Endoet – Sick of Fake

Berikut ini contoh load balance yang saya terapkan pada mesin OpenBSD sebagai NAT router, interface ethernet yang digunakan yaitu fxp0 dan fxp1 dengan dua koneksi ADSL Telkom Speedy.

Aktifkan tcp forwarding di mesin BSD anda dengan command :

sysctl -w net.inet.ip.forwarding=1

dan edit di /etc/sysctl.conf agar tetap tereksekusi pada saat router reboot


net.inet.ip.forwarding=1

Pastikan konfigurasi interface ethernet dan default routingnya kosong, hanya filename saja

# /etc/hosts.fxp0

# /etc/hosts.fxp1

# /etc/hostname.fxp0

# /etc/hostnamefxp1

# /etc/mygate

Berikut ini contoh script koneksi ADSL Telkom Speedy pada PPP, pppoe0 untuk koneksi pertama dan pppoe1 untuk koneksi kedua. Sesuaikan interface, username dan passwordnya.

# /etc/ppp/ppp.conf

default:

set log Phase Chat LCP IPCP CCP tun command

set redial 15 0

set reconnect 15 10000

pppoe0:

set device “!/usr/sbin/pppoe -i fxp0″

disable acfcomp protocomp

deny acfcomp

set mtu max 1492

set mru max 1492

set crtscts off

set speed sync

enable lqr

set lqrperiod 5

set cd 5

set dial

set login

set timeout 0

set authname usernamespeedy1@telkom.net

set authkey passwordspeedy1

add! default HISADDR

enable dns

enable mssfixup

pppoe1:

set device “!/usr/sbin/pppoe -i fxp1″

disable acfcomp protocomp

deny acfcomp

set mtu max 1492

set mru max 1492

set crtscts off

set speed sync

enable lqr

set lqrperiod 5

set cd 5

set dial

set login

set timeout 0

set authname usernamespeedy2@telkom.net

set authkey passwordspeedy2

add! default HISADDR

enable dns

enable mssfixup

Aktifkan interface fxp0 dan fxp1 pada mesin router

# ifconfig fxp0 up

# ifconfig fxp1 up

Jalankan PPPoE, Point to Point Protocol over Ethernet.

# ppp -ddial pppoe0

# ppp -ddial pppoe1

Jika dial koneksi ADSL Telkom Speedy berhasil, maka IP Address dari ADSL Telkom Speedy akan di Binding di dalam interface tunneling tun0 dan tun1

# ifconfig

tun0: flags=8051 mtu 1492

groups: tun egress

inet 125.xxx.xxx.234 -> 125.163.72.1 netmask 0xffffffff

tun1: flags=8051 mtu 1492

groups: tun

inet 125.xxx.xxx.235 -> 125.163.72.1 netmask 0xffffffff

Default gateway akan otomatis aktif dan terisi

# netstat -nr

Routing tables

Internet:

Destination Gateway Flags Refs Use Mtu Interface

default 125.163.72.1 UGS 5 18347 - tun0

Konfigurasi DNS server pada file /etc/resolv.conf akan otomatis terisi

# cat /etc/resolv.conf

nameserver 202.134.2.5

nameserver 203.130.196.5

Untuk load balancing nya saya menggunakan OpenBSD Packet Filter (pf). Aktifkan PacketFirewall pf.

# /etc/rc.conf

pf=”YES”

Script Packet Firewall NAT dan balancing menggunakan round-robin (atau bisa diganti dengan loadbalance jika lebih sesuai dengan kebutuhan).

# /etc/pf.conf

lan_net = “192.168.0.0/24″

int_if = “em0″

ext_if1 = “tun0″

ext_if2 = “tun1″

ext_gw1 = “125.163.72.1″

ext_gw2 = “125.163.72.1″

# scrub all

scrub in all

# nat outgoing connections on each internet interface

nat on $ext_if1 from $lan_net to any -> ($ext_if1)

nat on $ext_if2 from $lan_net to any -> ($ext_if2)

# pass all outgoing packets on internal interface

pass out on $int_if from any to $lan_net

# pass in quick any packets destined for the gateway itself

pass in quick on $int_if from $lan_net to $int_if

# load balance outgoing tcp traffic from internal network.

pass in on $int_if route-to { ($ext_if1 $ext_gw1), ($ext_if2 \ $ext_gw2) } \ round-robin proto tcp from $lan_net to any flags S/SA \ modulate state

# load balance outgoing udp and icmp traffic from internal network

pass in on $int_if route-to { ($ext_if1 $ext_gw1), ($ext_if2 \ ext_gw2) } \ round-robin proto { udp, icmp } from $lan_net to any keep state

# general “pass out” rules for external interfaces

pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state

pass out on $ext_if1 proto { udp, icmp } from any to any keep state

pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state

pass out on $ext_if2 proto { udp, icmp } from any to any keep state

Setelah itu restart pf rules dengan perintah

# pfctl -f /etc/pf.conf

Masukkan baris berikut ke dalam /etc/rc.local agar setiap router restart / reboot akan otomatis menjalankan PPPoE.

# /etc/rc.local

ppp -ddial pppoe0

ppp -ddial pppoe1

Untuk membunuh / merestart koneksi ADSL, PPPoE harus dimatikan terlebih dahulu

# pkill ppp

Fungsi NAT Pool round-robin dapat dipantau menggunakan pftop yang dapat diambil di sini.