[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: route-to and reply-to equivalents in npf?
On Tue, Jul 25, 2017 at 10:59:16PM -0700, Brian Buhrow wrote:
> Hello. I'm working on transitioning services at our shop from
> NetBSD-5 to NetBSD-8. As part of that effort, I'm working on figuring out
> how to write configurations for npf(7) which are direct replacements for
> our pf(4) configurations. The process looks pretty straightforward, except
> for one case which we use quite extensively. In pf(4), one can use the
> route-to and reply-to rules to explicitly route packets sourced from
> certain interfaces to other interfaces. We use this to allow us to use
> public IP addresses from one ISP through a series of VPN'S, allowing us to
> provide service through non-local networks.
> As an example, here is a snippet from one of our working systems. (IP
> addresses changed to protect the innocent)
> In the below example, $dmz_if is one interface of this machine that routes
> to a local subnet. $vpn_if is the interface that runs through an IP
> tunnel. Any traffic from the $dmz_if should be routed through the $vpn_if
> instead of using the standard routing table. Any traffic originating from
> the $vpn_if destined for the $dmz_if should be return-routed to the
> This works beautifully under pf(4) under NetbSD-4 and NetBSD-5. How
> can I replicate this behavior under NetBSD-8 with npf?
A "route-to"-alike for NPF hasn't been implemented. The same is
probably true of a "reply-to"-alike.
Main Index |
Thread Index |