LARTC - Mar 2004 - email/ftp over one connection, all else over second connection

Hi all,

Just wondering what the easiest way to do the following is:

We have two connections (routed ADSL) - a 512k/512k symmetrical and a
1.5M/256k asymmetrical, what I would like is for all email and FTP traffic
to use the symmetrical link, and all other internet traffic to use the
asymmetrical link. The symmetrical link is already set as the primary MX, so
source routing problems aside - how can this be done?

Using IPTables ROUTE target? using IPRoute2 (ideally)?

The reasons for doing it this way is this company needs a reliable email and
ftp channel, but they also do a lot of "surfing" so I would like the
isolate
the two distinct traffic types in order to optimise traffic flow.

All help is welcome.

-Bryan

Bryan Nolen
Lead Developer, Arc.Net.Au
Ph: 03 9499 2929
Fax: 03 9854 5436
Mobile: 0402 022 292
Email: bryan@arcnet.com.au or reveng@arc.net.au 
http://Arc.Net.AU
http://cdonline.com.au

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Just thought of a problem doing that - the email server is on the
gateway/firewall box itself....

Can SNAT still be used in this case?

I.e.:
iptables -t nat -A POSTROUTING -o $extIF --sport 25 -d 0/0 -j SNAT --to
$PriIP
iptables -t nat -A POSTROUTING -o $extIF --dport 25 -d 0/0 -j SNAT --to
$PriIP

> -----Original Message-----
> From: xerox@foonet.net [mailto:xerox@foonet.net] 
> Sent: Monday, 8 March 2004 3:21 PM
> To: Bryan Nolen
> Subject: Re: [LARTC] email/ftp over one connection, all else 
> over second connection
> 
> 
> If the box is doing NAT, which I assume it is, all you have 
> to do is SNAT 
> and for certain ports like web and such make it use the 
> source ip of the 
> asym link and so on.. should be real simple in that config :>
> 
> 
>  On Mon, 8 Mar 2004, Bryan Nolen wrote:
> 
> > Hi all,
> > 
> > Just wondering what the easiest way to do the following is:
> > 
> > We have two connections (routed ADSL) - a 512k/512k 
> symmetrical and a
> > 1.5M/256k asymmetrical, what I would like is for all email 
> and FTP traffic
> > to use the symmetrical link, and all other internet traffic 
> to use the
> > asymmetrical link. The symmetrical link is already set as 
> the primary MX, so
> > source routing problems aside - how can this be done?
> > 
> > Using IPTables ROUTE target? using IPRoute2 (ideally)?
> > 
> > The reasons for doing it this way is this company needs a 
> reliable email and
> > ftp channel, but they also do a lot of "surfing" so I would 
> like the isolate
> > the two distinct traffic types in order to optimise traffic flow.
> > 
> > All help is welcome.
> > 
> > -Bryan
> > 
> > Bryan Nolen
> > Lead Developer, Arc.Net.Au
> > Ph: 03 9499 2929
> > Fax: 03 9854 5436
> > Mobile: 0402 022 292
> > Email: bryan@arcnet.com.au or reveng@arc.net.au 
> > http://Arc.Net.AU
> > http://cdonline.com.au
> > 
> > _______________________________________________
> > LARTC mailing list / LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: 
http://lartc.org/
> 
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

This is quite easy to do with IPTables ROUTE,
I suppose you are using nat anyway
you will need to nat to source at first ( at prerouting)
then ROUTE to approriate gw

basicaly there is no much diference how do you route packets
you can just ignore routing at all, and direct everything to default
gateway,
but receive from anywhere. all you need is to to nat to approriate source at
first
example:

iptables -t nat -A POSTROUTING --dport 110 -j SNAT --to-source 81.x.x.x
iptables -t nat-A POSTROUTING ! -d 192.168.0.0/255.255.0.0 -j
SNAT --to-source 62.x.x.x

this will direct all port 110 trafic to to be received on 81.x.x.x
and everything else on 62.x.x.x

if you want all port 110 trafic to GO TO 81.x.x.x  then use route target

iptables -t mangle -A POSTROUTING --dport 110 -j ROUTE --gw
81.x.x.x --continue
everything else goes to default gw

usualy it is best to se both rules, but they can be used independently you
dont need packets to go through the same gateway in both directions.

any other very advanced configuartins are possible,
I am using similar setup to direct web trafic to one dsl and other trafic to
another
iptables condition module helps to switch links if one is detected dead.


seems iproute is not needed anymore ;-)
iptables does routing much better.(but proabbly slower)


----- Original Message ----- 
From: "Bryan Nolen" <reveng@arc.net.au>
To: <lartc@mailman.ds9a.nl>
Sent: Monday, March 08, 2004 6:11 AM
Subject: [LARTC] email/ftp over one connection, all else over second
connection


Hi all,

Just wondering what the easiest way to do the following is:

We have two connections (routed ADSL) - a 512k/512k symmetrical and a
1.5M/256k asymmetrical, what I would like is for all email and FTP traffic
to use the symmetrical link, and all other internet traffic to use the
asymmetrical link. The symmetrical link is already set as the primary MX, so
source routing problems aside - how can this be done?

Using IPTables ROUTE target? using IPRoute2 (ideally)?

The reasons for doing it this way is this company needs a reliable email and
ftp channel, but they also do a lot of
''"''surfing''"'' so I would like the
isolate
the two distinct traffic types in order to optimise traffic flow.

All help is welcome.

-Bryan

Bryan Nolen
Lead Developer, Arc.Net.Au
Ph: 03 9499 2929
Fax: 03 9854 5436
Mobile: 0402 022 292
Email: bryan@arcnet.com.au or reveng@arc.net.au
http://Arc.Net.AU
http://cdonline.com.au

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/