I just wanted to clarify the failover appliance piece. The failover appliance was purchased to allow incoming and outgoing traffic when one of the two isps went down quite a while ago. The host piece was handled by a variety of commercial firewalls which have since failed, leaving us searching for an alternative. The firewall appliance is just nat and only had the ability to deal with one ip per interface, limiting our ability to host multiple servers without changing a lot of ports to non-standard ones. That is why we are putting the Linux box in front of the appliance to provide security and handle multiple ips (phase two after we get the basics down). This way the area between the Linux/firewall and the failover appliance creates a dmz for external servers accessible while the internal clients have the benefit of outgoing failover. Not sure if this is the best way but it seemed to make sense, thoughts? Martin in answer to this below, I guess since the two internal eth2 and eth3 are really a dmz I suppose it wouldn't matter if they know just so long as when a request comes from the outside they know how to route it back out properly even when one isp is down. This appears to be the rub! I assume for the purposes of my answer that you don't want either of these pairs of networks knowing about the others. This is essentially turning your linux box into two separate routers....if this is not what you intend, at least it might get you started. Again thanks to all and look forward to your input. -----Original Message----- From: Martin A. Brown [mailto:mabrown-lartc@securepipe.com] Sent: Tuesday, September 10, 2002 5:50 PM To: Thad Marsh Cc: lartc@mailman.ds9a.nl Subject: RE: 4 nic advanced routing question update Thad, Preface: - - - - - - I'm not certain that I understand your ultimate goal, though I'm sure I do not understand what you mean by a failover appliance.... (I know what such devices do, but I don't see how you are integrating it into this solution, but that's your problem.) : ok i will do it in text: : : 66.92.114.46 eth0 : 209.141.2.194 eth1 : 192.168.119.101 eth2 : 192.168.120.101 eth3 : : What i have is a linux box RH7.3 which will eventually run Shorewall : Firewall. On this box there is eth0 66.92.114.46 conneted to isp1 and : eth1 209.141.2.194 connected to isp2 It also has eth2 192.168.119.101 : and eth3 192.168.120.101 which will connect to a failover appliance : which has 2 wan interface and one lan interface. : : What i need is to have traffic going to eth0 be routed to eth2 and : traffic going to eth1 routed to eth3, and vice versa. This appears to be the rub! I assume for the purposes of my answer that you don't want either of these pairs of networks knowing about the others. This is essentially turning your linux box into two separate routers....if this is not what you intend, at least it might get you started. You'll need to take the following steps: - create routing tables for each of the sets of networks between which you want to pass traffic - modify the RPDB to select traffic based on the interface on which a packet arrives # -- numbers chosen here are arbitrary, but between 1 and 253 # labels are also completely arbitary # echo 4 public-link-0 >> /etc/iproute2/rt_tables # -- table identifiers below are looked up in the above file # (/etc/iproute2/rt_tables) # ip route add table public-link-0 192.168.119.0/24 dev eth2 ip route add table public-link-0 66.92.114.32/28 dev eth0 ip route add table public-link-0 default via 66.92.114.33 dev eth0 # -- numbers here are equally as arbitrary--use alabel # that makes sense to you # echo 5 public-link-1 >> /etc/iproute2/rt_tables ip route add table public-link-1 192.168.120.0/24 dev eth3 ip route add table public-link-1 209.141.2.192/27 dev eth1 ip route add table public-link-1 default via $GW_ON_ETH1 dev eth1 # Notice that this simply sets up the routing tables. # Now you need to use the RPDB to ask for lookups to the routing table you # wish to use. # -- here we'll configure the policy routing to force packets # coming to and from the separate networks through the right interfaces # ip rule add iif eth2 table public-link-0 ip rule add iif eth0 table public-link-0 ip rule add iif eth1 table public-link-1 ip rule add iif eth3 table public-link-1 # -- now flush the routing cache # ip route flush cache Notes: - - - - - - - I can't simulate your setup....this may not work, and may not do what you want - locally generated traffic is a problem I don't deal with - this will only allow packets to and from eth0 <--> eth2 and eth1 <--> eth3 - you'll need to do masquerading with your packet filtering engine if you want any of the rfc1918 networks to reach the internet Oh, yes....by the way, Julian just responded to this. Read his documentation and the iproute2 manual thoroughly and carefully. There is more than enough to get you to where you want to go. If you need an online iproute2 manual there are a few--try this one: http://defiant.coinet.com/iproute2/ip-cref/node1.html Good luck and bon voyage! -Martin : Right now i can ping eth0, eth1, eth2, eth3 on the box. I also can : ping beyond eth0 and eth1. what i can not do is ping beyond eth2 and : eth3. : : I have tried several table statements and played with pref to no avail. : : any insight would be helpful! : : : : -----Original Message----- : From: Jose Luis Domingo Lopez [mailto:lartc@24x7linux.com] : Sent: Tue 9/10/2002 2:39 PM : To: lartc@mailman.ds9a.nl : Cc: : Subject: Re: 4 nic advanced routing question : : On Tuesday, 10 September 2002, at 12:34:10 -0400, : Michael T. Babcock wrote: : : > I'm not sure why you're having a problem: : > His document was encoded properly ... : > : Yes, multipart/alternative, but I think what the reader was trying to : say us that the ASCII version of the email seems to include some kind of : ASCII-art that depicts the sender's network. But at least in my email : client the drawing seems broken and gives no clues about topology. : : -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
