1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
.\" $OpenBSD: rdomain.4,v 1.5 2015/02/05 20:46:30 sthen Exp $
.\"
.\" Copyright (c) 2015 Peter Hessler <phessler@openbsd.org>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.Dd $Mdocdate: February 5 2015 $
.Dt RDOMAIN 4
.Os
.Sh NAME
.Nm rtable ,
.Nm rdomain
.Nd routing tables and routing domains
.Sh DESCRIPTION
The traditional kernel routing system had a single table for routes and
allowed for non-conflicting IP address assignments.
.Nm rtable
and
.Nm rdomain
allows us to have separate lookup tables for routes,
and assign IP addresses independently from other interfaces.
.Ss Routing tables
.Nm rtable
allows one to set a different route table for outbound network packets.
As with the traditional routing system, IP addresses cannot overlap.
You can have multiple
.Nm rtable
within the same routing domain.
Commonly used to set Policy Based Routing.
.Ss Routing domains
.Nm rdomain
are completely separate routing domains and tables in the kernel.
An IP address (e.g. 10.0.0.1/16) can be assigned in more than one
.Nm rdomain ,
but
cannot be assigned more than once per
.Nm rdomain .
An interface belongs to one and only one
.Nm rdomain .
The interface's
.Nm rdomain
determines which rdomain an incoming packet will
be in.
Virtual interfaces do not need to belong to the same
.Nm rdomain
as the parent.
An
.Nm rdomain
contains at least one routing table.
.Sh EXAMPLES
Set up em0 and lo4 onto rdomain 4:
.Bd -literal -offset indent
# ifconfig em0 rdomain 4
# ifconfig lo4 rdomain 4
# ifconfig lo4 inet 127.0.0.1/8
# ifconfig em0 192.0.2.100/24
.Ed
.Pp
Set a default route and localhost reject route within rdomain 4:
.Bd -literal -offset indent
# route -T4 -qn add -net 127 127.0.0.1 -reject
# route -T4 -n add default 192.0.2.1
.Ed
.Pp
Start an sshd in rdomain 4:
.Pp
.Dl # route -T4 exec /usr/sbin/sshd
.Pp
pf.conf snippet to block incoming port 80, and nat-to and move to rtable 0
on interface em1:
.Bd -literal -offset indent
block in on rdomain 4 proto tcp to any port 80
match out on rdomain 4 to !$internal_net nat-to (em1) rtable 0
.Ed
.Sh SEE ALSO
.Xr route 4 ,
.Xr pf.conf 5 ,
.Xr ifconfig 8 ,
.Xr route 8
.Sh HISTORY
.Ox
support for
.\" XXX - rdomains, not 'rtable'
.\" .Nm
rdomains
first appeared in
.Ox 4.9
and IPv6 support first appeared in
.Ox 5.5 .
|
