Marcos Dione wrote: > > my current configuration is:
Although I'm not going to try to solve your issues, I'll offer some comments on your configuration. > > # shorewall.conf > [...] > MARK_IN_FORWARD_CHAIN=No > [...] > > > # providers > # NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY > OPTIONS COPY > UNC 1 0x100 main eth0 200.16.29.111 > track,fallback,balance - > Arnet 2 0x200 main eth2 10.0.0.2 > track - The COPY column should not be empty -- it should contain a list of your interfaces other than eth0 and eth2. Depending on what version of Shorewall you are running (you failed to mention that -- it's the FIRST thing that we look at in the output of 'shorewall dump'), there are problems with COPY and you may need to include the interface named in the INTERFACE column in that list. > > > # tcrules > # MARK SOURCE DEST PROTO PORT CLIENT PORTS USER > TEST > # everything through the Arnet link > 0x200 - - > > # UNC networks go through the UNC link > 0x100 - 200.16.0.0/16 > 0x100 - 172.16.0.0/16 > > # also http/s and ssh connections generated from the internal network. > # the source does not include the FW itself! yes, I know, se below. > 0x100 172.16.21.0/24 - tcp 80 > 0x100 172.16.21.0/24 - tcp 443 > 0x100 172.16.21.0/24 - tcp 22 > > > this worked mostly fine, except for the cuts in the Arnet link, > which were espected. you can find shorewall info and mtr test here[1][2], > the files with 'works' in its name. fw-<machine> are mtr originated from > the fw, russell is in the UNC network and www.arnet.com.ar is in the > Arnet network. client-<machine> are originated in the 172.16.21.0/24 > network. > > now, there are a couple of problems with this setup. > > today the UNC network went down, so I tried to redirect all traffic > through the Arnet link. what I did was to simply comment out all the > marks for the UNC link and restart shorewall. > > for some reason it didn't work. what I was using for testing is a > simple «mtr -c3 -r <machine>». it was trying to go out through the UNC > link. this is, I think, because the default gw in the main routing table > is the router that links us to UNC. > > tom sugested to change the first rule to: > > # providers > # MARK SOURCE DEST PROTO PORT CLIENT PORTS USER > TEST > 0x200:P - - > 0x200 $FW - > > so packets originating from the FW were also marked. trying those > mtr commands in the FW again didn't work at all, even when taking out > the fallback option in the UNC entry in providers. they did work from > the client. I quickly rolled back to the old setup. what I'm doing wrong > here, and how's it is supposed to be done? I personally set 'optional' in /etc/shorewall/interfaces and simply restart Shorewall when an interface goes down. But then, you have complete access to my configuration. It's the 'Complete Example' on the Shorewall Multi-ISP page. And you will note that I don't set 'balance' on both interfaces. > > tom also mentioned that both providers should have the balance > option, but I don't understand exactly what the fallback, balance and > loose options do. The Shorewall Multi-ISP page explains them -- if you have explicit questions, I'm happy to answer them. > it works as it worked before, as the mtr show (the > 'balance' set). but as you can see clearly balance is not something that > I want in boths links, I just want to clearly route some traffic though > one and the rest through the other. > Sigh -- the FAQ talks about that. But I guess no one believes those FAQ entries... > now, taking out the balance (the 'no_balance' set) from the UNC > provider sends ICMP packets to russell through the Arnet link, not the > UNC as it should be. I will stick to this. > Sorry -- I don't understand that. But it sounds like you are missing the critical entries in /etc/shorewall/masq described on the Multi-ISP page. But you didn't include that file at all in your post. See why we want the output of 'shorewall dump'? I see that Jerry Vonau just posted with that suggestion also. > taking out both all the 'balance' and the 'fallback' options work as > spected, without the first suggestion from tom. puttong back both > 'balance' but no 'fallback' sends ICMP packets to the Arnet network > through UNC. no fun. > Again -- we have no idea what that means. But it sounds like the missing masq entries again. > as conclusion, just putting the 'track' option on each provider > worked as spected, even when I commented the lines in tcrules that > marked traffic for UNC, which was what I wanted. I know this is poor > man's BGP or any another routing protocol, but I can't do a more complex > setup. > -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Register Now for Creativity and Technology (CaT), June 3rd, NYC. CaT is a gathering of tech-side developers & brand creativity professionals. Meet the minds behind Google Creative Lab, Visual Complexity, Processing, & iPhoneDevCamp as they present alongside digital heavyweights like Barbarian Group, R/GA, & Big Spaceship. http://p.sf.net/sfu/creativitycat-com
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
