Re: Asymmetric routing and connection tracking

[Tore Anderson <tore@linpro.no>]

* Thomas Jacob

> Assuming that you do some sort of stateful firewalling on both R1 and
> R2, I wonder why this works at all, as at least netfilter in kernel
> 2.6 isn't too happy about only seeing one direction of a particular
> connection's traffic, (this used to work in 2.4 stock kernels).

  There are no rules that does stateful matching for traffic that is
 forwarded between two routers.  Such rules are only applied for traffic
 that is forwarded to an access LAN (like eth2).  Traffic that comes in
 from a transit provider and are forwarded directly to another router is
 only filtered based on simple source/destination matches in the IP.

  If such rules do not match, and the router is the last hop before a
 packet reaches its destination, it will apply stateful matching.  But
 this happens only for packets to/from access VLANs like eth2 in my
 drawing.

> Apart from that, I'd be interested to know why you set up this system
> with BGP and OSPF? If you have just on upstream transit provider?

  I have several transit providers, but since it's not really relevant
 for the problem (at least I don't think so) I didn't bother to draw
 them.  You're right that using some form of VRRP could have been a
 possible solution though if I had only one, so I should have mentioned
 it.  Apologies.

  My network is a bit larger than my drawing anyway, and it's not that
 easy (or desireable, for that matter) to make sure packets between two
 hosts take the same route in both directions.  But I would like to be
 able to use stateful firewalling on the routers that have the role as
 access routers too.

Regards
-- 
Tore Anderson