Hello, On Sat, 16 Nov 2002, Vincent Jaussaud wrote: > On All servers, we setup multipath default route, so that they can use both link as well. That means they know which link is alive or it does not matter? :) > Let's say we have Server A in our internal public network, with 2 network adapters, one > using 10.0.0.1 (routed through ISP1), other using 172.16.0.1 (routed through ISP2) > > Assuming that rp_filter is configured correctly on our firewall, what happens when a > client want to reach Server A using 10.0.0.1 ? What path will be used for the replies, > with what source IP ? The server uses the 10.0.0.1 as source when resolving route for the reply. Then it depends on the routing rules. > I assume that if rp_filter is configured correctly, return path do not matter (since we > don't do NAT), but I'm worried about the SRC IP beeing choosed for the reply. Because, if > the kernel choose the src IP according to the output default route beeing choosed, then > half clients<->servers sessions will just break. I'm sure you need correct routes on firewall and all internal hosts, for example: ip rule add prio ... from pubnet_X to 0/0 table table_for_ISP_X ip rule add prio ... from pubnet_Y to 0/0 table table_for_ISP_Y ip rule add prio ... from 0/0 to 0/0 table your_multipath_route Of course, the internal hosts use the proper firewall IP as gateway. That is all, traffic from specific pub IP should use only its gateway. You can expect rp_filter drops in firewall if the internal servers select wrong NIC by using multipath route for all route resolutions. The multipath route should be used only for source address autoselection: - originating connections without bind() - selecting masquerade address (for NAT) - etc I.e. it is a bad idea to use only multipath route. Internal servers creating outgoing connections after using bind() to specific pubip should not reach the multipath route. > So, basically my question is, what rules decide of the SRC IP to be used in a reply > packet on a system with several default route through different network interfaces ? The transport and the application decide what source IP to put in the reply. Then they decide how to call the routing. The right thing to do when addresses to both ends are known is to feed the routing with saddr and daddr. If callers use 0.0.0.0 as saddr when resolving routes, they will hit the multipath route which is bad. > Has anyone already experiencing such setup ? Not exactly, but everything is in the details :) > Vincent. Regards -- Julian Anastasov <ja@ssi.bg> _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
