not loadbalancing but 2 ISPs

not loadbalancing but 2 ISPs

[George Georgalis]

I'm going to be migrating some servers from one ISP to another at the
same location.

Does this scenario hold water (simplified syntax for clarity). The idea
is for the server to respond (all the way to the client) regardless of
whether the request went to the IP on ISP1 or ISP2.

T1a_host01=host ip on ISP 1
T1b_host01=host ip on ISP 2
DMZ_host01=host ip on DMZ
EXT_T1a=external interface for ISP 1
EXT_T1b=external interface for ISP 2
INT_DMZ=internal interface for DMZ

nat PREROUTING --dst $T1a_host01 DNAT $DMZ_host01
nat PREROUTING --dst $T1b_host01 DNAT $DMZ_host01

INPUT -i $EXT_T1a -d $DMZ_host01 -j ACCEPT
INPUT -i $EXT_T1b -d $DMZ_host01 -j ACCEPT

nat -A POSTROUTING -s $DMZ_host01 -o $EXT_T1a -j SNAT --to-source $T1a_host01
nat -A POSTROUTING -s $DMZ_host01 -o $EXT_T1b -j SNAT --to-source $T1b_host01

FORWARD -i $INT_DMZ -o $EXT_T1a -m state --state ESTABLISHED,RELATED -j ACCEPT
FORWARD -i $INT_DMZ -o $EXT_T1b -m state --state ESTABLISHED,RELATED -j ACCEPT

If this wouldn't work, why? I'm concerned about those POSTROUTING
lines, is there a workaround?  Would the system also work for high
availability, if I could get DNS to behave?

// George






-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george 

Re: not loadbalancing but 2 ISPs

[Antony Stone]

On Tuesday 18 June 2002 4:27 am, George Georgalis wrote:

> I'm going to be migrating some servers from one ISP to another at the
> same location.

You will have to consider which one of those ISPs is your default route.

Right now, your default route is via ISP 1.

Some day, your default route will be via ISP 2.

There will be some point in between when you switch default routes from ISP 1 
to ISP 2 - at that time you need to change your POSTROUTING rules as well.

> Does this scenario hold water (simplified syntax for clarity). The idea
> is for the server to respond (all the way to the client) regardless of
> whether the request went to the IP on ISP1 or ISP2.

Getting the server to *respond* will work fine.  No problems.

What's more difficult is letting the server initiate outgoing connections, 
because you have to know which source address to give it.

> nat -A POSTROUTING -s $DMZ_host01 -o $EXT_T1a -j SNAT --to-source
> $T1a_host01
> nat -A POSTROUTING -s $DMZ_host01 -o $EXT_T1b -j SNAT --to-source
> $T1b_host01

Only one of these will ever get matched - the one which corresponds to yur 
default route to the outside world, via ISP 1 or ISP 2.

> I'm concerned about those POSTROUTING
> lines, is there a workaround?

Look into iproute2 at http://defiant.coinet.com/iproute2 and see if you want 
to get involved.   I'd suggest no, if you're just migrating from one ISP to 
the other.   If you wanted to keep both running long term, it might be 
worthwhile.

> Would the system also work for high
> availability, if I could get DNS to behave?

For inbound connections, yes - you can get half your incoming connections to 
go to $EXT_T1a and half to go to $EXT_T1b.   You will have to let *all* 
outbound connections (ie ones initiated from your DMZ) go via the default 
route though.

 

Antony.