rendered paste body
~~~
( net )
~~~
|
|
|
----------
| switch |
----------
/ \
/ VIP \
---------- ----------
| FW1 | | FW2 |
---------- ----------
\ VIP /
\ /
----------
| switch |
----------
/ \
/ \
---------- ----------
| server1 | | server2 |
---------- ----------
FW2
out XL2 204.18.109.138
mid XL1 10.10.10.1
in XL0 172.16.0.2
shared carp 0-1-2 204.18.109.140
shared carp2 and carp 3 172.16.0.200
FW1
out XL2 204.18.109.139
mid XL1 10.10.10.2
in XL0 172.16.0.1
shared carp 0-1-2 204.18.109.140
shared carp2 and carp 3 172.16.0.200
SERVER 1
ip 172.16.0.100/24
GW 172.16.0.200
172.16.0.101 SERVER 2
SERVER 2
ip 172.16.0.101/24
GW 172.16.0.200
MES iconfig
xl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=9<RXCSUM,VLAN_MTU>
inet 172.16.0.1 netmask 0xffffff00 broadcast 172.16.0.255
inet6 fe80::201:3ff:febe:84d4%xl0 prefixlen 64 scopeid 0x1
ether 00:01:03:be:84:d4
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
xl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=9<RXCSUM,VLAN_MTU>
inet 10.10.10.1 netmask 0xffffff00 broadcast 10.10.10.255
inet6 fe80::201:2ff:fe43:c106%xl1 prefixlen 64 scopeid 0x2
ether 00:01:02:43:c1:06
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
xl2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=9<RXCSUM,VLAN_MTU>
inet 204.18.109.139 netmask 0xfffffff8 broadcast 204.18.109.143
inet6 fe80::240:caff:fe97:3c6c%xl2 prefixlen 64 scopeid 0x3
ether 00:40:ca:97:3c:6c
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33208
pfsync0: flags=41<UP,RUNNING> mtu 1348
inet 10.10.10.1 netmask 0xff000000
pfsync: syncif: xl1 maxupd: 128
carp0: flags=41<UP,RUNNING> mtu 1500
inet 204.18.109.140 netmask 0xfffffff8
inet 204.18.109.141 netmask 0xfffffff8
carp: BACKUP vhid 1 advbase 1 advskew 0
carp1: flags=41<UP,RUNNING> mtu 1500
inet 204.18.109.140 netmask 0xfffffff8
inet 204.18.109.141 netmask 0xfffffff8
carp: BACKUP vhid 2 advbase 1 advskew 100
carp2: flags=41<UP,RUNNING> mtu 1500
inet 172.16.0.200 netmask 0xffffff00
carp: BACKUP vhid 1 advbase 1 advskew 0
carp3: flags=41<UP,RUNNING> mtu 1500
inet 172.16.0.200 netmask 0xffffff00
carp: BACKUP vhid 2 advbase 1 advskew 100
Mais je ne peux meme pas ping outside ni dns
voici pf.conf
set limit { states 20000, frags 20000 }
#set optimization aggressive
set optimization normal
set block-policy return
set debug loud
#
# Variable definitions.
#
# My ext_if interface. pf can also interpret ext_if_interface as an ip.
# This is very practical for dynamic ips.
ext_if = "xl2"
int_if = "xl0"
loop = "lo0"
pfsync_if="xl1"
carp_intif = "carp2 carp3"
all_if = "{" $ext_if $int_if $carp_intif "}"
allint_if = "{" $int_if $carp_intif "}"
internal_net="172.16.0.200"
external_addr="204.88.109.140"
carp_ext="204.18.109.140"
carp_int="172.16.0.200"
table <myinternal> { 172.16.0.1, 172.16.0.200}
table <allint> { $internal_net, 172.16.0.1, 172.16.0.2, 172.16.0.100, 172.16.0.101 }
table <asts> { 172.16.0.100, 172.16.0.101 }
# TCP_OPTIONS = "flags S/SAFRUP keep state"
TCP_OPTIONS = "flags keep state"
# http://www.iana.org/assignments/ipv4-address-space
# http://rfc.net/rfc1918.html
reserved = " {
0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8,
169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16,
224.0.0.0/3, 255.255.255.255 } "
server = "{ smtp, http , 4569, 5060}"
allowed_outgoing = "{ ssh, smtp, finger, http, https, pop3, 4569, 5060, 1978,53 }"
scrub in on $ext_if all
pass in log-all all
pass out log-all all
#pfsync0
pass on $pfsync_if proto pfsync
#carp iface
pass quick log-all on { $ext_if $int_if } proto carp keep state
#local iface
pass out quick on lo0
pass in quick on lo0
#xl2 out
pass out log-all on $ext_if all
pass in log-all on $ext_if all
#xl0 inter
pass out log-all on $allint_if all
pass in log-all on $allint_if all
pass out log-all on $ext_if keep state