more than 16 routing tables ?

schmurfy

schmurfy

Hi,
I am in the process of testing freebsd to be used as a main router between clients networks, our current design (linux) uses routing tables to isolate each company from the others (a company may have multiple sites, all in the same table), while looking at freebsd options i stumbled upon ROUTETABLES which, if i am right, set the number of available routing tables on the server but it also looks like the maximum limit for it is... 16 ????
Since I found no documentation on this except in releases note (freebsd handbook is really great but some part are just not covered at all and man pages do not seem to speak about it either :/ )

is there another way to achieve isolation between networks without routing tables ? or can we use more than 16 routing tables ?

Thanks for any answer.
 
Not an expert, but:

I think the ROUTETABLES kernel option does not limit e.g. the amount of static routes you can have (like in the 'route add' statements or the 'static_routes' directives in /etc/rc.conf), but the amount of routing tables (FIBs) you can set for applications to use (applications' specific network views) (setfib(2), setfib(1)), showing up in [cmd=]sysctl net.fibs[/cmd], default 1).

If you're talking about 'simply' routing traffic through your box, I don't think the ROUTETABLES kernel option and its current limit of 16 applies, and utilities like route/routed (and/or possibly vlans?) should serve you well.
 
Here is what i am trying to build (the freebsd box is the router between all the sites):
I have 2 companies C1 and C2,C1 has two sites S1 and S2 and C2 has one site: S3
I want S1 and S2 to be able to freely connect to each other with their local addresses (each site has different local network address space) but none of them should be able to connect to S3 local network and S3 won't be able either to connect to S1 or S2.

I will try to do a quick diagram later if text is not enough ^^

Using routing tables under linux we simply put everything from or with destination S1 and S2 in a table and S3 in another, this way the two companies are isolated from each other.
I suppose i could do the same only with pf filters but it would be a lot simpler with routing tables unless I missed something.
 
Here is a graphical explanation attempt ;)
unnamed0.png
 
Posting a link that explains what "separate routing tables in Linux" is, would help. :)

Everything I've seen shows 1 routing table for everything in Linux, as managed by the route command.

The diagram you posted screams "packet filtering" to me, or static routing, not "multiple routing tables".
 
I did not said this was the only way and it can certainly be done by packet filtering, here is roughly what we use for linux :

(Sx) will be the interface leading to site x. (i don't have the exact syntax of the tools right now but the idea is there)

Code: 
ip route add default <internet_gateway_ip> table 1
ip route add <s1_lan> via (S1) table 1
ip route add <s2_lan> via (S2) table 1

ip route add default <internet_gateway_ip> table 2
ip route add <s3_lan> via (S3) table 2

ip rule add from (S1) lookup 1
ip rule add from (S2) lookup 1

ip rule add from (S3) lookup 2

lookup means redirect the packet from the main routing table (254) to this table where only the routes defined earlier apply.

It is incomplete but it should be enough to get an idea, what i was wondering is not really how to reproduce the exact config with freebsd but more how would this be done under freebsd ?

And what are routing tables used under freebsd ?
 
The FreeBSD method is multiple Forwarding Information Bases (FIBs). aka routing tables.

These are configured using the setfib() command, and the standard routing commands (route(), netstat(), etc).

And using IPFW as a classifier to assign packets to a FIB, based on the interface the packet appears on, the IP of the source, the IP of the dest, etc.

See here for an example.
 
Yeah i saw your post ( really helpful by the way :) ) but it means the limit of 16 applys.
In my example above how would you do that with more than 16 companies on the same server ? (It will clearly happens in my case)
 
At that point, you would want to revert to using just packet filtering rules (which, IMO, is simpler and easier to understand, as everything is listed in one place).
 
I agree that routing tables of fibs is not necessarily the simplest way of doing that, I will give it a try with packet filtering, thanks for the pointers :)
 
You must log in or register to reply here.
Back
Top