All of lore.kernel.org
 help / color / mirror / Atom feed
* [LARTC] ADVANCED ROUTING USING IPROUTE2 -> Multiple Firewalls
@ 2002-06-13 14:43 Roni Reicher
  2002-06-13 17:43 ` William L. Thomson Jr.
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Roni Reicher @ 2002-06-13 14:43 UTC (permalink / raw)
  To: lartc

[-- Attachment #1: Type: text/plain, Size: 3132 bytes --]

Hi guys. I really need some help.

 

This is my scenario:

 

 

 

CLIENTS -> SWITCH -> W2K Server -> Linux -> Internet (with 2 ADSL LINES)

 

 

My RedHat Linux 7.2 is just a firewall. Im running all the services
(www, mail, etc.) on my W2K.

 

I tried to set up a load balance, but im getting the following problem.

 

When I connect from the internet through my IP1 (ADSL 1) on any port
that I redirect to W2K, I can connect perfectly to my W2K, but when I
connect using my IP2 (ADSL2) I cant get to W2K.

 

And vice versa.

 

With the telnet server, which is running on the linux, I can connect
using both IP's. 

 

I guess the problem is when the W2K uses the other gw.

 

My W2K default gw is the linux.

 

This is my setup:

 

 

W2K IP   -> 10.0.0.1 

W2K IP2 -> 192.168.1.2

 

Linux eth0       -> xxx.xxx.xxx.170 (ADSL1)

Linux eth0 gw ->  xxx.xxx.xxx.129

 

Linux eth1       -> 192.168.1.1

 

Linux eth2       -> yyy.yyy.yyy.205 (ADSL2)

Linux eth2 gw  -> yyy.yyy.yyy.193

 

 

IPTABLES (just the basic).

 

$IPTABLES -A INPUT -i lo       -j ACCEPT

$IPTABLES -A INPUT -p icmp -j ACCEPT

 

$IPTABLES -A FORWARD -o eth0 -j ACCEPT

$IPTABLES -A FORWARD -o eth2 -j ACCEPT

 

##################### SMTP SERVER #################

 $IPTABLES -t nat -A PREROUTING -p tcp -d xxx.xxx.xxx.170 --dport 25
-j DNAT --to-destination 192.168.1.2

 $IPTABLES -t nat -A PREROUTING -p tcp -d yyy.yyy.yyy.205  --dport 25
-j DNAT --to-destination 192.168.1.2

##################### HTTP SERVER ##################

 $IPTABLES -t nat -A PREROUTING -p tcp -d xxx.xxx.xxx.170 --dport 80
-j DNAT --to-destination 192.168.1.2

 $IPTABLES -t nat -A PREROUTING -p tcp -d yyy.yyy.yyy.205 --dport 80
-j DNAT --to-destination 192.168.1.2

 

 $IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

 $IPTABLES -t nat -A POSTROUTING -s 10.0.0.0/24    -j MASQUERADE

 $IPTABLES -t nat -A POSTROUTING -o eth0           -j MASQUERADE

 $IPTABLES -t nat -A POSTROUTING -o eth2           -j MASQUERADE

 

 

 

And this is my load balancing script:

 

 

#### Variables ######

 

IP=/sbin/ip

 

IF1=eth0

IP1=xxx.xxx.xxx.170

P1=xxx.xxx.xxx.129

P1_NET=xxx.xxx.xxx.128/26

 

IF2=eth2

IP2=yyy.yyy.yyy.205

P2= yyy.yyy.yyy.193

P2_NET= yyy.yyy.yyy.192/26

 

echo 201  t1 >> /etc/iproute2/rt_tables

echo 202  t2 >> /etc/iproute2/rt_tables

 

 

$IP route add $P1_NET dev $IF1 src $IP1 table t1

$IP route add default via $P1 table t1

$IP route add $P2_NET dev $IF2 src $IP2 table t2 

$IP route add default via $P2 table t2

 

$IP route add $P1_NET dev $IF1 src $IP1

$IP route add $P2_NET dev $IF2 src $IP2

 

$IP route add default via $P1

 

$IP rule add from $IP1 table t1

$IP rule add from $IP2 table t2

 

$IP route add default scope global nexthop via $P1 dev $IF1 weight 1
nexthop via $P2 dev $IF2 weight 1

 

 

 

I really need help.

 

I appreciate it,

 

Ron Reicher

ronysrei@uol.com.br


[-- Attachment #2: Type: text/html, Size: 17257 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2002-06-29 18:08 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-06-13 14:43 [LARTC] ADVANCED ROUTING USING IPROUTE2 -> Multiple Firewalls Roni Reicher
2002-06-13 17:43 ` William L. Thomson Jr.
2002-06-17 13:18 ` Shroads, Jay
2002-06-26 23:14 ` Roni Reicher
2002-06-29 16:13 ` Roni Reicher
2002-06-29 18:08 ` William L. Thomson Jr.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.