[LARTC] port-mapping with 2 isps

[LARTC] port-mapping with 2 isps

[Diego Torres]

hello... i've got an annoying problems that makes me think that i want to do something that is impossible... :) explanation:


i've two dsl lines and a linux box as a "load balancer".

some traffic goes out by eth0 and other goes out by eth1. (i mark the packets with iptables and then have 2 route tables)

i'm currently forwarding some incoming connections (to the port 80 on eth0) to another host inside the network. this works without problems as long as eth0 is the default gateway.

trying to forward connections on eth1 port 80 with eth0 as the default gateway results in the linux box loosing the answer packet from the host inside the network.


diagram:

inet | - isp1 -- eth0\
     |                - LINUX ROUTER - eth2 - swith - "server host"
     | - isp2 -- eth1/

# ip ro sh
81.33.13.128 dev eth1  scope link  src 81.33.13.174
80.25.88.192 dev eth0  scope link  src 80.25.88.228
80.25.88.192/26 dev eth0  proto kernel  scope link  src 80.25.88.228
81.33.13.128/26 dev eth1  proto kernel  scope link  src 81.33.13.174
172.16.0.0/16 dev eth2  proto kernel  scope link  src 172.16.0.2
default via 80.25.88.193 dev eth0

because eth0 is the default gw, i can forward incoming connections on eth0 to the "server host".

can anyone help me so i can forward conections happening on both interfaces (eth0 & eth1, doesn't matter who is the default gw) ?

thanks in advance....

-- 
-- gnupg keyfingerprint -- 48AF 5BF9 8F54 2966 64CC  2327 7CD0 DD91 B09D 5799
-- Use of a keyboard or mouse may be linked to serious injuries or disorders.  
Diego Torres - dtorres@coral.dnsalias.org - Madrid / España
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] port-mapping with 2 isps

[Martin A. Brown]

Diego!

 : hello... i've got an annoying problems that makes me think that i want
 : to do something that is impossible... :) explanation:

No--not impossible.  Not trivial--but not impossible.

 : i've two dsl lines and a linux box as a "load balancer". some traffic
 : goes out by eth0 and other goes out by eth1. (i mark the packets with
 : iptables and then have 2 route tables)

 : i'm currently forwarding some incoming connections (to the port 80 on
 : eth0) to another host inside the network. this works without problems
 : as long as eth0 is the default gateway.
 :
 : trying to forward connections on eth1 port 80 with eth0 as the default
 : gateway results in the linux box loosing the answer packet from the
 : host inside the network.

Same server reachable via two public IPs.  As proven in this forum last
week, by Russell Senior, you can do this EVEN if the internal server has
a single IP.  Until last week, I was convinced that two internal IPs were
required.  That is no longer so.

See the thread which starts here:

  http://mailman.ds9a.nl/pipermail/lartc/2003q2/007952.html

And the magic happens here:

  http://mailman.ds9a.nl/pipermail/lartc/2003q2/008090.html

 : diagram:
 :
 : inet | - isp1 -- eth0\
 :      |                - LINUX ROUTER - eth2 - swith - "server host"
 :      | - isp2 -- eth1/
 :
 : # ip ro sh
 : 81.33.13.128 dev eth1  scope link  src 81.33.13.174
 : 80.25.88.192 dev eth0  scope link  src 80.25.88.228
 : 80.25.88.192/26 dev eth0  proto kernel  scope link  src 80.25.88.228
 : 81.33.13.128/26 dev eth1  proto kernel  scope link  src 81.33.13.174
 : 172.16.0.0/16 dev eth2  proto kernel  scope link  src 172.16.0.2
 : default via 80.25.88.193 dev eth0
 :
 : because eth0 is the default gw, i can forward incoming connections on
 : eth0 to the "server host".
 :
 : can anyone help me so i can forward conections happening on both
 : interfaces (eth0 & eth1, doesn't matter who is the default gw) ?

Another reasonable option is to assign an additional IP address to the
internal server, and follow these instructions to configure the DNAT
and routing for each IP:

  http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound

Good luck, Diego,

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] port-mapping with 2 isps

[Martin A. Brown]

[ Diego; I figured others would be interested in this answer, so I am
  copying the list. ]

 : > See the thread which starts here:
 : >
 : >   http://mailman.ds9a.nl/pipermail/lartc/2003q2/007952.html
 : >
 : > And the magic happens here:
 : >
 : >   http://mailman.ds9a.nl/pipermail/lartc/2003q2/008090.html
 :
 : thanks a lot! maybe i can now see some light on this problem :)
 :
 : i was thinking in mark'ing the output packet on the host server (with
 : the same mark i'm using on the router box to route through the
 : non-default gw) if i understood correctly, this is what has been done
 : on the example below ...

Not quite (if I understand your explanation).  First and foremost, the
fwmark is packet meta-data which does not survive once the packet leaves a
router.

The cleverness of the solution is to take advantage of the connection
tracking mechanism (which keeps state), to set an fwmark on a packet as
soon as the packet enters the machine.

Now your stateless IP routing mechanism (FIB || RPDB + routing tables)
makes a decision based on the packet and the meta-data (fwmark).

 : iptables -t mangle -I PREROUTING -m conntrack --ctstate DNAT \
 :   --ctorigdst eee.fff.ggg.11 -j MARK --set-mark 2
 :
 : ip rule add fwmark 2 table T2
 :
 : but yet i don't understand why rp_filter should be turned off...

rp_filter (reverse path filtering) described:

  http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html#AEN616

rp_filter is a sysctl which tells your linux box to take some
anti-spoofing measures.  Naturally, this anti-spoofing technique works to
your disadvantage if you wish to be able to reach a particular network (in
this case 0/0) through multiple interfaces.  So, if you don't want the
kernel happily throwing away packets arriving on unexpected interfaces,
simply put a lightweight zero in rp_filter.

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/