On September 23, 2004 05:33 am, Primero wrote: > Alistair Tonner wrote: > > I'm wondering if > > there are rules I can use (consider that the webserver/mailserver and FTP > > server are sadly on the firewall at the moment) to force the servers to > > reply via the DSL or internal lan only, even if the default route points > > at the cable link? (this would be a quick and dirty solution for me) -- > > the cablelink will have to shortly support a VPN tunnel back to work. > > i was using Iproute2 like u until a day i decided to "man iptables" .... > > i've found in EXTENSIONS TARGET section: > > .... > ROUTE > > --continue > Behave like a non-terminating target and continue > traversing the rules. Not valid in combination with `--iif' > .... > > this way u can use a normal matching syntax of iptables and change the > routing decision about the "interesting traffic". > I hope it works since i had no time yet to try it out ... let us know :) > *thwacks* self in head -- yes .. I've noted this in the past myself.. .but it had just wandered off into space ... thanks ... I've just recompiled the kernel ... the reason it wandered was that ROUTE is NOT in most default kernel configs, its in patch-o-matic. I'm running gentoo which does NOT have any consistent method of pulling in patch-o-matic. POM on gentoo takes some more work than normal, but I've got patched in and up and runnng. Further question to the list. Consider that I'm using iproute2 to share the connection to two different ISP's, and I want specific traffic from my internal network to only go out one interface. Where in mangle would I put these rules? For the moment I'm trying this by putting them in PREROUTING since I'd want the oif to OVERRIDE routing decisions -- I have my SNAT rules in place based on output interface, but perhaps my logic is wrong ... Has anyone done this yet or am I headed for experimental territory?? *grins* Alistair Tonner Rogers Shared Operations, Senior Operational Analyst, (soon to be junior HP/UX os support)
