Routing by source address

[Daniel Fuehrer]

Hi,

within a NetBSD installation, I connect to several ISPs via PPPoE using tap
devices. This works fine, but there's a problem with the routing:

In order to send packets over a certain connection, the socket is being
bound to the correspondending IP, but that gives me a "no route to host"
unless I change the default gateway. However, this is no practical solution
since I want to use all PPPoE sessions simultanously.

Therefore, I have to tell NetBSD that it should route all packets
originating from the IP of ISP #1 through the gateway of ISP #1 and so on
(some kind of routing by source address).

There's a how-to for Linux here:
http://www.lartc.org/howto/lartc.rpdb.multiple-links.html

I'd be really glad if someone could describe a working solution for NetBSD
(using pf, ipf or whatever).

Bye

Daniel


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Hubert Feyrer]

Post by Daniel Fuehrer
I'd be really glad if someone could describe a working solution for NetBSD
(using pf, ipf or whatever).

http://www.feyrer.de/NetBSD/blog.html/nb_20050114_4.html


- Hubert

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[der Mouse]

Post by Daniel Fuehrer
Therefore, I have to tell NetBSD that it should route all packets
originating from the IP of ISP #1 through the gateway of ISP #1 and
so on (some kind of routing by source address).

I found myself wanting to do this, so I created something that did it.

It's a pseudo-interface called srt (for Source RouTing). You point
your route out the srt interface and then use srtconfig to tell the srt
code where to send packets based on their ip_src fields.

Here, for example, is an excerpt from one of my house machines' startup
scripts. This machine is 216.46.5.1 on the house LAN, where the main
house uplink is managed by 216.46.5.9; it also has the backup house
netlink on ppp0, where its address is 216.46.0.70 and the other end of
the PPP link is 216.46.1.3. 216.46.5.0/28 is overlaid with
10.0.2.0/28, with the same third octet, and it has another Ethernet on
the house non-routed subnet 10.0.1.0/24.

srtconfig srt0 set 0 216.46.5.1 /32 de0 216.46.5.9
srtconfig srt0 set 1 216.46.0.70 /32 ppp0 216.46.1.3
srtconfig srt0 set 2 10.0.2.1 /32 de0 10.0.2.9
srtconfig srt0 set 3 10.0.0.0 /8 ex0 10.0.1.1
ifconfig srt0 216.46.5.1 10.0.0.1 netmask 255.255.255.255 up
route add default 10.0.0.1

Thus, the packet flow is:

packet emitted
-> default route to 10.0.0.1
-> sends it out srt0, which ignores the next-hop address (10.0.0.1)
-> the srt code checks ip_src against, in order
216.46.5.1/32 -> send it out de0, addressed to 216.46.5.9
216.46.0.70/32 -> send it out ppp0, addressed to 216.46.1.3
10.0.2.1/32 -> send it out de0, addressed to 10.0.2.9
10/8 -> send it out ex0, addressed to 10.0.1.1
anything else -> drop it on the floor

Order is important here, because the srt code checks in order. If I
found myself using it for anything big, I'd probably steal the radix
tree code and give each srt interface its own radix tree, and pick the
most specific route rather than defining it to check them in order.

You probably can't use the code directly, because it's for 1.4T, but
you're welcome to use the idea. (For that matter you're welcome to use
the code too, if you find any use for it.)

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Carl Brewer]

Post by Daniel Fuehrer
Hi,
within a NetBSD installation, I connect to several ISPs via PPPoE using
In order to send packets over a certain connection, the socket is being
bound to the correspondending IP, but that gives me a "no route to host"
unless I change the default gateway. However, this is no practical
solution since I want to use all PPPoE sessions simultanously.
Therefore, I have to tell NetBSD that it should route all packets
originating from the IP of ISP #1 through the gateway of ISP #1 and so
on (some kind of routing by source address).
http://www.lartc.org/howto/lartc.rpdb.multiple-links.html
I'd be really glad if someone could describe a working solution for
NetBSD (using pf, ipf or whatever).

