[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CARP



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Sun, 12 Dec 2004 10:54:28 -0500
Jason Dixon <[email protected]> wrote:
> On Dec 12, 2004, at 8:54 AM, ed wrote:
> 
> > Anyway, I have a /etc/pf.conf file which was originally for a single
> > firewall, which worked for a normal layout with two interfaces. I am
> > 
> > now
> > attempting to do the following:
> > [snip]
> > The two boxes have two interfaces, although most documentation
> > suggests using a third interface with cross over, which I don't
> > currently have.
> 
> It's not a requirement;  I've sent pfsync traffic across the int_if, 
> but it's not ideal.
> 
> > My existing firewall script allows access to 83.146.42.164 and
> > 83.146.42.165, should I be treating incoming packets as packets for
> > 83.146.42.163/4, or 83.146.42.165?
> 
> You can filter on all of them.  The "real" address on each interface 
> still allows dedicated access to each firewall.  However, when 
> filtering traffic across CARP virtual interfaces, remember that you 
> filter on the PHYSICAL interface (fxp0), not on the virtual interface 
> (carp0).
> 
> > Is it possible to provide two CARP interfaces over the fxp0 like I 
> > have,
> > and if I do, will it work as intended?
> 
> Yes, I've done many CARP interfaces using aliases on a single physical
> 
> interface.
> 
> > Needless to say, what I am trying to has not worked.
> 
> Without providing your configuration (hostname.*, pf.conf), it's 
> impossible to help you.  It would also help to know what 
> troubleshooting you've already tried and what errors/failures you're 
> encountered.
Sorry for this lengthy reply, I hope you all can forgive me for this,
but as I am but a beginner with PF/CARP I hope we can avoid hostility.
I have two boxes, with similar configs, on IP addresses 10.10.1.131 and
10.10.1.134, both /16.
- -------- 10.10.1.131 ------------
cat /etc/pf.conf
#       $OpenBSD: pf.conf,v 1.27 2004/03/02 20:13:55 cedric Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# -( pf.conf )-
# Written by Ed Neville for @UK PLC.
# Takes a /28 and distrubutes to NATed clients
# Forwards on ports 22 (ssh), 25 (mail), 80 (web), 110 (pop), 113 (auth)
# and 143 (IMAP)
# FTP sesame can provide outgoing FTP, from NAT computers in either
# ACTIVE or PASSIVE transfer. Not tested.
# FTP sesame SHOULD give FTP access to computers in DMZ, tested and does
# not work using config example 2.
# BINAT to computers where FTP is required.
# based on some work in the post of
# http://archives.neohapsis.com/archives/openbsd/2004-01/0417.html
# macro definitions
loif="lo0"
ext_if="{ dc0,carp1 }"
int_if="{ fxp0,carp0 }"
IP="83.146.42.171"
# External Addresses
BIP1="83.146.42.163"
BIP2="83.146.42.164"
CARP0="83.146.42.172"
# Internal Address
LAN="10.10.0.0/16"
# External NATs
MAIL0="192.168.1.32"
WEB0="10.10.1.250"
NS0="192.168.1.33"
FTP0="192.168.1.38"
SSH0="10.10.1.250"
#tcp_services = "{ 22, 25, 80, 110, 113, 143 }"
# Services
FTP=21
SSH=22
MAIL=25
WEB=80
POP=110
IMAP=143
NS=53
#table <spamd> persist
#table <spamd-white> persist
scrub in
# nat rules
#binat on $ext_if proto {tcp, icmp, udp} from $NS0 to any -> $BIP1
# rdr on $ext_if inet proto tcp from any to $BIP1 port $MAIL -> $MAIL0
port $MAIL nat on $ext_if from $LAN to any -> $CARP0
# blocking rules
# block all
block log all
block drop in  quick on $ext_if from $LAN to any
block drop out quick on $ext_if from any to $LAN
pass in on $ext_if proto tcp from any to $MAIL0 port $MAIL flags S/SA
synproxy state 
pass in on $ext_if proto tcp from any to $WEB0 port $WEB flags S/SA
synproxy state pass in on $ext_if proto tcp from any to $IP port $SSH
flags S/SA synproxy state pass in on $ext_if proto tcp from any to $FTP0
port $FTP flags S/SA pass in on $ext_if proto tcp from any to $NS0 port
$NS flags S/SA synproxy state pass in on $ext_if proto udp from any to
$NS0 port$NS keep state
pass in on $ext_if proto tcp from any to $FTP0 port { 1:65535 } flags
S/SAFR synproxy state
# let internal traffic out
pass in quick on lo0 all
pass out quick on lo0 all
#pass in on $int_if from $int_if:network to any keep state
#pass out on $int_if from any to $int_if:network keep state
pass in on $int_if from $LAN to any keep state
pass out on $int_if from any to $LAN keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state
pass in proto carp keep state
pass quick proto pfsync
# for i in `ls /etc/hostname.*` ; do echo $i ; cat $i ; done ;
/etc/hostname.carp0
inet 10.10.5.1 255.255.0.0 10.10.255.255 vhid 1 pass 3Waster
/etc/hostname.carp1
inet 83.146.42.172 255.255.255.240 83.146.42.175 vhid 2 pass 3Waster
/etc/hostname.dc0
inet 83.146.42.171 255.255.255.240 NONE
/etc/hostname.fxp0
#inet 10.10.1.251 255.255.0.0 NONE
#dhcp NONE NONE NONE
inet 10.10.1.131 255.255.0.0 NONE
/etc/hostname.pfsync
up syncif fxp0
- ----------- 10.10.1.134 -------------
 cat /etc/pf.conf
#       $OpenBSD: pf.conf,v 1.27 2004/03/02 20:13:55 cedric Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# -( pf.conf )-
