Firewall four nics, two separate routes

Firewall four nics, two separate routes

[Ryan Johnson]

Hi all,

I have a firewall with four nics, two external nics with two public ips and two internal nics with private ips (two different networks). What I would like to do is force all traffic from each internal network to its corresponding external nic. I believe the only solution to this is to use iproute2, but I have had to luck. So traffic from internal net1 will be routed out external nic1, then the other side, internal net2 will be routed out the external nic2. Internal net1 traffic should never go out external nic2 and internal net2 traffic should never go out external nic1.


Thank you in advance,
Ryan

Ryan Johnson
Security Architect
ESP Group

Re: Firewall four nics, two separate routes

[Alexis]

think lan1 lan2 wan1 wan2

the firewall box, must have NO defaul route

ip rule add from lan1 lookup table 5
ip rule add from lan2 lookup table 6
ip route add default via wan1 table 5
ip route add default via wan1 table 6

thats it.



----- Original Message ----- 
From: "Ryan Johnson" <rjohnson@espgroup.net>
To: <netfilter@lists.netfilter.org>
Sent: Monday, January 26, 2004 2:49 PM
Subject: Firewall four nics, two separate routes


Hi all,

I have a firewall with four nics, two external nics with two public ips and
two internal nics with private ips (two different networks). What I would
like to do is force all traffic from each internal network to its
corresponding external nic. I believe the only solution to this is to use
iproute2, but I have had to luck. So traffic from internal net1 will be
routed out external nic1, then the other side, internal net2 will be routed
out the external nic2. Internal net1 traffic should never go out external
nic2 and internal net2 traffic should never go out external nic1.


Thank you in advance,
Ryan

Ryan Johnson
Security Architect
ESP Group

Re: Firewall four nics, two separate routes

[Alexis]

its too late at night, i drive so many kms today, i cant write.

this is the real message


think lan1 lan2 wan1 wan2

the firewall box, must have NO default route

ip rule add from lan1 lookup table 5
ip rule add from lan2 lookup table 6
ip route add default via wan1 table 5
ip route add default via wan2 table 6

sorry


----- Original Message ----- 
From: "Alexis" <alexis@attla.net.ar>
To: "netfilter" <netfilter@lists.netfilter.org>
Sent: Monday, January 26, 2004 11:08 PM
Subject: Re: Firewall four nics, two separate routes


> think lan1 lan2 wan1 wan2
>
> the firewall box, must have NO defaul route
>
> ip rule add from lan1 lookup table 5
> ip rule add from lan2 lookup table 6
> ip route add default via wan1 table 5
> ip route add default via wan1 table 6
>
> thats it.
>
>
>
> ----- Original Message ----- 
> From: "Ryan Johnson" <rjohnson@espgroup.net>
> To: <netfilter@lists.netfilter.org>
> Sent: Monday, January 26, 2004 2:49 PM
> Subject: Firewall four nics, two separate routes
>
>
> Hi all,
>
> I have a firewall with four nics, two external nics with two public ips
and
> two internal nics with private ips (two different networks). What I would
> like to do is force all traffic from each internal network to its
> corresponding external nic. I believe the only solution to this is to use
> iproute2, but I have had to luck. So traffic from internal net1 will be
> routed out external nic1, then the other side, internal net2 will be
routed
> out the external nic2. Internal net1 traffic should never go out external
> nic2 and internal net2 traffic should never go out external nic1.
>
>
> Thank you in advance,
> Ryan
>
> Ryan Johnson
> Security Architect
> ESP Group
>
>
>
>
>
>

RE: Firewall four nics, two separate routes

[bmcdowell]

Well, it doesn't seem to be very thorough, and it wouldn't encompass
non-IP (_IP_tables), but what about something like:

iptables -A FORWARD -i eth0 -o ! eth1 -j LOG --log-prefix "Wrong Route:
" (and -j DROP)
iptables -A FORWARD -i eth2 -o ! eth3 -j LOG --log-prefix "Wrong Route:
" (and -j DROP)

Test this.  I'm just guessing here.


Bob

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Ryan Johnson
Sent: Monday, January 26, 2004 11:50 AM
To: netfilter@lists.netfilter.org
Subject: Firewall four nics, two separate routes


Hi all,

I have a firewall with four nics, two external nics with two public ips
and two internal nics with private ips (two different networks). What I
would like to do is force all traffic from each internal network to its
corresponding external nic. I believe the only solution to this is to
use iproute2, but I have had to luck. So traffic from internal net1 will
be routed out external nic1, then the other side, internal net2 will be
routed out the external nic2. Internal net1 traffic should never go out
external nic2 and internal net2 traffic should never go out external
nic1.


Thank you in advance,
Ryan

Ryan Johnson
Security Architect
ESP Group