[Securityinfos]

I have this kind of setup :

1 t1 line with 64 ip available
1 dsl line with only 1 ip available

so on obsd 3.5 box 3 nics available

1st nic for t1 link
2nd nic for dsl link
3rd nic for LAN


Here are the questions :

1) can i have a pf+carp configuration on this kind of situation or i
need more ips on DSL link ?

2) Is it possible to have pf+carp configuration on a bridge firewall ?

3) Need to have a sort of load balancing on the 2 links based os
source ip addresses ... packets coming from certain ips go to t1 ips
and then redirected inside to a webserver inside the lan
packets coming from certain ips go to DSL ips and then redirected
inside
to a webserver inside the lan

Thanks for the help very appreciated...

[Strog]

CARP is balancing/failover for multiple boxes and wouldn't be needed for your situation (unless you plan to add more firewalls/webservers/etc.).

I haven't had a chance to play with multiple connections yet but I'd like to. A good place to start is the OpenBSD pf faq (http://www.openbsd.org/faq/pf/index.html) section on Address Pools and Load Balancing (http://www.openbsd.org/faq/pf/pools.html).

[elmore]

CARP setups have the limitation that boxes must reside on the same physical subnet. It would not be helpful to you in this case. Also, I believe it would be difficult if not impossible to redirect incoming traffic from your t-1 to the DSL line.

You could however, redirect outgoing traffic. For instance if you wanted just web traffic to exit your net and go over the DSL line and then redirect all other types of traffic through your t-1. This could be handled with a few pf rules and you could get fancy with it and implement an altq config to maximize your bandwidth even further. This wouldn;t be too hard to accomplish in particularly now that OpenBSD 3.5 has multiple default gateway support.

If you have multiple webservers that the firewall redirects to and you want to achieve some sort of load balancing the better option for you would be to implement round-robin DNS which can also be done from pf.

Hope that helps.