Project

General

Profile

Actions

Feature #820

closed

Expose interface for PF address pools on outbound NAT rules

Added by Erik Fonnesbeck over 11 years ago. Updated about 11 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Rules / NAT
Target version:
Start date:
08/11/2010
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:

Description

There are various scenarios where it would be useful to expose an interface on outbound NAT rules to use subnets or aliases as the translation address and also access the address pool options available in PF.

For example, if you have less public IP addresses than client systems and want to balance IP addresses between them, you could specify the subnet if you have the whole subnet and select source-hash as the address selection method. This would automatically decide which clients will use each IP and keep the assignments static until the next time the ruleset is reloaded. Another option available is bitmask, which does assignments similar to binat but without forwarding inbound connections.

There are also random and round-robin selection methods that pick a different IP each time, but you can use the sticky-address option to make sure it uses the same IP address mapping for a given client system on every connection.

All of these options could be made available when using a subnet, and round-robin would be the method used when you use a multi-IP alias.

Documented at http://www.openbsd.org/faq/pf/pools.html

Actions

Also available in: Atom PDF