[已经解决]请教一个openbsd关于策略路由的问题

testab

弱弱的问

  openbsd 三块网卡   外网 202.202.202.202/29   em2
                                  内网 192.168.1.1/24           em1
                                  内网 192.168.2.1/24           em0

192.168.2.10/32的默认网关是  192.168.2.1
需要从192.168.2.10/32访问3.3.3.3/32 的下一跳是 192.168.2.2/32
这个如何做呢？ pf ？ 还是其他方法？ 谢谢 。
是否也能支持到 默认网关192.168.2.1/32 但 192.168.2.10/32访问3.3.3.3/32 的 http,dns,mail 服务下一跳是 192.168.2.2/32  ，

用bgp实现的暂时就不考虑了,十分感谢 ：-)

[ 本帖最后由 testab 于 2009-4-10 13:02 编辑 ]

axlrose

http://bbs.chinaunix.net/viewthread.php?tid=1011361 [FreeBSD] Freebsd PF 做策略路由

不知道是否适合楼主？GOOGLE找到很多

testab

google上找到得很多和官网上的pf-faq 中提到的负载均衡实例和原理都是一样的.
不是我想要实现的功能。 同时感谢楼上的.

testab

难道是,我太弱了...
解决了 应该这样写...


pass out log on em0 route-to (em0 192.168.2.2) inet from 192.168.2.10   to 3.3.3.3  flags S/SA keep state



网站上写着

ROUTING
     If a packet matches a rule with a route option set, the packet filter
     will route the packet according to the type of route option.  When such a
     rule creates state, the route option is also applied to all packets
     matching the same connection.

     fastroute
           The fastroute option does a normal route lookup to find the next
           hop for the packet.

     route-to
           The route-to option routes the packet to the specified interface
           with an optional address for the next hop.  When a route-to rule
           creates state, only packets that pass in the same direction as the
           filter rule specifies will be routed in this way.  Packets passing
           in the opposite direction (replies) are not affected and are routed
           normally.

     reply-to
           The reply-to option is similar to route-to, but routes packets that
           pass in the opposite direction (replies) to the specified inter-
           face.  Opposite direction is only defined in the context of a state
           entry, and reply-to is useful only in rules that create state.  It
           can be used on systems with multiple external connections to route
           all outgoing packets of a connection through the interface the in-
           coming connection arrived through (symmetric routing enforcement).

     dup-to
           The dup-to option creates a duplicate of the packet and routes it
           like route-to.  The original packet gets routed as it normally
           would.

[ 本帖最后由 testab 于 2009-4-9 13:50 编辑 ]