> There are no rules that does stateful matching for traffic that is > forwarded between two routers. Such rules are only applied for traffic > that is forwarded to an access LAN (like eth2). Traffic that comes in > from a transit provider and are forwarded directly to another router is > only filtered based on simple source/destination matches in the IP. > > If such rules do not match, and the router is the last hop before a > packet reaches its destination, it will apply stateful matching. But > this happens only for packets to/from access VLANs like eth2 in my > drawing. So in the scenario described, R1 wouldn't do any stateful packet filtering for packets to and from the internal server network? But the connections will be added to the connection tracking table of R1 nonetheless (unless you use the NOTRACK target in raw), only not with an ESTABLISHED state which probably means they timeout more often than needed and you have more insert/remove actions over the connection tracking hash table, maybe that's the source of your problem. You could try the NOTRACK/raw thing on the (internal-)standby-router, or you could route the packets of connections that have incoming data from R1 back out over R1 with a policy routing setup (+connmark) on R2. > I have several transit providers, but since it's not really relevant > for the problem (at least I don't think so) I didn't bother to draw > them. You're right that using some form of VRRP could have been a > possible solution though if I had only one, so I should have mentioned > it. Apologies. OK that makes sense, otherwise this would be high up on my list for "most complicated solution for a simple problem" :-) Thomas
