On Wed, 2009-05-27 at 20:09 -0300, Marcos Dione wrote: > NOTE: this mail started as a help call, but I've been wrinting it > through several days, and several tests that lead more to an > investigation that to an actual question. I think it's somewhat usefull, > specially if thewre are comments on why the different cases didn't work > as spected. take in account that I didn't try to fix its redaction. > > I have two ISPs, one reliable but restrictive and one unreliable but > open. I also have a internal network to which I should offer best effort > service. let me explain. > > the reliable network, let's call it UNC, only offers access to > http/s and ssh. the unreliable one. Arnet, lets me access any port, but > the BW is much smaller and often the link goes down. > > so what I want is to route all traffic, including the firewall > generated, through Arnet (even if it's unreliable), except http/s and > ssh, which goes though UNC, including traffic to the UNC network itself. > > my current configuration is: > > # shorewall.conf > [...] > MARK_IN_FORWARD_CHAIN=No > [...] > > > # providers > # NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY > OPTIONS COPY > UNC 1 0x100 main eth0 200.16.29.111 > track,fallback,balance - > Arnet 2 0x200 main eth2 10.0.0.2 > track - > > > # tcrules > # MARK SOURCE DEST PROTO PORT CLIENT PORTS USER > TEST > # everything through the Arnet link > 0x200 - - > > # UNC networks go through the UNC link > 0x100 - 200.16.0.0/16 > 0x100 - 172.16.0.0/16 > > # also http/s and ssh connections generated from the internal network. > # the source does not include the FW itself! yes, I know, se below. > 0x100 172.16.21.0/24 - tcp 80 > 0x100 172.16.21.0/24 - tcp 443 > 0x100 172.16.21.0/24 - tcp 22 > > > this worked mostly fine, except for the cuts in the Arnet link, > which were espected. you can find shorewall info and mtr test here[1][2], > the files with 'works' in its name. fw-<machine> are mtr originated from > the fw, russell is in the UNC network and www.arnet.com.ar is in the > Arnet network. client-<machine> are originated in the 172.16.21.0/24 > network. > > now, there are a couple of problems with this setup. > > today the UNC network went down, so I tried to redirect all traffic > through the Arnet link. what I did was to simply comment out all the > marks for the UNC link and restart shorewall. > > for some reason it didn't work. what I was using for testing is a > simple «mtr -c3 -r <machine>». it was trying to go out through the UNC > link. this is, I think, because the default gw in the main routing table > is the router that links us to UNC. > > tom sugested to change the first rule to: > > # providers > # MARK SOURCE DEST PROTO PORT CLIENT PORTS USER > TEST > 0x200:P - - > 0x200 $FW - > > so packets originating from the FW were also marked. trying those > mtr commands in the FW again didn't work at all, even when taking out > the fallback option in the UNC entry in providers. they did work from > the client. I quickly rolled back to the old setup. what I'm doing wrong > here, and how's it is supposed to be done? > from http://www.shorewall.net/MultiISP.html
Regardless of whether you have masqueraded hosts or not, the following entries are required in /etc/shorewall/masq if you plan to redirect connections from the firewall using entries in /etc/shorewall/tcrules or if you specify balance on your providers. #INTERFACE SUBNET ADDRESS eth0 130.252.99.27 206.124.146.176 eth1 206.124.146.176 130.252.99.27 Those entries ensure that traffic originating on the firewall and redirected via packet marks always has the source IP address corresponding to the interface that it is routed out of. Your missing the SNAT entries for the firewall itself... eth0 10.0.0.2 200.16.29.66 eth2 200.16.29.66 10.0.0.2 > tom also mentioned that both providers should have the balance > option, but I don't understand exactly what the fallback, balance and > loose options do. it works as it worked before, as the mtr show (the > 'balance' set). but as you can see clearly balance is not something that > I want in boths links, I just want to clearly route some traffic though > one and the rest through the other. > > now, taking out the balance (the 'no_balance' set) from the UNC > provider sends ICMP packets to russell through the Arnet link, not the > UNC as it should be. I will stick to this. > > taking out both all the 'balance' and the 'fallback' options work as > spected, without the first suggestion from tom. puttong back both > 'balance' but no 'fallback' sends ICMP packets to the Arnet network > through UNC. no fun. > > as conclusion, just putting the 'track' option on each provider > worked as spected, even when I commented the lines in tcrules that > marked traffic for UNC, which was what I wanted. I know this is poor > man's BGP or any another routing protocol, but I can't do a more complex > setup. > Hope it helps, Jerry ------------------------------------------------------------------------------ Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT is a gathering of tech-side developers & brand creativity professionals. Meet the minds behind Google Creative Lab, Visual Complexity, Processing, & iPhoneDevCamp as they present alongside digital heavyweights like Barbarian Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
