On Wed, 2003-10-15 at 10:23, Gaby Schilders wrote: > I'm in real trouble here so I hope somebody is able to answer this today (I know, my mistake in planning doesn't mean you will rush. I can try, can't I? ;) > > Problem as follows: > > - 1 linux box with 4 interfaces. Internal (private space), DMZ (can be ignored for this issue), 2 uplinks to different providers with different public ranges. > - DNAT (actually portforwarding) set up to to a few internal boxes on 1 uplink. > - I want to do DNAT to the same internal IP-addressess over the second link (obviously with different public ip-addressess). > - Routing chooses the wrong uplink (gateway) for the return packets. > > Cause: > DNAT is only undone at the last moment so even with iproute2's "ip rule" trick I can't discern between connections coming in through one link or the other for the return packets. > > Solution that I can think of: > If connections are DNATted, recall the routing routing after undoing the DNAT for the return packets. Problems with said solution: I can read C code, but only barely, and not write it. Also, I have only a very shallow understanding of the routing code and I'm running out of time. I don't know if the code allows the distinction between DNAT return packets from all other packets so that this can be done at all. > > Question: > I have no idea how complex it would be to create this 'hack'. Does anyone know of a patch that realises this feature or is someone prepared to create such a patch? If not, whom should I ask instead? > You could try the P-O-M ROUTE target patch. > Desperatly yours, > > Gaby Schilders > IBFD network admin -- -- Raymond Leach <raymondl@xxxxxxxxxxxxxxxxxxxxxx> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Attachment:
signature.asc
Description: This is a digitally signed message part
