Re: DNAT + 2 uplinks + route = nogo

[Ray Leach <raymondl@knowledgefactory.co.za>]

[-- Attachment #1: Type: text/plain, Size: 1930 bytes --]

On Wed, 2003-10-15 at 10:23, Gaby Schilders wrote:
> I'm in real trouble here so I hope somebody is able to answer this today (I know, my mistake in planning doesn't mean you will rush. I can try, can't I? ;)
> 
> Problem as follows:
> 
> - 1 linux box with 4 interfaces. Internal (private space), DMZ (can be ignored for this issue), 2 uplinks to different providers with different public ranges.
> - DNAT (actually portforwarding) set up to to a few internal boxes on 1 uplink.
> - I want to do DNAT to the same internal IP-addressess over the second link (obviously with different public ip-addressess).
> - Routing chooses the wrong uplink (gateway) for the return packets.
> 
> Cause:
> DNAT is only undone at the last moment so even with iproute2's "ip rule" trick I can't discern between connections coming in through one link or the other for the return packets.
> 
> Solution that I can think of:
> If connections are DNATted, recall the routing routing after undoing the DNAT for the return packets. Problems with said solution: I can read C code, but only barely, and not write it. Also, I have only a very shallow understanding of the routing code and I'm running out of time. I don't know if the code allows the distinction between DNAT return packets from all other packets so that this can be done at all.
> 
> Question:
> I have no idea how complex it would be to create this 'hack'. Does anyone know of a patch that realises this feature or is someone prepared to create such a patch? If not, whom should I ask instead?
> 
You could try the P-O-M ROUTE target patch.
> Desperatly yours,
> 
> Gaby Schilders
> IBFD network admin
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]