Re: pf/nat question: Two internet connections - separating outgoing packets per port number?

[Jon Radel <jon_(_at_)_radel_(_dot_)_com>]

Should be completely doable.  I just suspect you're going to have to use 
somewhat different config statements.  :-)

I do something very similar where my default route is out my T-1, which 
is where I want all the important traffic to go.  However, I want my 
bittorrent sessions to go across a cable modem I also have.  The 
statements of greatest interest from my config are:

nat on $pt_ext_if from $int_addr to any -> $pt_ext_addr
nat on $cox_ext_if from $int_addr to any -> $cox_ext_addr

pass in on $int_if route-to ($cox_ext_if $cox_ext_gw) proto tcp from 
$torrent_client \
        to any port 6881:6889 keep state

In other words, depend on kernel routing for the default cases, NAT 
appropriately on all the external interfaces, and then use "route-to" on 
anything you want to do policy routing on as it arrives on the internal 
interface.  Making that routing determination as it leaves the external 
interface is a touch late.

That should give you enough to get started.

[For people reading along in detail, yes I know that doesn't catch all 
bittorrent connections.  It gets enough of them for me.  I welcome 
suggestions on improvements.  :-) ]

--Jon Radel
jon_(_at_)_radel_(_dot_)_com

Rickard Borgmäster wrote:
> Hi,
>
> This issue has for sure been discussed a few times. Didn't find anything
> in the archives matching my exact question though.
>
> This is the case:
>
> A friend of mine, living in a dorm room with 10Mit Half-duplex internet
> access. Since the connection is halv duplex, it isn't a good idea to play
> <whatever online shoot-em-up game> while downloading a huge file on FTP.
> His neighbor, in the room next to his, also a frequent gamer, thought that
> there must be a solution. So the asked me if I knew of any.
>
> What I thought of, is if it would be possible to utilise both of their
> Internet connections. Using one for online gaming, and the other for
> <the rest>. Example:
>
> OpenBSD FW with 3 interfaces:
> ext0 -> Internet Connection 1
> ext1 -> Internet Connection 2
> int0 -> Internal network with NAT
>
> If we then assume that <whatever online game> connects to port 5000 on the
> game server, the pf nat rules could look like this:
>
> nat on ext0 from 192.168.0.0/24 to any port 5000 -> ($ext0_ip)
> nat on ext1 from 192.168.0.0/24 to any -> ($ext1_ip)
>
> The hour is a bit late, but to me this seems fine. If the destination port
> is 5000, put out the packet using ext0 (using ext0 ip as sender), else use
> ext1 (using ext1 ip as sender). Both of these connections use the same
> router (as it is a dorm LAN), so only one default gateway would need to be
> set in the OpenBSD configuration.
>
> What do you think of this? Could it work or am I going to spend my time
> with something undoable trying to set this up?