From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robert Kurjata Date: Fri, 24 Oct 2003 06:46:29 +0000 Subject: Re[4]: [LARTC] 'Help with routing' Message-Id: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable To: lartc@vger.kernel.org Witaj Nicolas, W Twoim li=9Ccie datowanym 24 pa=9Fdziernika 2003 (05:26:05) mo=BFna przecz= yta=E6: NF> HI ROBERT: NF> I apologise for mi ugly and diagrama thank you for the help. NF> This is the scheme of my network [cut out] NF> I`m using multipath default gateway because I want to balance the traf= fic NF> of my squid server (Is the proxy too). But I need the two networks go o= ut NF> from its corresponding gateway. Ok, I understand that the squid proxy server resides on your gateway and you only want to load balance a proxy, not the lans. So you have to distinguish between traffic from-to proxy and from your lans and apply different routing policies. I thing the best Idea is to use classical firewall marking (-j MARK --set-mark xx) depending on type of traffic and then use policy routing selecting different scenarios using ip rule add prio fwmark table Should work. I use similar setup for limiting selected traffic to single interface only in multipath router. NF> My problem is this: I can`t make everything that go out from one of the= ISP NF> go out from the gateway that correspond to it. For example everything t= hat NF> comes from ETH1 go out from ETH2. NF> I think the correct thing is everything comes from ETH1 go out from ETH0 NF> -----------------------------------------------------------------------= ----- NF> ------ NF> Esta es mi Conf NF> #removing old rules NF> echo "removing old rules" NF> ip rule del prio 50 table main NF> ip rule del prio 201 from 200.47.4.98/32 table 201 NF> ip rule del prio 202 from 200.80.32.158/32 table 202 NF> ip rule del prio 221 table 221 NF> echo "flushing tables" NF> ip route flush table 201 NF> ip route flush table 202 NF> ip route flush table 221 NF> echo "removing tables" NF> ip route del table 201 NF> ip route del table 202 NF> ip route del table 221 NF> # setting new rules NF> echo "Setting new routing rules" NF> # main table w/o default gateway here NF> ip rule add prio 50 table main NF> ip route del default table main NF> # identified routes here NF> ip rule add prio 201 from 200.47.4.98/32 table 201 NF> ip rule add prio 202 from 200.80.32.158/32 table 202 NF> ip route add default via 200.47.4.97 dev eth0 src 200.47.4.98 proto sta= tic NF> table 201 NF> ip route append prohibit default table 201 metric 1 proto static NF> ip route add default via 200.80.32.157 dev eth2 src 200.80.32.158 proto NF> static table 202 NF> ip route append prohibit default table 202 metric 1 proto static NF> # mutipath NF> ip rule add prio 221 table 221 NF> ip route add default table 221 proto static nexthop via 200.47.4.97 dev= eth0 NF> weight 2 nexthop via NF> 200.80.32.157 dev eth2 weight 3 NF> ip route flush cache NF> exit NF> THANKS VERY MUCH AND SORRY FOR MI HIGHSCHOOL ENGLISH NF> -----------------------------------------------------------------------= ----- NF> --------------------------------- NF> Nicolas Fillon NF> Argentina NF> ----- Original Message -----=20 NF> From: "Robert Kurjata" NF> To: NF> Cc: NF> Sent: Thursday, October 23, 2003 4:13 AM NF> Subject: Re[2]: [LARTC] 'Help with routing' >> Witaj nixo, >> >> W Twoim li=9Ccie datowanym 22 pa=9Fdziernika 2003 (20:13:29) mo=BFna prz= eczyta=E6: >> >> Seems like I didn't read your posting deeply enough. Before I can help >> I need to know some more details. >> >> Why are you using multipath default gateway? If you just need to make >> a proper routing for two separate lans going through one machine, not >> mixing them you should never use it. It's usefull for NAT-ed lan >> inside, not for public IP's. Just create simple routes without >> multipath. eth0 <-> eth1 and eth2 <-> eth3. >> >> >> nnca> Thank you very much for the solution, but I still have a problem a= nd NF> I >> nnca> need help :) . The problem number one has been solved. When I trace NF> from >> nnca> any computer of my LAN, It`s go out from the right ISP. But after a NF> short >> nnca> time, is like if the rute was chached and it back to the same NF> problem. >> nnca> (I=B4m getting paranoic :-P ) >> >> nnca> The Problem number two still happens when someone from outside tra= ce NF> an IP >> nnca> from mi LAN. Always the before complete jump is responded for the >> nnca> interface who correnspond to the other ISP. >> >> nnca> Do you have an idea what can be the failure... or, can I call this= a >> nnca> failure in my config? >> >> nnca> THANKS VERY MUCH >> nnca> Nicolas Fillon >> nnca> Argentina >> >> >> Hi nixo, >> >> >> >> I suppose you don't preserve properly output address see my postting >> >> with script from 15th October this year :) >> >> (append prohibit default:) >> >> >> >> >> >> nnca> the scheme of my LAN is the next: >> >> >> >> nnca> eth0 isp1 /32 >> >> nnca> eth1 lan de isp1 (LAN With public IP /24) >> >> nnca> eth2 isp2 /32 >> >> nnca> eth3 lan de isp2 (LAN With public IP /26) >> >> >> >> nnca> ip route add 200.47.x.x/24 dev eth0 src 200.47.4.x table 1 >> >> nnca> ip route add default via 200.47.4.x table 1 >> >> >> >> >> >> nnca> ip route add 200.80.32.x/26 dev eth2 src 200.80.32.x table 2 >> >> nnca> ip route add default via 200.80.32.x table 2 >> >> >> >> >> >> >> >> nnca> ip rule add from 200.47.4.x table 1 >> >> nnca> ip rule add from 200.80.32.x table 2 >> >> >> >> nnca> ip route add default scope global nexthop via 200.47.4.x dev et= h0 >> >> nexthop nnca> via >> >> nnca> 200.80.32.x dev eth2 >> >> >> >> nnca> ****** >> >> >> >> nnca> My problem is this: when I trace from the NETWORK of ISP1, >> >> sometimes the nnca> tracer go out from the gateway of ISP2 and vice >> >> versa >> >> >> >> nnca> And when someone trace an IP from my LAN of ISP1, it`s showme as >> >> before nnca> complete the gateway from ISP2 y vice versa. >> >> >> >> >> >> nnca> Mi question is: what is wrong in my config...??? What I need to >> >> put or is nnca> anything wrong with this config???. >> >> nnca> THANKS VERY MUCH AND SORRY FOR MI HIGHSCHOOL ENGLISH. >> >> >> >> >> >> --=20 >> Pozdrowienia, >> Robert mailto:rkurjata@ire.pw.edu.pl >> >> _______________________________________________ >> LARTC mailing list / LARTC@mailman.ds9a.nl >> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ >> --=20 Pozdrowienia, Robert mailto:rkurjata@ire.pw.edu.pl _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/