Project

General

Profile

Actions
Copy link

Feature #4796

open

Support Multiple FIBs in pfSense

Added by Jeremy Porter over 9 years ago. Updated over 7 years ago.

Status:
New
Priority:
Normal
Assignee:
Luiz Souza
Category:
Routing
Target version:
-
Start date:
06/28/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:

Description

The current default pfSense kernel is not built with multiple FIB support. Multiple FIB support has been in FreeBSD since Freebsd 6.0 or earlier.

Actions
Copy link
 #1

Updated by Jon Klinck over 9 years ago

I already put in a feature request for this- https://redmine.pfsense.org/issues/4598

Actions
Copy link
 #2

Updated by Jim Thompson about 9 years ago

  • Assignee set to Luiz Souza

someone needs to consider the impact on the rest of the system.

Actions
Copy link
 #3

Updated by Chris Buechler almost 9 years ago

  • Target version deleted (2.3)
Actions
Copy link
 #4

Updated by Jeremy Porter almost 9 years ago

As of 2.3 at least sysctl net.fibs report 4 fibs defined, and setfib is included in the distribution.
[2.3-BETA][]/root: sysctl -a | grep fib
net.my_fibnum: 0
net.add_addr_allfibs: 1
net.fibs: 4
[2.3-BETA][]/root: setfib 1 sysctl -a | grep fib
net.my_fibnum: 1
net.add_addr_allfibs: 1
net.fibs: 4

Actions
Copy link
 #5

Updated by Constantine Kormashev over 7 years ago

I see only one on 2.3.3:
sysctl -a | grep fib
net.my_fibnum: 0
net.add_addr_allfibs: 1
net.fibs: 1

Actions
Copy link
 #6

Updated by Stéphane Lapie over 7 years ago

I just stumbled upon a case where it would be nice to have the webConfigurator in a separate FIB, because of routing troubles.

I have a scenario where I have pfSense on these networks :
  • WAN
  • LAN1 (legacy network for which I need to provide net access via WAN and NAT)
  • LAN2 (on which I want to have SNMP, management screen)
Then, there is yet another network MGMT connected to LAN1 and LAN2 via respectively GW1 and GW1->GW2 :
  • MGMT -> GW1 -> LAN1 -> pfSense
  • MGMT -> GW1 -> LAN1 -> GW2 -> LAN2 -> pfSense
Normally I would want to do the following :
  • Have pfSense route to MGMT via GW2, for easy access to the management screen
  • Have LAN1 equipments route by default via pfSense, but to MGMT via GW1

Unfortunately LAN1 has a lot of legacy equipment for which it is not possible to set static routes. The problem is that then, we end up with assymetrical routing (LAN1 -> pfSense -> LAN2 -> GW2 -> MGMT), and GW2 ends up botching the state handling, which results in frequent broken pipes.

I would therefore like to :
  • Have standard routing for MGMT network done via GW1 in fib 0
  • Have webConfigurator and SSH run in fib 1, which would route via GW2 for MGMT network

I tried receiving packets on LAN2 for SSH/HTTP/HTTPS (after disabling the lockout rule), and setting a route-to GW2 directive, but it seems this fails, even when setting sloppy states.

Actions
Copy link

Also available in: Atom PDF