Ian, : It doesn't work as given for connections that are port forwarded from : the Linux router to machines inside the local network (e.g. to a web : server). True, the multiple uplinks is for exactly that, uplinks! Or, in other words, outbound connectivity, only. : With port forwarding in the mix, packets arriving from the Internet to : a particular port on the Linux router have DNAT applied so that they : pass transparently on to the internal web server; but, the answer : packets from the web server arrive back at the Linux router and do not : necessarily go out by the same gateway/provider by which they came in. Also true. The conventional solution is to have an end-to-end unique path, and perform DNAT (or NAT) based on each public/private pair. [0] Although, you might consider using connection tracking to do the heavy lifting for you. [1] : I suspect the fix is somehow to mark the port forwarded packets with a : flag indicating on which interface they arrived at the Linux router, : and then preserve this flag into the answer packets on the web server. : On the Linux router I can then make sure that appropriately flagged : answer packets go out the correct interface. Yes, you can mark the packets....the trick is to take advantage of the DNAT connection tracking entry in the PREROUTING table as the packet enters the firewall from the internal network. This allows you to mark the packet before routing based on the original (public) destination IP address. Observe the use of "--ctorigdst" in this iptables command. -Martin [0] http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound [1] http://mailman.ds9a.nl/pipermail/lartc/2003q2/008090.html -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@xxxxxxxxxxxxxx _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
