (more than two) machines.
These machines are sending a lot more traffic than they are
receiving. Its therefor not feasible to route the traffic out
through one single machine as it would quickly become the bottleneck.

This setup is transparent to our users and is working quite well.

Motivation:
All our 'back-end' machines are now running *BSD. The company's only
Linux guy/defender/admin has left us.
We would therefor like to completely loose linux in our setup.
We have seen that IPVS has been ported to FreeBSD but have not had any
luck finding people that use it on a larger scale. Furthermore we would
like to make this solution more clean (if possible) using pf.



Question:
 Is this possible with pf (maybe with relayd)?


Thanks in advance for any information (positive or negative) that might
help us on our way.

/mgb