On Thu, Jun 20, 2002, Noam Meltzer wrote about ""Load balancing" between two or more lines": > I am trying to find a way to connect to the internet through more than > one line. > Round-Robin is not an option in my case, because I am working with more > than one ISP.
You didn't say what the intended use is, so I'll assume we're talking about a SOHO (small office/home office) solution, not a solution for a relatively large company with two fat pipes, so BGP is completely out of the question. I'll also assume for simplicity the computers you plan to connect to the Internet are going to be clients, not servers (when you have non-fixed IP addresses from your ISP, this assumption makes sense anyway) - but this assumption is not necessary. The usual trick is to do NAT: say you connect to two ISPs with a modem, and get two IP addresses: 10.1.2.3 and 10.2.3.4. The computers in your small network are on the (say) 192.168.1.0 network. One computer/device acts as the default gateway to the others, and it is that computer/device that connects to the two ISPs. Now, whenever a packet arrives from the inner network through the gateway to the outside, the gateway chooses one of the external IP addresses (say 10.1.2.3) and NATs (masquerades) the packet as if it is coming from that packet, with a newly designated port. When more packets arrive at the same session, the gateway (which keeps the NAT table) sends them on the same IP and port as previously. When reply packets arrive at that IP and port, they are de-masqueraded and returned back to the original client in the inner network. Linux's iptables has almost all of these required features, but at a cursory glance it appears that SNAT's --to-source can only supply a consecutive range of IP addresses, not two distinct IP addresses (like we need here) which is pretty weird. I never actually tried this though - does anyone have any positive or negative experience with getting this trick to work? It'd be surprised if no-one dealt with this issue before (and as we all know, any solution beats BGP, which is a sure way to bring you one step closer to the nuthouse ;) ). By the way, Radware, the company I work for, sells a device called "Linkproof" which does something similar to what I described, but it is a heavy-duty machine, intended for fat pipes (so it's useful for relatively-large offices connecting to several ISPs, etc, not for homes or tiny offices). Of course a real product (like Linkproof) also needs to handle issues like dealing with dead lines, lines of different bandwidth, and other real-life issues like that that I didn't mention above. -- Nadav Har'El | Friday, Jun 21 2002, 11 Tammuz 5762 [EMAIL PROTECTED] |----------------------------------------- Phone: +972-53-245868, ICQ 13349191 |Christopher Robin Hood steals from the http://nadav.harel.org.il |rich and gives to the Pooh. ================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
