Re: [LARTC] Simplest method for 2 external lines?

[Adrian Chung <adrian@enfusion-group.com>]

On Mon, Oct 29, 2001 at 08:59:12PM -0500, Whit Blauvelt wrote:

[...]

> network. Since the DNS round robin should take care of bringing, for
> instance, http requests in on whichever line is up - or both if both lines

Will it?  My understanding is that it will (fairly) equally distribute
the load between both incoming lines, regardless of whether or not
they're up.  DNS doesn't check to see if the line is up before sending
a response back...

> are - what I want ip route to do is send the response back out on the same
> interface the request came in on. What's the easiest way to do that?

I've been thinking about this for a while too, and haven't been able
to come up with any bulletproof.

If the requests are for the box that both external lines run into,
then policy routing should be able to do what you want.

Take a look at:

http://ds9a.nl/2.4Routing/HOWTO/cvs/2.4routing/output/2.4routing-4.html

Since requests come in to a specific interface, policy routing could
send all packets originating from that specific interface back out the
same one.

Things get hairy when you try to use policy routing, and the packets
don't terminate at the router, but are portforwarded further inbound,
like this case:

> Also, port forwarding is being used to an internal NT mail server. I'd like
> to handle redundancy to that by having a secondary MX on the second public
> interface, and also forwarding that to the server. Again, when the server
> comes back through the masq in negotiations I'd like it to connect out
> through whichever interface/IP it was connected to from.

It's easy enough to forward both incoming SMTP MX addresses on both
external lines to the same internal host, but I don't know how to get
the responses from the internal host to go back out whichever
interface they originally came in from.  If anyone's got any ideas,
I'm all ears. :)

Marking doesn't work, since the packets don't have their respective
marks anymore by the time they get back from the internal host to the
router, and policy based routing doesn't work, because it's a static
set of rules.

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] up 89 days, 4:56, 6 users


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/