On Wed, 15 Aug 2007 09:55:06 am Tom Eastep wrote:
> James Gray wrote:
> > Tom Eastep wrote:
> >> James Gray wrote:
> >>> I thought I followed all the docs but I feel like I've missed something
> >>> really basic.
> >>
> >> Like maybe Shorewall FAQ 57?
> >>
> >> -Tom
> >
> > Thanks Tom.  I really appreciate the fast response :)  I've been doing
> > most of the config offline using the 3.x PDF documentation, and it
> > doesn't lay it out as plainly as FAQ 57.  My bad.
> >
> > I replaced "loose" with "balance" in the providers options.  However,
> > after restarting shorewall (sudo service shorewall restart) the routing
> > totally wigged out.  Traffic was going out on the two interfaces
> > (ISP1/2) but if data was coming back, it wasn't reaching the clients.  I
> > reverted to the old config and all was good (all traffic on one
> > interface).
>
> Your tcrules are so completely broken (see my other post) that this
> isn't surprising.
>
> I suggest that you totally forget traffic shaping for the time being and
> get multi-ISP working the way that you want it. Then *and only then*
> should you add traffic shaping.

Ok.  I got the multi-ISP stuff going without any traffic shaping but that's 
not particularly useful for us.  We must have certain traffic going out over 
specific links, otherwise the service will fail (tcpwrappers "paranoid" and 
certain services that must originate from one link or the other).  But 
there's traffic that should be going over specific links over both, and other 
traffic bound to an interface that should be on the other :(

For instance, ALL ssh (tcp/22) traffic should be going out over NET_IF1 (eth3, 
via 172.16.3.1) with mark of 10 or 20.  But here's a tcp trace from the LAN:

$tcptraceroute XX.XX.XX.XX 22
Selected device eth0, address 10.10.10.74, port 37321 for outgoing packets
Tracing the path to XX.XX.XX.XX on TCP port 22 (ssh), 30 hops max
 1  10.10.10.1  0.727 ms  0.142 ms  0.128 ms
 2  172.16.4.1  0.859 ms  0.656 ms  0.643 ms  <--- *** NO! ***
 3  203.38.103.1  11.029 ms  10.983 ms  9.575 ms
 4  TenGigabitEthernet8-1.ken17.Sydney.telstra.net (203.50.20.27)  10.486 ms  
10.770 ms  11.849 ms
 5  ge-2-1-0-25.bdr5.hay.connect.com.au (203.63.130.250)  11.091 ms  10.497 ms  
12.283 ms
 6  gigabitethernet0-1.cor10.hay.connect.com.au (203.63.217.3)  11.623 ms  
11.821 ms  10.474 ms
 7  * * *

Hop #2 should be going out via 172.16.3.1.  The router it's going through is 
actually NET_IF2 (eth4).  Consequently, the traffic is dropped because the 
destination will only accept connections from the first ISP (NET_IF1).  I 
thought the config below would achieve the desired result...but apparently 
not.

I've changed the providers OPTIONS for the two ISP's to "track,balance".  
Which got things working...apart from this weird traffic/routing behaviour.  
Attached is another shorewall dump whilst running with the config below.

tcrules:
#MARK SOURCE        DEST    PROTO DEST     SOURCE   USER     TEST LENGTH TOS
#                                          PORT(S)  PORT(S)
50    $ANY_IP
50    $FW
50    $LAN_NETWORK  $ANY_IP udp   $GAMES
50    $LAN_NETWORK  $ANY_IP tcp   $GAMES
50    $LAN_NETWORK  $ANY_IP udp   $P2P
50    $LAN_NETWORK  $ANY_IP tcp   $P2P
50    $LAN_NETWORK  $ANY_IP udp   $IM
50    $LAN_NETWORK  $ANY_IP tcp   $IM
50    $LAN_NETWORK  $ANY_IP tcp   $ALLMAIL
40    $LAN_NETWORK  $ANY_IP tcp   $STREAM
30    $LAN_NETWORK  $ANY_IP tcp   nntp
30    $DMZ1_NETWORK $ANY_IP tcp   $ALLMAIL
20    $LAN_NETWORK  $ANY_IP tcp   $FTP
20    $LAN_NETWORK  $ANY_IP tcp   $WWW
20    $LAN_NETWORK  $ANY_IP tcp   ssh     -         -        -    513:
10    $LAN_NETWORK  $ANY_IP tcp   domain
10    $LAN_NETWORK  $ANY_IP udp   domain
10    $LAN_NETWORK  $ANY_IP tcp   ssh     -         -        -    0:512

tcclasses:
#INTERFACE MARK RATE      CEIL      PRIORITY OPTIONS
$NET_IF1   10   full      full      1        tcp-ack,tos-minimize-delay
$NET_IF1   20   9*full/10 9*full/10 2
$NET_IF1   30   6*full/10 6*full/10 3        default

$NET_IF2   40   full      full      4        tcp-ack,tos-minimize-delay
$NET_IF2   50   6*full/10 6*full/10 5        default

providers:
#NAME NUMBER MARK DUPLICATE   INTERFACE   GATEWAY       OPTIONS   COPY
squid 1      202  -           $LAN_IF     $PROXYSVR     loose     -
$ISP1 2      1    main        $NET_IF1    $NET_IF1_GW   $PROVOPTS $COPY
$ISP2 3      2    main        $NET_IF2    $NET_IF2_GW   $PROVOPTS $COPY
(COPY=eth0,eth1,eth2)

What is left to make this work....it feels close :-/

Cheers,

James
-- 
"All snakes who wish to remain in Ireland will please raise their right 
hands."
                -- Saint Patrick

Attachment: shorewall-dump.txt.bz2
Description: BZip2 compressed data

Attachment: smime.p7s
Description: S/MIME cryptographic signature

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users

Reply via email to