Routing

NDRS · Dec 30, 2010

Hello I have the following setup:

Code:

                           public ip xl0
 OBSD4.6        [GW]
                              |      tun0 public (xx.xx.xx.xx) ip from tunnel provider (openvpn tunnel from PRQ with 4 public ips)
                              |      vlan2 10.0.1.1
                              |      trunk0  10.0.0.1
                              |
                          [sw0]
                              |
                    Boxes on different vlans

The tunnel takes over the the whole Internet connection, therefore I had to use on my gw:

Code:

pass in on trunk0 route-to ($wan 85.227.16.129) proto {tcp, udp, icmp} from 10.0.0.0/24 to any
pass in on vlan2 route-to ($wan 85.227.16.129) proto {tcp, udp, icmp} from 10.0.1.0/24 to any

To make local traffic go through my ISP.

I've managed to alias the other public ips on different FreeBSD boxes. And then to create routes to them with:

route add yyy.yyy.yyy.yyy/32 10.0.1.252 (10.0.1.252 is one of the boxes I want to put public ip addresses on to)
Tracerouting works fine, I can ssh into it from the outside (from another isp) ( it's slow to login due dns issues ).

The problem is now that from ie 10.0.1.252 I cant access Internet, it works fine from the lan that is on trunk0 though (10.0.0.0/24).
I can however ssh into it from the outside using it's public ip-adress. (yyy.yyy.yyy.yyy)

The simple question is, how do I create routes on the freebsd machines to make it work as I desire?

Would I need policy/source-based routing with pf on the freebsd boxes.

I've made some attempts my self with:

Code:

pass out on $ext_if route-to ($ext_if xxx.xxx.xxx.xxx) from yyy.yyy.yyy.yyy to any

To make traffic iniated from yyy.yyy.yyy.yyy to go through the tun0-interface (xxx.xxx.xxx) on the gw.
However that did not work.

Any help is appreciated, I've been busting my balls the last few days to get this to work.

Routing

NDRS