[原创]OpenBSD 3.8 + PF + PFSYNC + CARP

congli

OpenBSD 3.8 + PF + PFSYNC + CARP
日期:2005.12.1
作者:congli

参考:http://www.countersiege.com/doc/pfsync-carp/
参考:pfsync 及 carp 手册

实验环境:
VMWare 5.5,虚拟三台BSD,两台OpenBSD,一台FreeBSD.每台OpenBSD均有三块网卡.
虚拟机1:
名称:OpenBSD(GZ)
网卡pcn0:192.168.0.110/24        (接外网 vmnet0 桥接 192.168.0.0/24)
网卡pcn1:192.168.20.110/24        (接内网 vmnet2 NAT 192.168.20.0/24)
网卡pcn2:192.168.30.110/24        (pfsync vmnet3 NAT 192.168.30.0/24)
网关:192.168.0.254

虚拟机2:
名称:OpenBSD(PY)
网卡pcn0:192.168.0.120/24        (接外网 vmnet0 桥接 192.168.0.0/24)
网卡pcn1:192.168.20.120/24        (接内网 vmnet2 NAT 192.168.20.0/24)
网卡pcn2:192.168.30.120/24        (pfsync vmnet3 NAT 192.168.30.0/24)
网关:192.168.0.254

虚拟机3:
名称:FreeBSD
网卡lnc0:192.168.20.10/24        (接内网 vmnet2 NAT 192.168.20.0/24)
网关:192.168.20.200



设置:
1./etc/pf.conf(两台OpenBSD使用相同的规则),下面的规则非常简单,只用于测试.

1. 
   
2. ext_if  = "pcn0"
   
3. int_if  = "pcn1"
   
4. sync_if = "pcn2"
   
5. loop_if = "lo0"
   
6. 
   
7. nat on $ext_if from $int_if:network to any -> $ext_if
   
8. 
   
9. pass quick on { $sync_if } proto pfsync
   
10. pass on { $ext_if $int_if } proto carp keep state
    
11. 
    
12. pass in quick all keep state
    
13. pass out quick all keep state
    

复制代码

2.在OpenBSD(GZ)和OpenBSD(PY)中,分别增加下面文件.
# vi /etc/hostname.carp0

1. vhid 1 pass foo 192.168.0.200 255.255.255.0

复制代码

# vi /etc/hostname.carp1

1. vhid 2 pass bar 192.168.20.200 255.255.255.0

复制代码

# vi /etc/hostname.pfsync0

1. syncpeer 192.168.30.200 syncdev pcn2

复制代码

# vi /etc/rc.conf.local

1. pf=YES

复制代码

3.设置FreeBSD
# vi /etc/rc.conf

1. 
   
2. defaultrouter="192.168.20.200"
   
3. ifconfig_lnc0="inet 192.168.20.10 netmask 255.255.255.0"
   

复制代码

# vi /etc/resolv.conf

1. 
   
2. nameserver 202.96.128.68
   
3. nameserver 202.96.134.133
   

复制代码

4.设置完毕之后,重启三台虚拟机.

5.简单测试:
在FreeBSD虚拟机中,ping一个Internet上的真实IP,随便关闭那一台OpenBSD都可以.

附ifconfig
1.OpenBSD(GZ)

1. 
   
2. lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
   
3.         groups: lo
   
4.         inet 127.0.0.1 netmask 0xff000000
   
5. pcn0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
   
6.         lladdr 00:0c:29:fe:67:4b
   
7.         groups: egress
   
8.         media: Ethernet autoselect (autoselect)
   
9.         inet 192.168.0.110 netmask 0xffffff00 broadcast 192.168.0.255
   
10. pcn1: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
    
11.         lladdr 00:0c:29:fe:67:55
    
12.         media: Ethernet autoselect (autoselect)
    
13.         inet 192.168.20.110 netmask 0xffffff00 broadcast 192.168.20.255
    
14. pcn2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
15.         lladdr 00:0c:29:fe:67:5f
    
16.         media: Ethernet autoselect (autoselect)
    
17.         inet 192.168.30.110 netmask 0xffffff00 broadcast 192.168.30.255
    
18. pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
    
19. pfsync0: flags=0<> mtu 1348
    
20.         pfsync: syncdev: pcn2 syncpeer: 192.168.30.200 maxupd: 128
    
21. enc0: flags=0<> mtu 1536
    
22. carp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
23.         carp: BACKUP carpdev pcn0 vhid 1 advbase 1 advskew 0
    
24.         groups: carp
    
25.         inet 192.168.0.200 netmask 0xffffff00 broadcast 255.255.255.0
    
26. carp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
27.         carp: BACKUP carpdev pcn1 vhid 2 advbase 1 advskew 0
    
28.         groups: carp
    
29.         inet 192.168.20.200 netmask 0xffffff00 broadcast 255.255.255.0
    

复制代码

2.OpenBSD(PY)

1. 
   
2. lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
   
3.         groups: lo
   
4.         inet 127.0.0.1 netmask 0xff000000
   
5. pcn0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
   
6.         lladdr 00:0c:29:cc:f5:37
   
7.         groups: egress
   
8.         media: Ethernet autoselect (autoselect)
   
9.         inet 192.168.0.120 netmask 0xffffff00 broadcast 192.168.0.255
   
10. pcn1: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
    
11.         lladdr 00:0c:29:cc:f5:41
    
12.         media: Ethernet autoselect (autoselect)
    
13.         inet 192.168.20.120 netmask 0xffffff00 broadcast 192.168.20.255
    
14. pcn2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
15.         lladdr 00:0c:29:cc:f5:4b
    
16.         media: Ethernet autoselect (autoselect)
    
17.         inet 192.168.30.120 netmask 0xffffff00 broadcast 192.168.30.255
    
18. pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
    
19. pfsync0: flags=0<> mtu 1348
    
20.         pfsync: syncdev: pcn2 syncpeer: 192.168.30.200 maxupd: 128
    
21. enc0: flags=0<> mtu 1536
    
22. carp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
23.         carp: MASTER carpdev pcn0 vhid 1 advbase 1 advskew 0
    
24.         groups: carp
    
25.         inet 192.168.0.200 netmask 0xffffff00 broadcast 255.255.255.0
    
26. carp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    
27.         carp: MASTER carpdev pcn1 vhid 2 advbase 1 advskew 0
    
28.         groups: carp
    
29.         inet 192.168.20.200 netmask 0xffffff00 broadcast 255.255.255.0
    

复制代码

3.FreeBSD

1. 
   
2. # ifconfig
   
3. lnc0: flags=108843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
   
4.         inet 192.168.20.10 netmask 0xffffff00 broadcast 192.168.20.255
   
5.         inet6 fe80::20c:29ff:fe1d:bbda%lnc0 prefixlen 64 scopeid 0x1
   
6.         ether 00:0c:29:1d:bb:da
   

复制代码

[ 本帖最后由 congli 于 2005-12-2 09:18 编辑 ]

mafa

好贴！收藏了！

MichaelBibby

偶的机子（Althon XP 1800+，RAM 256M）虚拟一台OPENBSD（100M RAM）都已经够折磨我的了

congli

原帖由 MichaelBibby 于 2005-12-1 23:10 发表
偶的机子（Althon XP 1800+，RAM 256M）虚拟一台OPENBSD（100M RAM）都已经够折磨我的了

呵~~BSD就给他32MB的RAM也可以啊,做实验时,每台OpenBSD分了64 MB,FreeBSD分了128 MB

mafa

你把内存调小点不行吗？我的弄成64M。

loveKDE

呵呵。。对OB不熟悉啊

mafa

喜欢bsd就因该都熟悉一下，真的是各有各的特点。

congli

原帖由 mafa 于 2005-12-1 23:18 发表
喜欢bsd就因该都熟悉一下，真的是各有各的特点。

呵~~有时间跟兄弟学一下NetBSD.

loveKDE

我有是有这样的机器。办公室给我弄的专门做实验的。P43.0  2G  36G scsi
可惜可能主板有毛病。跑windows无论什么版本都死机。但是跑linux整死不死。BSD也不死。。但是
linux和BSD下的虚拟机搞不定。老大说换主板。不知道要等到哪年去了。。

congli

原帖由 loveKDE 于 2005-12-1 23:34 发表
我有是有这样的机器。办公室给我弄的专门做实验的。P43.0  2G  36G scsi
可惜可能主板有毛病。跑windows无论什么版本都死机。但是跑linux整死不死。BSD也不死。。但是
linux和BSD下的虚拟机搞不定。老大说换主板 ...

倒,能弄到这样的机器来做实验,难道一块板还搞不定.呵~~~