Re: [LARTC] Simplest method for 2 external lines?

[Adrian Chung <adrian@enfusion-group.com>]

On Wed, Oct 31, 2001 at 07:33:45PM -0500, Whit Blauvelt wrote:
> On Tue, Oct 30, 2001 at 01:05:56PM -0500, Adrian Chung wrote:
> > they're up.  DNS doesn't check to see if the line is up before sending
> > a response back...
> 
> The trick in Leghart's article is using dynamic DNS zones (which was a new
> feature in Bind 8) along with a script he provides that adds and removes IPs
> from the round robin according to whether the lines are up, using a short
> TTL setting and frequent checks so that adjustment, while not instant,
> should be within a few minutes, at most, and not run into problems with
> downstream caching servers. I don't mind a Website not working half the time
> for a minute or two - people are used to that much fussiness from the Web.

That's a great idea!  I had thought about doing this at one point, but
it seemed like such a hack...  But, given the circumstances, it seems
to be the best option.  After all, it's only a couple of minutes of
downtime, rather than an undeterminate amount of downtime.

> > It's easy enough to forward both incoming SMTP MX addresses on both
> > external lines to the same internal host, but I don't know how to get
> > the responses from the internal host to go back out whichever
> > interface they originally came in from.  If anyone's got any ideas,
> > I'm all ears. :)
> 
> Hmm. Considering that the secondary MX won't be used when the first is
> working, guess it would mostly work even if the remote mail daemon is fussy
> about having the response come back the same way - have to confess I don't
> know the degree of fussiness on this - sure would like the avoid the issue
> entirely, but may well be you're right and the hooks just aren't there to
> control this yet. Thanks for helping me think at it!

What I've done as a hack is:

- portforward the inbound connections to the internal box by using
  DNAT
- SNAT (change the source address) inbound packets to the address of
  the interface they came in on.  That way, the portforwarded box will
  return it's packets to a specific interface on the gateway
- Set up policy based routes to route all packets from internal host
  on respective interfaces out the same interface.

This works, but has the effect that all packets reaching the internal
host appear to have come from the gateway. :(

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] up 92 days, 3:48, 9 users


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/