Mark Shields wrote:
eth0 gives you the default gw via DHCP, and you're trying to set a
default gw for eth1, right? If so, you can't do that. There can only
be one default gateway (hence the name). What are the functions of the
NICs on the private networks (eth1/eth2)?
<router geek hat on>
You can have as many default gateways or perhaps gateway of last resort
or the least specific gateway are better names as your routing engine
can support. There is nothing special about a default gateway. It's just
a route like all other routes, just far less specific.
By default Linux uses the first 0.0.0.0/0 route you set. However by
turning on advanced routing in the kernel you can configure more than
one. Unfortunately Linux will do per packet instead of the fancier per
TCP stream that most routers do by default these days. Per packet round
robins between your gateways and can cause packets to arrive out of
order in some cases. Per stream, this isn't quite the right terminology
but you get the idea, has the downside that one large connection like
your db backing up to a remote server can swamp a single gateway.
Going back to the original question I don't you're having a routing
problem though I'm not sure I understand exactly what you're doing. Once
a packet reaches any interface of your route/firewall the Linux should
be aware of all local networks. Unless you're routing specific non
connected networks to various interfaces you shouldn't need any
additional routes.
A netstat -rn should look roughly like this:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
24.x.x.43 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo
10.x.11.1 0.0.0.0 255.255.255.0 U 0 0 0 eth1
10.x.12.1 0.0.0.0 255.255.255.0 U 0 0 0 eth1:0
10.x.21.1 0.0.0.0 255.255.255.0 U 0 0 0 eth2
10.x.22.1 0.0.0.0 255.255.255.0 U 0 0 0 eth2:0
0.0.0.0 24.x.x.1 0.0.0.0 UG 0 0 0 eth0
However unless you have enabled ip_forward on your router, Linux is
unlikely to route packets from one interface to another. I'm betting
that's your problem.
kashani
--
[EMAIL PROTECTED] mailing list
