Re: [LARTC] Policy routing and strange packets traversing.

From: Julian Anastasov <ja@ssi.bg>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Policy routing and strange packets traversing.
Date: Sun, 02 Mar 2003 10:17:42 +0000	[thread overview]
Message-ID: <marc-lartc-104660041410117@msgid-missing> (raw)
In-Reply-To: <marc-lartc-104653305330571@msgid-missing>

	Hello,

On Sun, 2 Mar 2003, Tomasz Wrona wrote:

> > 	This looks a bit strange, it is not needed:
> >
> > > # To be sure that traffic goes to proper gateway
> > > 22:     from 1.1.1.30 lookup 1
> > > 22:     from 2.2.2.66 lookup 2
>
> Why, It's the same what You pointed me below... ?

	OK, I overlooked it

> > > 30:     from all to 1.1.1.29 lookup 1
> > > 30:     from all to 2.2.2.65 lookup 2
>
> OK, but I process main table after all manual typed rules... but never
> mind its not issue ;)

	It is not good to put table main after other rules, it can
be used only to override route in table main. For example, why
traffic from 1.1.1.29 to some internal IP should go to the ISP
gateway (table 1)?

> > 	Don't expect from Netfilter to use correctly the routing,
> > you have to avoid using "iif" when playing with Netfilter. Just
> > use "from XXX".
>
> Hmmm... I  cant understand what has netfilter to do with "iif" parameter ?
> What I want to achieve is to catch all incoming traffic on eth1..

	There are some places that can use output rerouting where
the iif parameter is ignored. And second, the normal kernel relies
on the routing cache to keep persistence for each NAT connection to
its selected nexthop. There is no guarantee that it will work for the
whole connection life.

> > 	but you will need rules "from all to all" for
> > proper default route selelection and source IP autoselection for
> > the masquerading.
> >
> Balance table catches all traffic from LAN to inet.Thats all what I need.

	It does not work all the time.

> > http://www.ssi.bg/~ja/#routes
> >
> > dgd-usage.txt contains example for rules and routes you can use.
>
> Hmm... Maybe I am wrong but It's related to NAT multiple gateways on
> single interface not on different what I have...

	Not exactly true, it is related to making sure each NAT
conn is bound to its allowed path(s), no matter how many interfaces
are used. Selecting different nexthop should be allowed only if
it is alternative allowed from the routing rules.

> There shouldn't be problem what I read in this article.

	Then why you see traffic to the wrong gateway?

Regards

--
Julian Anastasov <ja@ssi.bg>

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/