Try to SNAT the incoming conection too, then your server see only the 200.x.x.x IP for the incoming calls. You have DNAT for redirections, add a postrouting SNAT. I supose that you are DNATing in PREROUTING and you will add a rule (only for example) for SNAT the incoming calls from 200.x.x.x router: iptables -t nat -A POSTROUTING -d <internal server ip> -j MASQUERADE Perhaps you'll need to put before that rule some rules to allow internal traffic to that server without SNAT. Other solution is to configure the routing fules/tables/filters in your routers to more specific fules/filters. Perhaps LARTC is better list than this to allow you to find a good answer about your routing problem. Regards P.D.: My english isn't perfect, sorry. El Mar, 12 de Diciembre de 2006, 11:29, Matt escribió: > > > Related problem to the earlier one, I'm afraid. Current network layout: > > > Internet > | > ----100.100.251.217---- > / (router) \ Internet > | | | > 100.100.251.220 100.100.251.218 200.200.64.139 > | | | > 192.168.100.x \ / > (Office Network) \ / > Linux Multihomed Router > 192.168.0.254 > | > | > 192.168.0.6 > Internal Server > > > I got the above working on our test bed, where users can get to the > internal server 192.168.0.6 via either Internet connection. The problem is > getting from our Office Network to 200.200.64.139:56100 > > What appears to be happening is this: > > 1. Packet is sent from internal router, arrives at 100.100.251.220, is > routed through 100.100.251.217 to the Internet. > 2. Packet arrives at 200.200.64.139, DNAT'd to 192.168.0.6. > 3. Internal Server replies, sends it to it's default gateway > (192.168.0.254) > 4. Linux server sees 100.100.251.220 as destination, sends to > 100.100.251.218 instead of back out of 200.200.64.139. (This is not > expected as I'm marking incoming connections at the linux router using > CONNMARK/MARK, and connections go in and out of the correct interface when > the destination is outside the 100.100.251.216/29 network) > > (Note: I don't know if the returning connections are SNAT'd back to > 200.200.64.139) > > So... > > Is there a way around this? i.e. so that the multihoming still works? > > It seems that normal routing to the 100.100.251.216/29 network takes > precedence over my connection marked rule, that would instruct the packet > to be sent out over the correct interface (and maybe therefore SNAT'd > correctly too). > > Not sure what's going on. Can anyone point me in the correct direction? > > Thanks, > > Matt > >
