hi! this is the solution i need, i just wish there was a way to implement it... and thats what i'm looking for. a few correction on your very good guess of my network, is that the linux which connects to the internet runs a proxy (squid) and from one ethernet card its connected to two ADSLs (but this no. will increase probably), and from another it connects to another computer which does the real NAT. I just need that every packet that goes out of the linux to the internet and every related packet afterward will go through the same interface.
I thought it might be possible to do with a combination of iproute2 and defining three default gateways and maybe adding to this netfilter functionality, which will continue sending related packets through the same interface. But thats seems a little bogus to me, and i'm not sure thats its possible. Noam On Fri, 2002-06-21 at 01:33, Nadav Har'El wrote: > On Thu, Jun 20, 2002, Noam Meltzer wrote about ""Load balancing" between two or more >lines": > > I am trying to find a way to connect to the internet through more than > > one line. > > Round-Robin is not an option in my case, because I am working with more > > than one ISP. > > You didn't say what the intended use is, so I'll assume we're talking about > a SOHO (small office/home office) solution, not a solution for a relatively > large company with two fat pipes, so BGP is completely out of the question. > I'll also assume for simplicity the computers you plan to connect to the > Internet are going to be clients, not servers (when you have non-fixed IP > addresses from your ISP, this assumption makes sense anyway) - but this > assumption is not necessary. > > The usual trick is to do NAT: say you connect to two ISPs with a modem, and > get two IP addresses: 10.1.2.3 and 10.2.3.4. The computers in your small > network are on the (say) 192.168.1.0 network. One computer/device acts > as the default gateway to the others, and it is that computer/device that > connects to the two ISPs. Now, whenever a packet arrives from the inner > network through the gateway to the outside, the gateway chooses one of the > external IP addresses (say 10.1.2.3) and NATs (masquerades) the packet as > if it is coming from that packet, with a newly designated port. When more > packets arrive at the same session, the gateway (which keeps the NAT table) > sends them on the same IP and port as previously. When reply packets arrive > at that IP and port, they are de-masqueraded and returned back to the > original client in the inner network. > > Linux's iptables has almost all of these required features, but at a > cursory glance it appears that SNAT's --to-source can only supply a > consecutive range of IP addresses, not two distinct IP addresses (like > we need here) which is pretty weird. I never actually tried this though - > does anyone have any positive or negative experience with getting this > trick to work? It'd be surprised if no-one dealt with this issue before > (and as we all know, any solution beats BGP, which is a sure way to bring > you one step closer to the nuthouse ;) ). > > By the way, Radware, the company I work for, sells a device called "Linkproof" > which does something similar to what I described, but it is a heavy-duty > machine, intended for fat pipes (so it's useful for relatively-large offices > connecting to several ISPs, etc, not for homes or tiny offices). Of course a > real product (like Linkproof) also needs to handle issues like dealing with > dead lines, lines of different bandwidth, and other real-life issues like that > that I didn't mention above. > > -- > Nadav Har'El | Friday, Jun 21 2002, 11 Tammuz 5762 > [EMAIL PROTECTED] |----------------------------------------- > Phone: +972-53-245868, ICQ 13349191 |Christopher Robin Hood steals from the > http://nadav.harel.org.il |rich and gives to the Pooh. -- Noam Meltzer [EMAIL PROTECTED] ICQ: 4853872 ================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
