[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: access to terminal server in DMZ with 2 isp
From:       Vlado_Drz(ík <vlado () ttx ! sk>
Date:       2009-10-23 10:22:31
Message-ID: 4AE183E7.7010300 () ttx ! sk
[Download RAW message or body]

Hi,

It's definitely a routing problem as you see and you have probably
noticed it already..

You are using fwmark to send packets to your spacial tables but it seems
that your local network is missing inside neo and ono tables.

Please verify the by:
ip route show table ono
ip route show table neo

>                # neo
>                IP1="213.172.XXXX"
>                P1_NET="213.172.XXXX/29"
>                P1="213.172.XXXX"
>                IF1="eth1"
> 
>                # ono
>                IP2="84.124.XXXXX"
>                P2_NET="84.124.87.224/29"
>                P2="84.124.XXXX"
>                IF2="eth2"
>                IP0="192.168.0.249"
>                P0_NET="192.168.0.0/24"
>                #P0=
>                IF2="eth0"
                 ^^^^^^^^^^
Seems like typo should be IF0="eth0"

> 
>                ip route add $P2_NET dev $IF2 src $IP2 table ono
>                ip route add default via $P2 table ono
>                ip route add $P1_NET dev $IF1 src $IP1 table neo
>                ip route add default via $P1 table neo
>                ip route add $P1_NET dev $IF1 src $IP1
>                ip route add $P2_NET dev $IF2 src $IP2
>                ip route add default via $P1
>                ip route add $P0_NET     dev $IF0 table neo
>                ip route add $P2_NET     dev $IF2 table neo
>                ip route add 127.0.0.0/8 dev lo   table neo
>                ip route add $P0_NET     dev $IF0 table ono
>                ip route add $P1_NET     dev $IF1 table ono
>                ip route add 127.0.0.0/8 dev lo   table ono
> 
> 
>                ip rule add fwmark 2 table ono
>                ip rule add fwmark 1 table neo
>                ip rule add from $IP2 table ono
>                ip rule add from $IP1 table neo
>                # -----------
> 
> When I try to connect from outside to each of my isps, for example ono,
> I see packets entering eth2 and then
> going out eth2 immediately without being routed to eth0.
> I see dnat has changed the destination ip so packets go out eth2 having
> the source ip from which I'm connecting from (not the ip of the
> 

Everything else seems to be correct to me..


Regarsd,
Vlado
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]