RE: [LARTC] 4 nic advanced routing question update

RE: [LARTC] 4 nic advanced routing question update

[Thad Marsh]

[-- Attachment #1: Type: text/plain, Size: 1769 bytes --]

ok i will do it in text:

66.92.114.46 eth0
209.141.2.194 eth1
192.168.119.101 eth2
192.168.120.101 eth3 

What i have is a linux box RH7.3 which will eventually run Shorewall Firewall. On this box there is eth0 66.92.114.46 conneted to isp1 and eth1 209.141.2.194 connected to isp2
It also has eth2 192.168.119.101 and eth3 192.168.120.101 which will connect to a failover appliance which has 2 wan interface and one lan interface.


What i need is to have traffic going to eth0 be routed to eth2 and traffic going to eth1 routed to eth3, and vice versa.

Right now i can ping eth0, eth1, eth2, eth3 on the box.  I also can ping beyond eth0 and eth1.  what i can not do is ping beyond eth2 and eth3.

I have tried several table statements and played with pref to no avail.  

any insight would be helpful!



-----Original Message-----
From: Jose Luis Domingo Lopez [mailto:lartc@24x7linux.com]
Sent: Tue 9/10/2002 2:39 PM
To: lartc@mailman.ds9a.nl
Cc: 
Subject: Re: [LARTC] 4 nic advanced routing question

On Tuesday, 10 September 2002, at 12:34:10 -0400,
Michael T. Babcock wrote:

> I'm not sure why you're having a problem:
> His document was encoded properly ...
> 
Yes, multipart/alternative, but I think what the reader was trying to
say us that the ASCII version of the email seems to include some kind of
ASCII-art that depicts the sender's network. But at least in my email
client the drawing seems broken and gives no clues about topology.

-- 
Jose Luis Domingo Lopez
Linux Registered User #189436     Debian Linux Woody (Linux 2.4.19-pre6aa1)
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/



[-- Attachment #2: Type: text/html, Size: 2517 bytes --]

RE: [LARTC] 4 nic advanced routing question update

[Martin A. Brown]

Thad,

Preface:
- - - - - -
I'm not certain that I understand your ultimate goal, though I'm 
sure I do not understand what you mean by a failover appliance.... (I know 
what such devices do, but I don't see how you are integrating it into this 
solution, but that's your problem.)

 : ok i will do it in text:
 : 
 : 66.92.114.46 eth0
 : 209.141.2.194 eth1
 : 192.168.119.101 eth2
 : 192.168.120.101 eth3 
 : 
 : What i have is a linux box RH7.3 which will eventually run Shorewall
 : Firewall. On this box there is eth0 66.92.114.46 conneted to isp1 and
 : eth1 209.141.2.194 connected to isp2 It also has eth2 192.168.119.101
 : and eth3 192.168.120.101 which will connect to a failover appliance
 : which has 2 wan interface and one lan interface.
 : 
 : What i need is to have traffic going to eth0 be routed to eth2 and
 : traffic going to eth1 routed to eth3, and vice versa.

This appears to be the rub!  I assume for the purposes of my answer that  
you don't want either of these pairs of networks knowing about the 
others.  This is essentially turning your linux box into two separate 
routers....if this is not what you intend, at least it might get you 
started.

You'll need to take the following steps:

  - create routing tables for each of the sets of networks between 
    which you want to pass traffic
  - modify the RPDB to select traffic based on the interface on which a 
    packet arrives

# -- numbers chosen here are arbitrary, but between 1 and 253
#    labels are also completely arbitary
#
echo 4 public-link-0 >> /etc/iproute2/rt_tables

# -- table identifiers below are looked up in the above file 
#    (/etc/iproute2/rt_tables)
#
ip route add table public-link-0 192.168.119.0/24 dev eth2 
ip route add table public-link-0 66.92.114.32/28 dev eth0
ip route add table public-link-0 default via 66.92.114.33 dev eth0

# -- numbers here are equally as arbitrary--use alabel
#    that makes sense to you
#
echo 5 public-link-1 >> /etc/iproute2/rt_tables

ip route add table public-link-1 192.168.120.0/24 dev eth3
ip route add table public-link-1 209.141.2.192/27 dev eth1
ip route add table public-link-1 default via $GW_ON_ETH1 dev eth1

# Notice that this simply sets up the routing tables.
# Now you need to use the RPDB to ask for lookups to the routing table you 
# wish to use.

