Dynamic Routing

All our examples so far have used static routes, which are routes that never change. This is because in our examples up to this point, the routers have each only had one connection to the Internet. For example, in the previous section, simba accessed the Internet through the router at its ISP, and falcon accessed the Internet through simba. In both cases, these were the only access links that the router had to the Internet.

Sometimes, however, you may have multiple Internet connections or multiple routes to the same network. In this case, static routing does not work well. This is where dynamic routing comes in.

Dynamic routing uses a routing daemon, along with a routing protocol to discover new routes, and dynamically adds them to the routing table. In addition, dynamic routing automatically deletes routing entries from the routing table when they are no longer valid.

Several router daemons are available for FreeBSD. The one that is included with the FreeBSD base system is called routed. It is a fairly old program, and it uses a fairly old routing protocol known as RIP (Routing Information Protocol). RIP has some security problems, so there are better choices available for routing than routed. Other routing daemons available in the FreeBSD ports collection include gated and zebra, both in the "net" directory of the ports tree. For more information on installing software using the FreeBSD ports collection, see Chapter 16, "Installing Additional Software."

A discussion of how to configure the routing daemons is beyond the scope of this book. See the man pages and documentation for the routing daemon that you decide to use for more information.

The good news is that you probably won't need to run a routing daemon anyway. As mentioned before, the only time you will need a routing daemon is if you have multiple routes to get to the same network (for example, multiple Internet connections). If you don't have multiple routes to the same network, then using static routing entries, as discussed previously, will work fine.

Enterprise Routing and DMZ

A variation of the previous concept of routing between multiple networks is the DMZ (Demilitarized Zone) concept, which is fairly common in enterprise environments.

The problem here is that you may need some systems behind the gateway to have real IP addresses (such as web servers), but you want the rest of the systems to use NAT. This is usually done by having a gateway that has three network interfaces in it. One interface is the outside link to the Internet, the second is for the systems that should use NAT, and the third is for the systems that should not use NAT. The interface that serves the systems with the real IP addresses is known as the demilitarized zone (DMZ). More information on DMZ setups can be found in the section "Using a Firewall" in Chapter 30.