NOTE: this mail started as a help call, but I've been wrinting it
through several days, and several tests that lead more to an
investigation that to an actual question. I think it's somewhat usefull,
specially if thewre are comments on why the different cases didn't work
as spected. take in account that I didn't try to fix its redaction.
I have two ISPs, one reliable but restrictive and one unreliable but
open. I also have a internal network to which I should offer best effort
service. let me explain.
the reliable network, let's call it UNC, only offers access to
http/s and ssh. the unreliable one. Arnet, lets me access any port, but
the BW is much smaller and often the link goes down.
so what I want is to route all traffic, including the firewall
generated, through Arnet (even if it's unreliable), except http/s and
ssh, which goes though UNC, including traffic to the UNC network itself.
my current configuration is:
# shorewall.conf
[...]
MARK_IN_FORWARD_CHAIN=No
[...]
# providers
# NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY
OPTIONS COPY
UNC 1 0x100 main eth0 200.16.29.111
track,fallback,balance -
Arnet 2 0x200 main eth2 10.0.0.2
track -
# tcrules
# MARK SOURCE DEST PROTO PORT CLIENT PORTS USER
TEST
# everything through the Arnet link
0x200 - -
# UNC networks go through the UNC link
0x100 - 200.16.0.0/16
0x100 - 172.16.0.0/16
# also http/s and ssh connections generated from the internal network.
# the source does not include the FW itself! yes, I know, se below.
0x100 172.16.21.0/24 - tcp 80
0x100 172.16.21.0/24 - tcp 443
0x100 172.16.21.0/24 - tcp 22
this worked mostly fine, except for the cuts in the Arnet link,
which were espected. you can find shorewall info and mtr test here[1][2],
the files with 'works' in its name. fw-<machine> are mtr originated from
the fw, russell is in the UNC network and www.arnet.com.ar is in the
Arnet network. client-<machine> are originated in the 172.16.21.0/24
network.
now, there are a couple of problems with this setup.
today the UNC network went down, so I tried to redirect all traffic
through the Arnet link. what I did was to simply comment out all the
marks for the UNC link and restart shorewall.
for some reason it didn't work. what I was using for testing is a
simple «mtr -c3 -r <machine>». it was trying to go out through the UNC
link. this is, I think, because the default gw in the main routing table
is the router that links us to UNC.
tom sugested to change the first rule to:
# providers
# MARK SOURCE DEST PROTO PORT CLIENT PORTS USER
TEST
0x200:P - -
0x200 $FW -
so packets originating from the FW were also marked. trying those
mtr commands in the FW again didn't work at all, even when taking out
the fallback option in the UNC entry in providers. they did work from
the client. I quickly rolled back to the old setup. what I'm doing wrong
here, and how's it is supposed to be done?
tom also mentioned that both providers should have the balance
option, but I don't understand exactly what the fallback, balance and
loose options do. it works as it worked before, as the mtr show (the
'balance' set). but as you can see clearly balance is not something that
I want in boths links, I just want to clearly route some traffic though
one and the rest through the other.
now, taking out the balance (the 'no_balance' set) from the UNC
provider sends ICMP packets to russell through the Arnet link, not the
UNC as it should be. I will stick to this.
taking out both all the 'balance' and the 'fallback' options work as
spected, without the first suggestion from tom. puttong back both
'balance' but no 'fallback' sends ICMP packets to the Arnet network
through UNC. no fun.
as conclusion, just putting the 'track' option on each provider
worked as spected, even when I commented the lines in tcrules that
marked traffic for UNC, which was what I wanted. I know this is poor
man's BGP or any another routing protocol, but I can't do a more complex
setup.
--
[1] http://iate.oac.uncor.edu/~mdione/shorewall/
[2] you can also find a sw.tbz with all those files.
--
(Not so) Random fortune:
Y en que lugar, habrá consuelo para mi locura,
esta ironía con que se cura, si el final es donde partí.
Y a quién llamar, a quién golpearle la puerta tan tarde,
con quién hablar cuando no hay nadie, si esta noche no puedo dormir.
-- La Renga, "El final es donde partí"
------------------------------------------------------------------------------
Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT
is a gathering of tech-side developers & brand creativity professionals. Meet
the minds behind Google Creative Lab, Visual Complexity, Processing, &
iPhoneDevCamp as they present alongside digital heavyweights like Barbarian
Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