# -- here we'll configure the policy routing to force packets
#    coming to and from the separate networks through the right interfaces
#
ip rule add iif eth2 table public-link-0
ip rule add iif eth0 table public-link-0

ip rule add iif eth1 table public-link-1
ip rule add iif eth3 table public-link-1

# -- now flush the routing cache
#
ip route flush cache


  Notes:
  - - - - - -
  - I can't simulate your setup....this may not work, and may not do 
    what you want
  - locally generated traffic is a problem I don't deal with
  - this will only allow packets to and from eth0 <--> eth2 and
    eth1 <--> eth3
  - you'll need to do masquerading with your packet filtering engine if
    you want any of the rfc1918 networks to reach the internet

Oh, yes....by the way, Julian just responded to this.  Read his 
documentation and the iproute2 manual thoroughly and carefully.  There is 
more than enough to get you to where you want to go.

If you need an online iproute2 manual there are a few--try this one:

  http://defiant.coinet.com/iproute2/ip-cref/node1.html

Good luck and bon voyage!

-Martin

 : Right now i can ping eth0, eth1, eth2, eth3 on the box.  I also can
 : ping beyond eth0 and eth1.  what i can not do is ping beyond eth2 and
 : eth3.
 : 
 : I have tried several table statements and played with pref to no avail.  
 : 
 : any insight would be helpful!
 : 
 : 
 : 
 : -----Original Message-----
 : From: Jose Luis Domingo Lopez [mailto:lartc@24x7linux.com]
 : Sent: Tue 9/10/2002 2:39 PM
 : To: lartc@mailman.ds9a.nl
 : Cc: 
 : Subject: Re: [LARTC] 4 nic advanced routing question
 : 
 : On Tuesday, 10 September 2002, at 12:34:10 -0400,
 : Michael T. Babcock wrote:
 : 
 : > I'm not sure why you're having a problem:
 : > His document was encoded properly ...
 : > 
 : Yes, multipart/alternative, but I think what the reader was trying to
 : say us that the ASCII version of the email seems to include some kind of
 : ASCII-art that depicts the sender's network. But at least in my email
 : client the drawing seems broken and gives no clues about topology.
 : 
 : 

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] 4 nic advanced routing question update

[Thad Marsh]

I just wanted to clarify the failover appliance piece.  

The failover appliance was purchased to allow incoming and outgoing traffic when one of the two isps went down quite a while ago. 
The host piece was handled by a variety of commercial firewalls which have since failed, leaving us searching for an alternative.
The firewall appliance is just nat and only had the ability to deal with one ip per interface, limiting our ability to host multiple servers without changing a lot of ports to non-standard ones. That is why we are putting the Linux box in front of the appliance to provide security and handle multiple ips (phase two after we get the basics down).  This way the area between the Linux/firewall and the failover appliance creates a dmz for external servers accessible while the internal clients have the benefit of outgoing failover.  

Not sure if this is the best way but it seemed to make sense, thoughts?

Martin in answer to this below, I guess since the two internal eth2 and eth3 are really a dmz I suppose it wouldn't matter if they know just so long as when a request comes from the outside they know how to route it back out properly even when one isp is down.

This appears to be the rub!  I assume for the purposes of my answer that 
you don't want either of these pairs of networks knowing about the
others.  This is essentially turning your linux box into two separate
routers....if this is not what you intend, at least it might get you
started.

Again thanks to all and look forward to your input.


-----Original Message-----
From: Martin A. Brown [mailto:mabrown-lartc@securepipe.com]
Sent: Tuesday, September 10, 2002 5:50 PM
To: Thad Marsh
Cc: lartc@mailman.ds9a.nl
Subject: RE: [LARTC] 4 nic advanced routing question update

Thad,

Preface:
- - - - - -
I'm not certain that I understand your ultimate goal, though I'm
sure I do not understand what you mean by a failover appliance.... (I know
what such devices do, but I don't see how you are integrating it into this
solution, but that's your problem.)

 : ok i will do it in text:
 :
 : 66.92.114.46 eth0
 : 209.141.2.194 eth1
 : 192.168.119.101 eth2
 : 192.168.120.101 eth3
 :
 : What i have is a linux box RH7.3 which will eventually run Shorewall
 : Firewall. On this box there is eth0 66.92.114.46 conneted to isp1 and
 : eth1 209.141.2.194 connected to isp2 It also has eth2 192.168.119.101
 : and eth3 192.168.120.101 which will connect to a failover appliance
 : which has 2 wan interface and one lan interface.
 :
 : What i need is to have traffic going to eth0 be routed to eth2 and
 : traffic going to eth1 routed to eth3, and vice versa.

This appears to be the rub!  I assume for the purposes of my answer that 
you don't want either of these pairs of networks knowing about the
others.  This is essentially turning your linux box into two separate
routers....if this is not what you intend, at least it might get you
started.

