Re: Asymmetric routing and connection tracking

[Thomas Jacob <jacob@internet24.de>]

>   There are no rules that does stateful matching for traffic that is
>  forwarded between two routers.  Such rules are only applied for traffic
>  that is forwarded to an access LAN (like eth2).  Traffic that comes in
>  from a transit provider and are forwarded directly to another router is
>  only filtered based on simple source/destination matches in the IP.
> 
>   If such rules do not match, and the router is the last hop before a
>  packet reaches its destination, it will apply stateful matching.  But
>  this happens only for packets to/from access VLANs like eth2 in my
>  drawing.

So in the scenario described, R1 wouldn't do any stateful packet
filtering for packets to and from the internal server network? But
the connections will be added to the connection tracking table of
R1 nonetheless (unless you use the NOTRACK target
in raw), only not with an ESTABLISHED state which probably
means they timeout more often than needed and you have
more insert/remove actions over the connection tracking hash
table, maybe that's the source of your problem.

You could try the NOTRACK/raw thing on the (internal-)standby-router,
or you could route the packets of connections that have incoming data
from
R1 back out over R1 with a policy routing setup (+connmark) on R2.

>   I have several transit providers, but since it's not really relevant
>  for the problem (at least I don't think so) I didn't bother to draw
>  them.  You're right that using some form of VRRP could have been a
>  possible solution though if I had only one, so I should have mentioned
>  it.  Apologies.

OK that makes sense, otherwise this would be high
up on my list for "most complicated solution for a simple problem" :-)

  Thomas