Client Load Balancing: LSNAT-router using IPFW and NATD on FreeBSD 6.0

The Internet gateways must reside in different logical networks for this configuration to work.

Compile Custom Kernel

options IPFIREWALL options IPFIREWALL_FORWARD options IPDIVERT options IPFIREWALL_FORWARD_EXTENDED

Configure System (/etc/rc.conf)

firewall_enable="yes" firewall_type="/etc/ipfw.rules" ifconfig_ste0="195.16.87.38/29" ifconfig_ste0_alias0="192.168.102.62/24" ifconfig_fxp0="192.168.10.1/24" defaultrouter="192.168.102.1" gateway_enable="yes" natd_enable="yes" natd_flags="-f /etc/natd.conf"

Configure NATD (/etc/natd.conf)

instance default alias_address 192.168.102.62

instance other alias_address 195.16.87.38 port 8669

globalport 9000

Configure IPFW (/etc/ipfw.rules)

-f flush

add skipto 20000 ip from any to 192.168.102.62 in via ste0 add skipto 30000 ip from any to 195.16.87.38 in via ste0

add divert 9000 ip from any to any out via ste0 add skipto 40000 ip from { 192.168.102.62 or 195.16.87.38 } to any out via ste0 add prob .5 skipto 20000 ip from any to any out via ste0 add skipto 30000 ip from any to any out via ste0

add skipto 40000 ip from any to any

add 20000 divert natd ip from any to any add skipto 40000 ip from any to any

add 30000 divert 8669 ip from any to any add skipto 40000 ip from any to any

add 40000 check-state add deny ip from 192.168.10.0/24 to any via ste0 add allow ip from me to me via lo0 keep-state add deny ip from me to any in

add allow ip from 195.16.87.38 to { me or 195.16.87.32/29 or

192.168.102.0/24 or 192.168.10.0/24 } keep-state add forward 195.16.87.33 ip from 195.16.87.38 to any keep-state add allow ip from me to any keep-state add deny ip from me to any add allow icmp from any to me icmptypes 3,4,8,11 keep-state add deny ip from any to me

add allow ip from 192.168.10.0/24 to any keep-state add deny ip from 192.168.10.0/24 to any add allow icmp from any to 192.168.10.0/24 icmptypes 3,4,11 keep-state add deny ip from any to 192.168.10.0/24