You'll need to take the following steps:

  - create routing tables for each of the sets of networks between
    which you want to pass traffic
  - modify the RPDB to select traffic based on the interface on which a
    packet arrives

# -- numbers chosen here are arbitrary, but between 1 and 253
#    labels are also completely arbitary
#
echo 4 public-link-0 >> /etc/iproute2/rt_tables

# -- table identifiers below are looked up in the above file
#    (/etc/iproute2/rt_tables)
#
ip route add table public-link-0 192.168.119.0/24 dev eth2
ip route add table public-link-0 66.92.114.32/28 dev eth0
ip route add table public-link-0 default via 66.92.114.33 dev eth0

# -- numbers here are equally as arbitrary--use alabel
#    that makes sense to you
#
echo 5 public-link-1 >> /etc/iproute2/rt_tables

ip route add table public-link-1 192.168.120.0/24 dev eth3
ip route add table public-link-1 209.141.2.192/27 dev eth1
ip route add table public-link-1 default via $GW_ON_ETH1 dev eth1

# Notice that this simply sets up the routing tables.
# Now you need to use the RPDB to ask for lookups to the routing table you
# wish to use.

# -- here we'll configure the policy routing to force packets
#    coming to and from the separate networks through the right interfaces
#
ip rule add iif eth2 table public-link-0
ip rule add iif eth0 table public-link-0

ip rule add iif eth1 table public-link-1
ip rule add iif eth3 table public-link-1

# -- now flush the routing cache
#
ip route flush cache


  Notes:
  - - - - - -
  - I can't simulate your setup....this may not work, and may not do
    what you want
  - locally generated traffic is a problem I don't deal with
  - this will only allow packets to and from eth0 <--> eth2 and
    eth1 <--> eth3
  - you'll need to do masquerading with your packet filtering engine if
    you want any of the rfc1918 networks to reach the internet

Oh, yes....by the way, Julian just responded to this.  Read his
documentation and the iproute2 manual thoroughly and carefully.  There is
more than enough to get you to where you want to go.

If you need an online iproute2 manual there are a few--try this one:

  http://defiant.coinet.com/iproute2/ip-cref/node1.html

Good luck and bon voyage!

-Martin

 : Right now i can ping eth0, eth1, eth2, eth3 on the box.  I also can
 : ping beyond eth0 and eth1.  what i can not do is ping beyond eth2 and
 : eth3.
 :
 : I have tried several table statements and played with pref to no avail. 
 :
 : any insight would be helpful!
 :
 :
 :
 : -----Original Message-----
 : From: Jose Luis Domingo Lopez [mailto:lartc@24x7linux.com]
 : Sent: Tue 9/10/2002 2:39 PM
 : To: lartc@mailman.ds9a.nl
 : Cc:
 : Subject: Re: [LARTC] 4 nic advanced routing question
 :
 : On Tuesday, 10 September 2002, at 12:34:10 -0400,
 : Michael T. Babcock wrote:
 :
 : > I'm not sure why you're having a problem:
 : > His document was encoded properly ...
 : >
 : Yes, multipart/alternative, but I think what the reader was trying to
 : say us that the ASCII version of the email seems to include some kind of
 : ASCII-art that depicts the sender's network. But at least in my email
 : client the drawing seems broken and gives no clues about topology.
 :
 :

--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] 4 nic advanced routing question update

[Thad Marsh]

This line gave me an errors I substituted $GW_ON_ETH1 for the ip of the interface gateway 209.141.2.195:

ip route add table public-link-1 default via $GW_ON_ETH1 dev eth1

I am still unable to ping beyond the internal interface hon the firewall.  Ie from the firewall I can ping 209.141.2.192, 66.92.114.33 but not the next hop from 192.168.119.101 which is 192.168.119.100.  here are the rules and routes:

ip ru
0:      from all lookup local
32762:  from all iif eth3 lookup public-link-1
32763:  from all iif eth1 lookup public-link-1
32764:  from all iif eth0 lookup public-link-0
32765:  from all iif eth2 lookup public-link-0
32766:  from all lookup main
32767:  from all lookup 253

ip ro
66.92.114.32/28 dev eth0  scope link
209.141.2.192/27 dev eth1  scope link
192.168.119.0/24 dev eth2  scope link
192.168.120.0/24 dev eth3  scope link
127.0.0.0/8 dev lo  scope link
default via 66.92.114.33 dev eth0

ip ad
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:04:75:9f:07:79 brd ff:ff:ff:ff:ff:ff
    inet 66.92.114.46/28 brd 66.92.114.47 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:10:5a:a2:75:0d brd ff:ff:ff:ff:ff:ff
    inet 209.141.2.194/27 brd 209.141.2.223 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:10:5a:a2:74:2f brd ff:ff:ff:ff:ff:ff
    inet 192.168.119.101/24 brd 192.168.119.255 scope global eth2
5: eth3: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:60:08:bf:1c:c2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.120.101/24 brd 192.168.120.255 scope global eth3

Thanks again for the help!


