OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Scott Francis (darkuncle_at_darkuncle.net)
Date: Wed Oct 23 2002 - 14:36:53 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Wed, Oct 23, 2002 at 08:46:59PM +0200, ziga.huskiczejn.si said:
    > Ok so I have 10workstations, linux application|samba|domain|... server,
    > Open BSD gateway with firewall.
    >
    > BSD box has 4 ether-net cards. One is connected inside. 3 should serve i
    > as uplink to inter net.
    >
    > Than I have 3 ADSL lines, all on same ISP. At present I use pppoe to
    > connect the office to the inter net, but i only use one. That means 2
    > ADSL lines are not used.
    >
    > All I want to do now is to have 3x as fast connection as I have now, by
    > means of using the 2 unused ADSL.

    You're talking about bonding DSL lines, which (IIRC) has been discussed
    before once or twice. Check the archives for "load balancing" "rate limiting"
    and "bonding" ...

    > So this means following:
    > 1. as UN-complicated as possible
    > 2. without the need for ISP to set anything on it's side (if possible)
    > in order for me to be as independent as possible from others and from
    > other problems
    >
    > I would imagine this to be done in something like this:
    > - incoming packets all come by one single ADSL (means download).

    stop right there. :) Having your ingress traffic come in on a different path
    than the egress traffic took on the way out is asymmetric routing, and that
    pretty much _requires_ some kind of routing to be going on (BGP most
    generally). The source address of outgoing IP packets will be used by the
    destination machines in order to send the replies. Think about it for a few
    minutes.

    > - outgoing should use other 2 lines, 1st packet left 2nd packet
    > right,...

    altqd(8) can rate limit; but to specify different routes based on source IP
    (which is, I think, the best you can do in this situation), you need to
    investigate some of the options in pf.conf(5). Basically, I'd divide up your
    internal machines into groups, and setup your pf.conf such that packets from
    group A get routed through interface 1 with gateway X, packets from group B
    get routed through interface 2 with gateway Y, etc.

    > but would be prettier if all 3 could be used for outgoing if need be
    > and all are free.

    You may as well use all 3 for outgoing; there's no way you can do asymmetric
    routing unless you are, well, ROUTING. :) That means BGP or some other
    routing protocol, which means considerable setup on the part of your ISP.

    > I hope it is clear what i want to do now... Use all 3 ADSL for
    > connection and not only one as I do now. Traffic should be somehow
    > balanced between the 3 lines.

    CC'ing the list for the sake of archives (and hopefully discussion by those
    who have dealt with this problem before).

    > thanks for helping me,
    >
    > On Wed, Oct 23, 2002 at 09:15:32AM -0700, Scott Francis wrote:
    > > Perhaps the OP could clarify his setup and exactly what he was trying to
    > > accomplish?
    > --
    > Ziga Huskic

    --
    -= Scott Francis || darkuncle (at) darkuncle (dot) net =-
      GPG key CB33CCA7 has been revoked; I am now 5537F527
            illum oportet crescere me autem minui
    

    [demime 0.98d removed an attachment of type application/pgp-signature]