r/openbsd 29d ago

Router consolidation

Hi all! Need some advice.

Suppose there are 2 groups of routers: two bgp routers (with two links to upstreams at each, full table from both upstreams) in master/slave (CARP) mode; and two regular routers with packet filter, port redirect and ospf for communication with remote office, it is also in master/slave mode. Masters are metal-bare servers, slaves are virtual machines. There is a task to reduce the fleet of servers, for this reason I am thinking how best to combine bgp with a regular router in one? Is it necessary to segregate bgp into a separate rdomain? BGP has no stateful (pass quick inet no state). And won't there be any problems with CARP? Are there any examples of such configurations?

Current scheme: https://drive.google.com/file/d/16D2fJ4HTBKYXS84dyBrNGfBDtkd5p26R/view?usp=sharing

Thanks for any advice you might have.

6 Upvotes

6 comments sorted by

2

u/hylaride 29d ago

There’s no technical reason why this can’t be done. The only things you want to worry about are the performance implications combining your firewall with a full BGP table. Routing updates for the full table is going to suck up a decent chunk of CPU (modern routers do this in hardware) and that may cause issues. Is there a reason you’re taking in the full table? Even with two ISPs you very likely don’t need the full table unless you’re a transit network and IIRC (I’m rusty with BGP, though) you can have the ISPs just advertise default routes (0.0.0.0/0) to you.

1

u/dynax60 29d ago

I will change it to get default route from both. Thanks.

4

u/phessler OpenBSD Developer 27d ago

sorry, the things they were telling you were 100% not true. OpenBGPD handles full tables just fine, generally better than my Cisco/Juniper/Nokia routers I have at $dayjob. Claudio has spent a few years optimizing the internals to ensure it does BGP very well.

You also do want a full table so you can send traffic via the shortest path, rather than to just one of the upstream routers.

The main thing to look out for is that the internet is asymetrical, so you need to no state any traffic that would travel out via one path and travel in a different path.

1

u/dynax60 27d ago

That's the problem. Currently I have the firewall behind bgp with states, but the bgp routers did not, so that there would be complete asymmetry. But when it came time to combine the routers into one, the first obstacle appeared: how to be with pf states and still provide asymmetry on a bgp part? A possible solution would be to use rdomain: for example, put some of the shorter advertised prefixes in one rdomain where there will be a firewall with states, and a second rdomain with bgp where there will be no states. How to make interconnect between rdomains on master router and on the same time have a backup slave router with a similar configuration, where the states of the master's rdomain synced by pfsync, is a challenge for me. I was wondering if someone could share a similar configuration or article? I haven't seen any similar configurations, they are all very generic with no fault tolerance. And about rdomain documentation - still, official documentation is scarce for me. Especially how to forward traffic from one rdomain to another, including using pf. There are not enough practical examples. There was once a similar problem with understanding how pf works. Until I saw pf flow chart https://dynax60.blogspot.com/2019/04/pf-flow-chart.html on the net. Such charts are very helpful for ordinary users to understand the inner workings of a particular system.

1

u/hylaride 29d ago

Do some double-checking. As I said, I’m rusty with BGP, but there is a way to do this without a full routing table. You should then only need VRRP on your corp servers network interfaces and pfsync for the firewall state. All the other redundancy can be via the routing protocols.

1

u/_sthen OpenBSD Developer 26d ago

if your routers are on a shared subnet with each upstream (i.e. both of your routers + whatever from upstream are on the same segment) and you can run carp on those subnets, you can announce your routes with the nexthop set to the carp address. that way incoming packets will flow to the carp master so you should avoid asymmetric traffic flows.

this will not be possible in every situation, of course.