Using pfsense to decapsulate ipip packet - LVS/Tun method



  • We're doing some failover stuff ( using LVS )
    LVS : Linux Virtual Server
    we have a director, pfsense and some windows servers

    Director (linux)

    |

    |

    |–-------------------------  --------------------

    pfsense WRAP                                            |

    |                                                            windows 2000 server

    windows 2003

    our issue - we want the director to failover to windows 2003 ( one of the real server ) machine straight away,
    BUT as we found out windows 2003 doesn't support ipip protocol, which is required for LVS-Tun
    Windows 2003 supports IPSec however. but again i'm not sure if IPSec can be made to work with ipip
    protocol. it's a separate issue.

    the windows2003 sits behind a pfsense device. Now, I've read that pfsense support ipip.
    http://cvstrac.pfsense.org/fileview?f=pfSense/etc/protocols&v=1.2

    I'm thinking if pfsense supports ipip, then i'm hoping it could be the decapsulation end before
    it can forward the decapsulated ip packet to the real server windows2003 using firewall rules

    To setup an interface that supports ipip
    In Linux machine, I'd just need to do the following :
    root@rod7:# modprobe ipip        -> this is to load module 'ipip' in Linux machine.  similiar mechanism I think in FreeBSD??

    root@rod7:# ifconfig tunl0 192.168.0.7 netmask 255.255.255.255 broadcast 192.168.0.7 up        -> to config tunl0

    How can i achieve similiar thing in pfsense as it's a freebsd system ?

    thanks a lot



  • Well, I guess if they way I said it make too hard to understand, i'll try to simplify it.

    In essence, How can I add/enable tunl0 interface for ipip support on pfsense ( as it's a FreeBSD system and I
    have no knowledge of it. though I know it's UNIX-like OS ).

    for example : i could not just add this "ifconfig tun0 create" on pfsense console terminal, can I ?
    WebGUI doesn't really help in solving what I want.

    Thanks,


Log in to reply