AFAIK, the only way to do policy routing on NetBSD (or any of the
*BSD's?) is to use IPF or PF.

pass in quick on <default route interface> to:<alternate int>:<next hop
IP> from <> to <>

This is poorly documented and an awful hack, but it does work.




--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[der Mouse]

Post by Daniel Fuehrer
Therefore, I have to tell NetBSD that it should route all packets
originating from the IP of ISP #1 through the gateway of ISP #1 and
so on (some kind of routing by source address).

I wanted just that (for almost that application). I wrote a
source-routing pseudo-interface to do this.

It currently exists only for 1.4T, as far as I know. When I scrape
together the round tuits, I'm going to roll it forward to something
more modern, probably -current. If you want its present (1.4T) state,
look under ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/ -
specifically, sys/dev/pseudo/if_srt.[ch] for the pseudo-device driver
and usr.sbin/srtconfig/* for the configuration utility.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Thomas E. Spanjaard]

Post by der Mouse
ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/

IPv6 network unreachable; perhaps a typo?

Cheers,

[der Mouse]

Post by Thomas E. Spanjaard

Post by der Mouse
ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/

IPv6 network unreachable; perhaps a typo?

No - just dead v6 connectivity. :-þ

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[der Mouse]

Post by Thomas E. Spanjaard

Post by der Mouse
ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/

IPv6 network unreachable; perhaps a typo?

No - just dead v6 connectivity. :-=FE

Still, an address in 2610::/16 is very strange, and I get network
unreachable from my remote gateway, so I doubt broken connectivity is
the only problem here :).

"Dead v6 connectivity" is just the very abbreviated explanation. :-)

My upstream used to be using 3ffe/16 - 6boen - space. Their v6
connectivity fell apart back in February; they finally got "real" space
direct from ARIN (check "whois -h whois.arin.net 2610:98:8001::7:0").
What they don't yet have is a working upstream for it. *sigh*

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Thomas E. Spanjaard]

Post by der Mouse

Post by Thomas E. Spanjaard

Post by der Mouse
ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/

IPv6 network unreachable; perhaps a typo?

No - just dead v6 connectivity. :-=FE

Still, an address in 2610::/16 is very strange, and I get network
unreachable from my remote gateway, so I doubt broken connectivity is
the only problem here :).

My upstream used to be using 3ffe/16 - 6boen - space. Their v6
connectivity fell apart back in February; they finally got "real" space
direct from ARIN (check "whois -h whois.arin.net 2610:98:8001::7:0").
What they don't yet have is a working upstream for it. *sigh*

Wow, first time I see non-200{1,2}::/16 (and 3ffe::/16) in use :).
Couldn't they peer with e.g. SixXS?

Cheers,

[Thomas E. Spanjaard]

Post by der Mouse

Post by Thomas E. Spanjaard

Post by der Mouse
ftp.rodents.montreal.qc.ca:/mouse/source-tree/postpatches/

IPv6 network unreachable; perhaps a typo?

No - just dead v6 connectivity. :-þ

Still, an address in 2610::/16 is very strange, and I get network
unreachable from my remote gateway, so I doubt broken connectivity is
the only problem here :).

Cheers,

[der Mouse]

Post by Thomas E. Spanjaard

Post by der Mouse
What they don't yet have is a working upstream for it. *sigh*

Wow, first time I see non-200{1,2}::/16 (and 3ffe::/16) in use :).

Well, I think "in use" is a bit of a stretch at the moment. :)

Post by Thomas E. Spanjaard
Couldn't they peer with e.g. SixXS?

Quite possibly. I wasn't previously aware of SixXS. Thanks for the
pointer; I'll pass it off to the people doing that stuff.

/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Ignatios Souvatzis]

Post by Thomas E. Spanjaard
Wow, first time I see non-200{1,2}::/16 (and 3ffe::/16) in use :).

You're too young to have seen 5ffe::/16?

-is


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Carl Brewer]

Daniel Fuehrer wrote:

Mea Culpa, it should be

pass OUT quick, not pass IN quick....


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de