View Single Post
  #1   (View Single Post)  
Old 23rd May 2012
eherrera eherrera is offline
New User
 
Join Date: May 2012
Posts: 2
Default Load balancing network traffic with PF

I have OpenBSD running as a firewall in a PC with 3 network interfaces, one is used for the intranet and teh other two for the external network and i was expecting to do Load Balancing to improve the two external connections use so i found this code at the PF FAQ

Code:
lan_net = "192.168.0.0/24"
int_if  = "dc0"
ext_if1 = "fxp0"
ext_if2 = "fxp1"
ext_gw1 = "aaa.bbb.ccc.ddd"
ext_gw2 = "eee.fff.ggg.hhh"

#  nat outgoing connections on each internet interface
match out on $ext_if1 from $lan_net nat-to ($ext_if1)
match out on $ext_if2 from $lan_net nat-to ($ext_if2)

#  default deny
block in
block out

#  pass all outgoing packets on internal interface
pass out on $int_if to $lan_net
#  pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if
#  load balance outgoing traffic from internal network. 
pass in on $int_if from $lan_net \
    route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } \
    round-robin
#  keep https traffic on a single connection; some web applications,
#  especially "secure" ones, don't allow it to change mid-session
pass in on $int_if proto tcp from $lan_net to port https \
    route-to ($ext_if1 $ext_gw1)

#  general "pass out" rules for external interfaces
pass out on $ext_if1
pass out on $ext_if2

#  route packets from any IPs on $ext_if1 to $ext_gw1 and the same for
#  $ext_if2 and $ext_gw2
pass out on $ext_if1 from $ext_if2 route-to ($ext_if2 $ext_gw2)
pass out on $ext_if2 from $ext_if1 route-to ($ext_if1 $ext_gw1)
I supoused to do exetly what a want, the problem comes at

Code:
#  keep https traffic on a single connection; some web applications,
#  especially "secure" ones, don't allow it to change mid-session
pass in on $int_if proto tcp from $lan_net to port https \
    route-to ($ext_if1 $ext_gw1)
here is my question, what happens if ext_if1 is down? is there some how to recognice when an interface is down and switch among them?

Last edited by ocicat; 23rd May 2012 at 11:15 PM. Reason: redacting public IP addresses -- spammers may harvest these...
Reply With Quote