Re: [LARTC] Multipath Routing Question with Public networks

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Sat, 16 Nov 2002, Vincent Jaussaud wrote:

> On All servers, we setup multipath default route, so that they can use both link as well.

	That means they know which link is alive or it does not
matter? :)

> Let's say we have Server A in our internal public network, with 2 network adapters, one
> using 10.0.0.1 (routed through ISP1), other using 172.16.0.1 (routed through ISP2)
>
> Assuming that rp_filter is configured correctly on our firewall, what happens when a
> client want to reach Server A using 10.0.0.1 ? What path will be used for the replies,
> with what source IP ?

	The server uses the 10.0.0.1 as source when resolving
route for the reply. Then it depends on the routing rules.

> I assume that if rp_filter is configured correctly, return path do not matter (since we
> don't do NAT), but I'm worried about the SRC IP beeing choosed for the reply. Because, if
> the kernel choose the src IP according to the output default route beeing choosed, then
> half clients<->servers sessions will just break.

	I'm sure you need correct routes on firewall and all internal
hosts, for example:

ip rule add prio ... from pubnet_X to 0/0 table table_for_ISP_X
ip rule add prio ... from pubnet_Y to 0/0 table table_for_ISP_Y
ip rule add prio ... from 0/0 to 0/0 table your_multipath_route

	Of course, the internal hosts use the proper firewall
IP as gateway.

	That is all, traffic from specific pub IP should use only
its gateway. You can expect rp_filter drops in firewall if
the internal servers select wrong NIC by using multipath
route for all route resolutions. The multipath route should be
used only for source address autoselection:

- originating connections without bind()
- selecting masquerade address (for NAT)
- etc

	I.e. it is a bad idea to use only multipath route.

	Internal servers creating outgoing connections after
using bind() to specific pubip should not reach the multipath route.

> So, basically my question is, what rules decide of the SRC IP to be used in a reply
> packet on a system with several default route through different network interfaces ?

	The transport and the application decide what source IP
to put in the reply. Then they decide how to call the routing.
The right thing to do when addresses to both ends are known is
to feed the routing with saddr and daddr. If callers use 0.0.0.0
as saddr when resolving routes, they will hit the multipath
route which is bad.

> Has anyone already experiencing such setup ?

	Not exactly, but everything is in the details :)

> Vincent.

Regards

--
Julian Anastasov <ja@ssi.bg>

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/