2 ISPs on firewall

2 ISPs on firewall

[Matthias Kattanek]

There seems to be lots of question about multihomed firewall/routers.
I am in similiar situation. Having 2 ISP, where to provide services too.

I managed to forward traffic to e.g. a web server in the DMZ zone.
Main problem I encounter is that the response is always going out
via the DEFAULT gateway on the router.
(In my case one ISP doesn't like it and drops the response.)

I was under the impression that connection tracking of Netfilter keeps 
"track" which interface the traffic came in and anticipated it would go 
out the same route it came from.

What am I missing here?
What does it take to make it happen?
Do I just need additional rules for Netfilter?
Would something like "ip_conntrack_isp" work out? Understood such module
needs to be developed. Q just arises is that a way to go?

mattes

RE: 2 ISPs on firewall

[George Vieira]

that's exactly right.. connection tracking.. meaning the ports connections,
but the path it came from all depends on it's routing so as long as the
packet arrives it knows the connection it's for..

You need something like using the TOS value for minimise-cost and routing
that to the other link... so it works like a redundant link and doesn't go
through the other because it thinks it costs the earth to go that way..
iproute2 might be able to help here but never done it..

thanks,
George Vieira
Systems Manager
Citadel Computer Systems P/L
http://www.citadelcomputer.com.au



-----Original Message-----
From: Matthias Kattanek [mailto:mattes@mykmk.com]
Sent: Wednesday, 03 July 2002 11:54 AM
To: netfilter@lists.samba.org
Subject: 2 ISPs on firewall



There seems to be lots of question about multihomed firewall/routers.
I am in similiar situation. Having 2 ISP, where to provide services too.

I managed to forward traffic to e.g. a web server in the DMZ zone.
Main problem I encounter is that the response is always going out
via the DEFAULT gateway on the router.
(In my case one ISP doesn't like it and drops the response.)

I was under the impression that connection tracking of Netfilter keeps 
"track" which interface the traffic came in and anticipated it would go 
out the same route it came from.

What am I missing here?
What does it take to make it happen?
Do I just need additional rules for Netfilter?
Would something like "ip_conntrack_isp" work out? Understood such module
needs to be developed. Q just arises is that a way to go?

mattes

Re: 2 ISPs on firewall

[John Adams]

On Tuesday 02 July 2002 09:53 pm, Matthias Kattanek wrote:
> There seems to be lots of question about multihomed firewall/routers.
> I am in similiar situation. Having 2 ISP, where to provide services too.
>
> I managed to forward traffic to e.g. a web server in the DMZ zone.
> Main problem I encounter is that the response is always going out
> via the DEFAULT gateway on the router.
> (In my case one ISP doesn't like it and drops the response.)
>
> I was under the impression that connection tracking of Netfilter keeps
> "track" which interface the traffic came in and anticipated it would go
> out the same route it came from.
>
> What am I missing here?
> What does it take to make it happen?
> Do I just need additional rules for Netfilter?
> Would something like "ip_conntrack_isp" work out? Understood such module
> needs to be developed. Q just arises is that a way to go?

Here's a script I use with iproute2.  It gives two default routes with 
different weightings for different speed lines.
johna

GATEWAY0=216.254.97.1
GATEWAY1=65.185.37.22
NIC0=216.254.97.15
NIC1=65.185.37.21
route del default
ip route add 0.0.0.0/0 via $GATEWAY0 table E0
ip route add 0.0.0.0/0 via $GATEWAY1 table E1 
ip rule add from $NIC0 table E0
ip rule add from $NIC1 table E1
ip route add default scope global \
	nexthop via $GATEWAY0 weight 6 \
	nexthop via $GATEWAY1 weight 1
ip route flush cache

Re: 2 ISPs on firewall

[Carlos Lopez]

I did the same but have a problem actually trying to
make a DNAT with two ips to one destination. ie:
iptables -A PREROUTING -t nat -i eth0 -d 1.2.3.4 -j
DNAT --to 172.28.16.4 
iptables -A PREROUTING -t nat -i eth1 -d 5.6.7.8 -j
DNAT --to 172.28.16.4 

and using iproute the same way as described by John.
But I can see only one of the addresses from the
outside working right.

any clues?

Thanks,
Carlos.

--- John Adams <johna@onevista.com> wrote:
> On Tuesday 02 July 2002 09:53 pm, Matthias Kattanek
> wrote:
> > There seems to be lots of question about
> multihomed firewall/routers.
> > I am in similiar situation. Having 2 ISP, where to
> provide services too.
> >
> > I managed to forward traffic to e.g. a web server
> in the DMZ zone.
> > Main problem I encounter is that the response is
> always going out
> > via the DEFAULT gateway on the router.
> > (In my case one ISP doesn't like it and drops the
> response.)
> >
> > I was under the impression that connection
> tracking of Netfilter keeps
> > "track" which interface the traffic came in and
> anticipated it would go
> > out the same route it came from.
> >
> > What am I missing here?
> > What does it take to make it happen?
> > Do I just need additional rules for Netfilter?
> > Would something like "ip_conntrack_isp" work out?
> Understood such module
> > needs to be developed. Q just arises is that a way
> to go?
> 
> Here's a script I use with iproute2.  It gives two
> default routes with 
> different weightings for different speed lines.
> johna
> 
> GATEWAY0=216.254.97.1
> GATEWAY1=65.185.37.22
> NIC0=216.254.97.15
> NIC1=65.185.37.21
> route del default
> ip route add 0.0.0.0/0 via $GATEWAY0 table E0
> ip route add 0.0.0.0/0 via $GATEWAY1 table E1 
> ip rule add from $NIC0 table E0
> ip rule add from $NIC1 table E1
> ip route add default scope global \
> 	nexthop via $GATEWAY0 weight 6 \
> 	nexthop via $GATEWAY1 weight 1
> ip route flush cache
> 


__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com