nat on multihomed server

nat on multihomed server

[Sandy T. Santos]

our campany has two internet links from different isp's. we then use both
of these to host the company's webserver. what i want is that the
webserver maybe accessible by coming from my isp1 link or my isp2 link. i
know that i need to set up my dns to have two ip addresses that points to
my linux box and then DNAT that connection towards my webserver. what i
don't know is what's the iptables script gonna look like for the SNAT
reply. how would i be able to determine that the request that came in to
my webserver originated from my isp1 or isp2 link  so that the reply would
be SNAT'ed to that interface?

should i just make two SNAT  that replies to the request irregardless of
the destination address? ex. iptables -t nat -A POSTROUTING -s 192.168.x.2
--sport 80 -j SNAT --to-ip (ip facing isp1) and  iptables -t nat -A
POSTROUTING -s 192.168.x.2 --sport 80 -j SNAT --to-ip (ip facing isp2)

other suggestions are welcome.

-- 
Sandy T. Santos <sandy@bulacan.gov.ph>
Provincial Information Technology Office
Provincial Government of Bulacan
Malolos, Philippines

Re: nat on multihomed server

[Antony Stone]

On Saturday 24 January 2004 3:35 am, Sandy T. Santos wrote:

> our campany has two internet links from different isp's. we then use both
> of these to host the company's webserver. what i want is that the
> webserver maybe accessible by coming from my isp1 link or my isp2 link. i
> know that i need to set up my dns to have two ip addresses that points to
> my linux box and then DNAT that connection towards my webserver. what i
> don't know is what's the iptables script gonna look like for the SNAT
> reply. how would i be able to determine that the request that came in to
> my webserver originated from my isp1 or isp2 link  so that the reply would
> be SNAT'ed to that interface?

I suggest you give your webserver two internal addresses on the same interface 
(eg 192.168.1.100 and 192.168.1.101, or whatever fits with your addressing 
scheme), and DNAT one public address to the first, and the other public 
address to the second.

Your web server applications should be able to listen on multiple addresses, 
and it will reply from the address which was contacted, therefore the 
automatic SNAT rules which netfilter will do for you behind the scenes will 
work.   No need for manual SNAT rules.

Regards,

Antony.

-- 
My New Year's resolution is not to make any resolutions I can't keep.

I'm wondering whether I've failed already.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: nat on multihomed server

[Alexis]

if your webserver is your firewall box, DNAT is not necessary.

just the input rule is enough.


eg

eth1 isp1
eth2 isp2

iptables -P INPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW -p --dport 80 -j ACCEPT

and thats it


----- Original Message ----- 
From: "Sandy T. Santos" <sandy@bulacan.gov.ph>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, January 24, 2004 12:35 AM
Subject: nat on multihomed server


> our campany has two internet links from different isp's. we then use both
> of these to host the company's webserver. what i want is that the
> webserver maybe accessible by coming from my isp1 link or my isp2 link. i
> know that i need to set up my dns to have two ip addresses that points to
> my linux box and then DNAT that connection towards my webserver. what i
> don't know is what's the iptables script gonna look like for the SNAT
> reply. how would i be able to determine that the request that came in to
> my webserver originated from my isp1 or isp2 link  so that the reply would
> be SNAT'ed to that interface?
>
> should i just make two SNAT  that replies to the request irregardless of
> the destination address? ex. iptables -t nat -A POSTROUTING -s 192.168.x.2
> --sport 80 -j SNAT --to-ip (ip facing isp1) and  iptables -t nat -A
> POSTROUTING -s 192.168.x.2 --sport 80 -j SNAT --to-ip (ip facing isp2)
>
> other suggestions are welcome.
>
> -- 
> Sandy T. Santos <sandy@bulacan.gov.ph>
> Provincial Information Technology Office
> Provincial Government of Bulacan
> Malolos, Philippines
>
>
>