Re: Load balancing outgoing traffic

[Stefano Marinelli <postnet%dragas.dyndns.org@localhost>]

Hello Dalibor,

> NetBSD has older version of pf. Syntax for pf has changed (OpenBSD 4.6
> -> 4.7) on nat/rdr/binat rules in favor of using match keyword. Here
> is the upgrade guide that describes the change and solution:
> 
> http://www.openbsd.org/faq/upgrade47.html#newPFnat

Thank you very much! I modified the pf.conf and works perfectly, doing a good 
round robin job. For future reference, I will post my modified script here.
I could not find a solution for the https fix part (my knowledge of pf isn't 
very good), anyway it's a starting point.
(now for search engines :-))
So if you want to do Load balancing of outgoing traffic on NetBSD 5, you should 
do something like that:

-------

lan_net = "172.16.5.0/24"
int_if  = "pcn2"
ext_if1 = "pcn0"
ext_if2 = "pcn1"
ext_gw1 = "172.16.154.1"
ext_gw2 = "192.168.0.1"

scrub in all

#  nat outgoing connections on each internet interface
nat on $ext_if1 from $lan_net -> ($ext_if1)
nat on $ext_if2 from $lan_net -> ($ext_if2)

#  default deny
block in
block out

#  pass all outgoing packets on internal interface
pass out on $int_if to $lan_net
#  pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if
#  load balance outgoing traffic from internal network.
pass in on $int_if \
        route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
        from $lan_net 

#  keep https traffic on a single connection; some web applications,
#  especially "secure" ones, don't allow it to change mid-session
##pass in on $int_if proto tcp from $lan_net to port https \
##    route-to ($ext_if1 $ext_gw1)

#  general "pass out" rules for external interfaces
pass out on $ext_if1
pass out on $ext_if2

#  route packets from any IPs on $ext_if1 to $ext_gw1 and the same for
#  $ext_if2 and $ext_gw2

pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2
pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1

-------