Hello Aldrovando,
This is a not uncommon problem.
: I have the following situation to handle: a linux box is a firewall
: and router of my internal network (192.168.1.0/24). This firewall is
: connected to the net through two network cards that connect to two
: different gateways. A picture of the situation is the following:
[ snipped netmap ]
Quick summary of configuration:
- private (rfc1918) internal network with services published to the
world
- two public networks
- a single service (in the internal network) which should be reachable
on an IP in each public network
[ snipped some text ]
: The package is then redirected to the server in the intranet by the
: linux box. So how do I make sure ( i am using iproute and iptables)
: that the answer by the server( web) when it reaches the linux box gets
: sent through the same provider the request came from?
The key to the general solution of this problem is to use separate pairs
of IPs for the entire path from the outside world to the internal network.
The internal service (e.g., webserver) must host two IP addresses. One IP
address can be reached via DNAT from public network 1 and the other IP
address can be reached via DNAT from the other network.
See also the following:
http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound
http://lists.netfilter.org/pipermail/netfilter/2001-May/011697.html
http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html#AEN616
And don't forget to turn off reverse path filtering!
(/proc/sys/net/ipv4/conf/all/rp_filter)
Best of luck,
-Martin
--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@xxxxxxxxxxxxxx
_______________________________________________
LARTC mailing list / LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