# Written by Ed Neville for @UK PLC.
# Takes a /28 and distrubutes to NATed clients
# Forwards on ports 22 (ssh), 25 (mail), 80 (web), 110 (pop), 113 (auth)
# and 143 (IMAP)
# FTP sesame can provide outgoing FTP, from NAT computers in either
# ACTIVE or PASSIVE transfer. Not tested.
# FTP sesame SHOULD give FTP access to computers in DMZ, tested and does
# not work using config example 2.
# BINAT to computers where FTP is required.
# based on some work in the post of
# http://archives.neohapsis.com/archives/openbsd/2004-01/0417.html
# macro definitions
loif="lo0"
ext_if="{ sis0,carp1 }"
int_if="{ fxp0,carp0 }"
IP="83.146.42.174"
# External Addresses
BIP1="83.146.42.163"
BIP2="83.146.42.164"
CARP0="83.146.42.172"
# Internal Address
LAN="10.10.0.0/16"
# External NATs
MAIL0="192.168.1.32"
WEB0="10.10.1.250"
NS0="192.168.1.33"
FTP0="192.168.1.38"
SSH0="10.10.1.250"
#tcp_services = "{ 22, 25, 80, 110, 113, 143 }"
# Services
FTP=21
SSH=22
MAIL=25
WEB=80
POP=110
IMAP=143
NS=53
#table <spamd> persist
#table <spamd-white> persist
scrub in
# nat rules
#binat on $ext_if proto {tcp, icmp, udp} from $NS0 to any -> $BIP1
# rdr on $ext_if inet proto tcp from any to $BIP1 port $MAIL -> $MAIL0
port $MAIL nat on $ext_if from $LAN to any -> $CARP0
# blocking rules
# block all
block log all
block drop in  quick on $ext_if from $LAN to any
block drop out quick on $ext_if from any to $LAN
#pass in on $ext_if proto tcp from any to $MAIL0 port $MAIL flags S/SA
synproxy state
#pass in on $ext_if proto tcp from any to $WEB0 port $WEB flags S/SA
synproxy state#pass in on $ext_if proto tcp from any to $IP port $SSH
flags S/SA synproxy state#pass in on $ext_if proto tcp from any to $FTP0
port $FTP flags S/SA#pass in on $ext_if proto tcp from any to $NS0 port
$NS flags S/SA synproxy state#pass in on $ext_if proto udp from any to
$NS0 port$NS keep state
#pass in on $ext_if proto tcp from any to $FTP0 port { 1:65535 } flags
S/SAFR synproxy state
# let internal traffic out
pass in quick on lo0 all
pass out quick on lo0 all
#pass in on $int_if from $int_if:network to any keep state
#pass out on $int_if from any to $int_if:network keep state
pass in on $int_if from $LAN to any keep state
pass out on $int_if from any to $LAN keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state
pass in proto carp keep state
pass quick proto pfsync
# for i in `ls /etc/hostname.*` ; do echo $i ; cat $i ; done ;
/etc/hostname.carp0
inet 10.10.5.1 255.255.0.0 10.10.255.255 vhid 1 pass 3Waster
/etc/hostname.carp1
inet 83.146.42.172 255.255.255.240 83.146.42.175 vhid 2 pass 3Waster
/etc/hostname.fxp0
#dhcp NONE NONE NONE
inet 10.10.1.134 255.255.0.0 NONE
/etc/hostname.pfsync
up syncif fxp0
/etc/hostname.sis0
inet 83.146.42.174 255.255.255.240 NONE
- -- 
/--  _| | Regards. Please note, my PGP key ID has changed.
|-- / | | If you are planning on sending me something encrypted
\__ \_| | please update your keyring. Debian/OpenBSD. 53C9FC6C.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBv1UDjtZArFPJ/GwRAvLvAJ4rP8xsdKEqByFuvgYB/sU6+oeaaACfXCgK
xUlVkt6u/3/1m42sft7Z0Y4=
=Ai4h
-----END PGP SIGNATURE-----