-----Original Message-----
From: Martin A. Brown [mailto:mabrown-lartc@securepipe.com]
Sent: Tuesday, September 10, 2002 5:50 PM
To: Thad Marsh
Cc: lartc@mailman.ds9a.nl
Subject: RE: [LARTC] 4 nic advanced routing question update

Thad,

Preface:
- - - - - -
I'm not certain that I understand your ultimate goal, though I'm
sure I do not understand what you mean by a failover appliance.... (I know
what such devices do, but I don't see how you are integrating it into this
solution, but that's your problem.)

 : ok i will do it in text:
 :
 : 66.92.114.46 eth0
 : 209.141.2.194 eth1
 : 192.168.119.101 eth2
 : 192.168.120.101 eth3
 :
 : What i have is a linux box RH7.3 which will eventually run Shorewall
 : Firewall. On this box there is eth0 66.92.114.46 conneted to isp1 and
 : eth1 209.141.2.194 connected to isp2 It also has eth2 192.168.119.101
 : and eth3 192.168.120.101 which will connect to a failover appliance
 : which has 2 wan interface and one lan interface.
 :
 : What i need is to have traffic going to eth0 be routed to eth2 and
 : traffic going to eth1 routed to eth3, and vice versa.

This appears to be the rub!  I assume for the purposes of my answer that 
you don't want either of these pairs of networks knowing about the
others.  This is essentially turning your linux box into two separate
routers....if this is not what you intend, at least it might get you
started.

You'll need to take the following steps:

  - create routing tables for each of the sets of networks between
    which you want to pass traffic
  - modify the RPDB to select traffic based on the interface on which a
    packet arrives

# -- numbers chosen here are arbitrary, but between 1 and 253
#    labels are also completely arbitary
#
echo 4 public-link-0 >> /etc/iproute2/rt_tables

# -- table identifiers below are looked up in the above file
#    (/etc/iproute2/rt_tables)
#
ip route add table public-link-0 192.168.119.0/24 dev eth2
ip route add table public-link-0 66.92.114.32/28 dev eth0
ip route add table public-link-0 default via 66.92.114.33 dev eth0

# -- numbers here are equally as arbitrary--use alabel
#    that makes sense to you
#
echo 5 public-link-1 >> /etc/iproute2/rt_tables

ip route add table public-link-1 192.168.120.0/24 dev eth3
ip route add table public-link-1 209.141.2.192/27 dev eth1
ip route add table public-link-1 default via $GW_ON_ETH1 dev eth1

# Notice that this simply sets up the routing tables.
# Now you need to use the RPDB to ask for lookups to the routing table you
# wish to use.

# -- here we'll configure the policy routing to force packets
#    coming to and from the separate networks through the right interfaces
#
ip rule add iif eth2 table public-link-0
ip rule add iif eth0 table public-link-0

ip rule add iif eth1 table public-link-1
ip rule add iif eth3 table public-link-1

# -- now flush the routing cache
#
ip route flush cache


  Notes:
  - - - - - -
  - I can't simulate your setup....this may not work, and may not do
    what you want
  - locally generated traffic is a problem I don't deal with
  - this will only allow packets to and from eth0 <--> eth2 and
    eth1 <--> eth3
  - you'll need to do masquerading with your packet filtering engine if
    you want any of the rfc1918 networks to reach the internet

Oh, yes....by the way, Julian just responded to this.  Read his
documentation and the iproute2 manual thoroughly and carefully.  There is
more than enough to get you to where you want to go.

If you need an online iproute2 manual there are a few--try this one:

  http://defiant.coinet.com/iproute2/ip-cref/node1.html

Good luck and bon voyage!

-Martin

 : Right now i can ping eth0, eth1, eth2, eth3 on the box.  I also can
 : ping beyond eth0 and eth1.  what i can not do is ping beyond eth2 and
 : eth3.
 :
 : I have tried several table statements and played with pref to no avail. 
 :
 : any insight would be helpful!
 :
 :
 :
 : -----Original Message-----
 : From: Jose Luis Domingo Lopez [mailto:lartc@24x7linux.com]
 : Sent: Tue 9/10/2002 2:39 PM
 : To: lartc@mailman.ds9a.nl
 : Cc:
 : Subject: Re: [LARTC] 4 nic advanced routing question
 :
 : On Tuesday, 10 September 2002, at 12:34:10 -0400,
 : Michael T. Babcock wrote:
 :
 : > I'm not sure why you're having a problem:
 : > His document was encoded properly ...
 : >
 : Yes, multipart/alternative, but I think what the reader was trying to
 : say us that the ASCII version of the email seems to include some kind of
 : ASCII-art that depicts the sender's network. But at least in my email
 : client the drawing seems broken and gives no clues about topology.
 :
 :

--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/