Re: Dual WAN set-up

[Dimitri Yioulos <dyioulos@onpointfc.com>]

On Friday 13 January 2012 10:17:21 am you wrote:
> On Friday 13 January 2012 9:17:20 am Lloyd Standish wrote:
> > On Fri, 13 Jan 2012 01:25:45 -0600, Andrew Beverley
>
> <andy@andybev.com> wrote:
> > > Using marks is one way to do this, and provides plenty of
> > > flexibility. However, if all the traffic is coming from the
> > > same IP address / interface, then you should be able to use
> > > straight iproute2 rules to match those aspects, without
> > > even touching iptables (see ip rule).
> > >
> > >> 	iptables -t mangle -A PREROUTING -m state --state NEW
> > >> -s 10.x.x.x -j CONNMARK1
> >
> > That's a good point.  In my own firewall, at one point I
> > wanted to avoid load-balancing for certain hosts (i.e.,
> > always route through a given interface for a certain source
> > IP), and I was unable to use "ip rule" with no packet
> > marking.  However, I think this is because all the hosts were
> > internal LAN hosts using SNAT, and the NAT is done before the
> > packet hits "ip rule."  Therefore "ip rule" could not match
> > on the source IP. But in Dimitri's case, since there is no
> > NAT for the DMZ hosts, this should work fine, and is simpler.
> >  The only reason to mark packets would be to allow the
> > possibility of later routing some of the LAN hosts through
> > the second interface.
> >
> > >Also, if you do decide to use netfilter marks (which is
> > > certainly no bad thing IMHO), then you probably don't need
> > > to mark connections and then restore them. Instead just
> > > mark a packet straight away: iptables -t mangle -A
> > > PREROUTING -s 10.x.x.x -j MARK --set-mark 1
> >
> > Another very good point for Dimitri, Andy, which should give
> > better efficiency.  Connection marking is only necessary for
> > load-balancing. I guess I am in a "load-balancing" mindset.
> >
> > --
> > Lloyd
> > --
> > To unsubscribe from this list: send the line "unsubscribe
> > netfilter" in the body of a message to
> > majordomo@vger.kernel.org
> > More majordomo info at
> > http://vger.kernel.org/majordomo-info.html
>
> Lloyd,
>
> Not to throw a proverbial wrench in the works, but in my case
> there is NAT for the DMZ hosts.
>
> I have three NICs currently active on the fw (more are
> available): eth0 - WAN, eth1 - LAN, eth2 - DMZ.  In addition,
> eth0 has several aliases for the external addresses of the DMZ
> boxes. Then, NAT to internal addresses (10.x.x.x).
>
> Hope I'm not muddying the waters but, rather, providing all of
> the info that you need to so kindly help me.
>
> Dimitri


Er, sorry, seems like I don't even remember my own network scheme.  
internal LAN addresses are 192.168.100.0/22, and internal DMZ 
addresses are 192.168.1.0/24.  (The 10.x.x.x addresses are used 
by our VPN.)

Dimitri

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.