From: "Ming-Ching Tiew" <mingching.tiew@redtone.com>
To: netfilter@lists.netfilter.org
Subject: Re: DNAT for two external NIC
Date: Fri, 1 Sep 2006 17:32:00 +0800 [thread overview]
Message-ID: <06a001c6cda9$79feb2e0$0100a8c0@newlife> (raw)
In-Reply-To: 44F7F0B7.5010001@gazeta.pl
From: "longraider" <longraider@gazeta.pl>
> Ming-Ching Tiew wrote:
>
> >>Maybe you need to disable rp_filter (reverse path filtering) on the
> >>interface that has not the default route.
> >>
> >>sysctl -w net/ipv4/conf/eth2/rp_filter=0
> >
> > Isn't this a bug in rp_filter ? In multipath routing, it's often the system
> > will have multiple routing tables. The rp_filter seems to only look at
> > the main routing table.
> >
>
> It looks at different tables (according to ip rule). I've recently
> posted a problem with the same solution. The problem was with the fwmark
> in the ip rules.
>
> http://lists.netfilter.org/pipermail/netfilter/2006-August/066553.html
>
I did not go through your post carefully enough to know what you are talking
about. But my question was why do we have to turn off reverse filter path
checking to get multipath routing to work ? The original idea of reverse
filter path checking is to improve security by doing reverse path checking,
ie by checking the source IP address of all packets coming in via an interface
against the networks known to be behind that interface, the firewall/router
can simply drop packets that aren't supposed to come from there. In the
multipath routing case, the packets are INDEED supposed to be from the
interface where it is coming from, why they are dropped ?
Regards.
next prev parent reply other threads:[~2006-09-01 9:32 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-09-01 6:32 DNAT for two external NIC Ming-Ching Tiew
2006-09-01 8:35 ` longraider
2006-09-01 9:32 ` Ming-Ching Tiew [this message]
-- strict thread matches above, loose matches on Subject: below --
2006-09-05 2:29 Ming-Ching Tiew
2006-09-01 1:01 Mikhail
2006-08-29 21:42 Mikhail
2006-08-29 22:00 ` Pascal Hambourg
2006-08-30 7:15 ` Florent Guiliani
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='06a001c6cda9$79feb2e0$0100a8c0@newlife' \
--to=mingching.tiew@redtone.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox