I'm in real trouble here so I hope somebody is able to answer this today (I know, my mistake in planning doesn't mean you will rush. I can try, can't I? ;) Problem as follows: - 1 linux box with 4 interfaces. Internal (private space), DMZ (can be ignored for this issue), 2 uplinks to different providers with different public ranges. - DNAT (actually portforwarding) set up to to a few internal boxes on 1 uplink. - I want to do DNAT to the same internal IP-addressess over the second link (obviously with different public ip-addressess). - Routing chooses the wrong uplink (gateway) for the return packets. Cause: DNAT is only undone at the last moment so even with iproute2's "ip rule" trick I can't discern between connections coming in through one link or the other for the return packets. Solution that I can think of: If connections are DNATted, recall the routing routing after undoing the DNAT for the return packets. Problems with said solution: I can read C code, but only barely, and not write it. Also, I have only a very shallow understanding of the routing code and I'm running out of time. I don't know if the code allows the distinction between DNAT return packets from all other packets so that this can be done at all. Question: I have no idea how complex it would be to create this 'hack'. Does anyone know of a patch that realises this feature or is someone prepared to create such a patch? If not, whom should I ask instead? Desperatly yours, Gaby Schilders IBFD network admin
