Hi there;
I'm planning to implement multipath routing across two ISP in the next few weeks, but
before going further, I have a routing question which is puzzling me :)
Here is the setup:
10.0.0.0/8 172.16.0.0/16
ISP1 ISP2
| |
| |
_|____________|_
[Linux Firewall]
| |
__|_____ |
| |
| __|_____
| |
_____|________|__________
[Internal Public Network]
All machines are linux based. (Firewall is kernel 2.2, public servers are either 2.2 or
2.4)
Linux firewall has 4 networks interfaces, all of them using public IP's; 2 routed through
ISP1, others 2 routed through ISP2.
>From the firewall itself, we can do multipath routing over both ISP's without problems.
In this network topology, we don't use NAT. ALL IPs are publics, and belongs to either
ISP1 or ISP2 network. So that all servers in the Internal Public Network are reachable
from the Internet, through both links.
All servers do have 2 network adapters, using public IPs belonging to ISP1 & ISP2
networks.
On All servers, we setup multipath default route, so that they can use both link as well.
Let's say we have Server A in our internal public network, with 2 network adapters, one
using 10.0.0.1 (routed through ISP1), other using 172.16.0.1 (routed through ISP2)
Assuming that rp_filter is configured correctly on our firewall, what happens when a
client want to reach Server A using 10.0.0.1 ? What path will be used for the replies,
with what source IP ?
I assume that if rp_filter is configured correctly, return path do not matter (since we
don't do NAT), but I'm worried about the SRC IP beeing choosed for the reply. Because, if
the kernel choose the src IP according to the output default route beeing choosed, then
half clients<->servers sessions will just break.
So, basically my question is, what rules decide of the SRC IP to be used in a reply
packet on a system with several default route through different network interfaces ?
Has anyone already experiencing such setup ?
Thanks In advance !
Regards,
Vincent.
---
Vincent Jaussaud
Kelkoo - Security Manager / Networks & Systems Administration
AIM Nick: portsentry
---
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
