Re: FW: Address pools

Wrong mailing list.
See http://www.openbsd.org/mail.html


On Sat, 30 Apr 2011 10:02:17 +0800, Joel wrote:

>Hi!
>
> 
>
>With the example of pf rules on http://www.openbsd.org/faq/pf/pools.html its
>not working for me.
>
> 
>
>lan_net = "192.168.0.0/24"
>
>int_if  = "dc0"
>
>ext_if1 = "fxp0"
>
>ext_if2 = "fxp1"
>
>ext_gw1 = "68.146.224.1"
>
>ext_gw2 = "142.59.76.1"
>
> 
>
>#  nat outgoing connections on each internet interface
>
>match out on $ext_if1 from $lan_net nat-to ($ext_if1)
>
>match out on $ext_if2 from $lan_net nat-to ($ext_if2)
>
> 
>
>#  default deny
>
>block in
>
>block out
>
> 
>
>#  pass all outgoing packets on internal interface
>
>pass out on $int_if to $lan_net
>
>#  pass in quick any packets destined for the gateway itself
>
>pass in quick on $int_if from $lan_net to $int_if
>
>#  load balance outgoing traffic from internal network. 
>
>pass in on $int_if from $lan_net \
>
>    route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } \
>
>    round-robin
>
>#  keep https traffic on a single connection; some web applications,
>
>#  especially "secure" ones, don't allow it to change mid-session
>
>pass in on $int_if proto tcp from $lan_net to port https \
>
>    route-to ($ext_if1 $ext_gw1)
>
> 
>
>#  general "pass out" rules for external interfaces
>
>pass out on $ext_if1
>
>pass out on $ext_if2
>
> 
>
>#  route packets from any IPs on $ext_if1 to $ext_gw1 and the same for
>
>#  $ext_if2 and $ext_gw2
>
>pass out on $ext_if1 from $ext_if2 route-to ($ext_if2 $ext_gw2)
>
>pass out on $ext_if2 from $ext_if1 route-to ($ext_if1 $ext_gw1) 
>
> 
>
> 
>
>But when I put one of the gateways on /etc/mygate, my client pc can now
>connect to internet but only for that gateway that I put on /etc/mygate.  Is
>this suppose to work without the /etc/mygate file?
>
> 
>
>Joel
>

*** NOTE *** Please DO NOT CC me. I <am> subscribed to the list.
Mail to the sender address that does not originate at the list server is tarpitted. The reply-to: address is provided for those who feel compelled to reply off list. Thankyou.

Rod/
---
This life is not the real thing.
It is not even in Beta.
If it was, then OpenBSD would already have a man page for it.