Bug #3531
closed
WAN to VIP on WAN traffic routing.
0%
Description
2.1.1-PRERELEASE (i386)
built on Wed Mar 12 06:06:11 EDT 2014
FreeBSD 8.3-RELEASE-p14
I have a static IP and a routed /29 subnet from my ISP
When I ping a VIP from on the LAN interface (or from the FW Diagnostics), the traffic is passed to the gateway IP assigned by the PPPoE connection and is then reflected back to the WAN interface, in my case this gateway is at the other end of my fibre at my ISP.
where X.Y.1.88/29 are VIPs on the FW
and X.Y.12.68 is the GW given by PPPoE
and X.Y.28.117 is the IP given by PPPoE
Ping output:
PING X.Y.1.91 (X.Y.1.91): 56 data bytes
36 bytes from A.B.C.D.com (X.Y.12.68): Redirect Host(New addr: X.Y.28.117)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 1b67 0 0000 40 01 995f X.Y.28.117 X.Y.1.91
I can't extend the subnet mask on the WAN as it is controlled by the ISP and is 255.255.255.255 as per :
inet X.Y.28.117 --> X.Y.12.68 netmask 0xffffffff
from ifconfig, and also would lose me access to a lot of IP's that would fall within the subnet needed.
It doesn't seem possible to set a static route either as only WAN_PPPOE (X.Y.12.68), null 4 (127.0.0.1) or null6 (::1) are available.
Updated by Chris Buechler almost 11 years ago
- Status changed from New to Rejected
that's the expected and correct behavior where you don't have IP alias (or CARP, though don't use that in this scenario w/PPPoE) VIPs for those IPs, and/or no NAT matching the ICMP + reflection to send it back to the internal host.