Multi-ISP in 2.4.0

Manuel Goepfert
2005-06-06T06:53:54Z

Hello Shorewall list,

I''m a happy Shorewall user since a few years now and everything works
fine
for me except one thing that I try to implement since a week, the multi-isp.

I''ve downloaded the 2.4.0 Stable release yesterday and tried the RC2
since a
week.

My config is a Debian running a kernel 2.4.27 home made with the
CONNMARK.diff patch applied

I''m using 2 ISP, one is Nerim with a fixed IP and the other is neuf
telecom
with a dynamic IP.
I use NAT on both lines. The interfaces are:
ETH0=PPP0 ISP nerim
ETH1=PPP1 ISP neuf telecom
ETH2=LAN
ETH3=DMZ
ETH4=Wifi.

The features available in the kernel are:

   NAT: Available
   Packet Mangling: Available
   Multi-port Match: Available
   Extended Multi-port Match: Not available
   Connection Tracking Match: Available
   Packet Type Match: Available
   Policy Match: Not available
   Physdev Match: Not available
   IP range Match: Not available
   Recent Match: Available
   Owner Match: Available
   Ipset Match: Not available
   ROUTE Target: Not available
   Extended MARK Target: Not available
   CONNMARK Target: Available
   Connmark Match: Available


My providers file is:

nerim   200     200     main            ppp0            detect
track,balance=2
n9uf    201     201     main            ppp1            detect
track,balance=1

My masq file is:

ppp0                    eth2            -
ppp1                    eth2            -
ppp0                    eth3            -
ppp1                    eth3            -
ppp0                    eth4            -
ppp1                    eth4            -

Here a copy of the route and ip route:

emeraude:/etc/shorewall# route
Table de routage IP du noyau
Destination     Passerelle      Genmask         Indic Metric Ref    Use
Iface
lo1-lns101-tip- *               255.255.255.255 UH    0      0        0 ppp0
1.240.101-84.re *               255.255.255.255 UH    0      0        0 ppp1
192.168.2.0     *               255.255.255.0   U     0      0        0 eth1
192.168.18.0    *               255.255.255.0   U     0      0        0 eth4
localnet        *               255.255.255.0   U     0      0        0 eth0
192.168.17.0    *               255.255.255.0   U     0      0        0 eth3
192.168.16.0    *               255.255.255.0   U     0      0        0 eth2
default         lo1-lns101-tip- 0.0.0.0         UG    0      0        0 ppp0

emeraude:/etc/shorewall# ip route
62.4.16.246 dev ppp0  proto kernel  scope link  src 80.65.224.153
84.101.240.1 dev ppp1  proto kernel  scope link  src 84.101.240.204
192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
192.168.18.0/24 dev eth4  proto kernel  scope link  src 192.168.18.1
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
192.168.17.0/24 dev eth3  proto kernel  scope link  src 192.168.17.1
192.168.16.0/24 dev eth2  proto kernel  scope link  src 192.168.16.1
default
        nexthop via 62.4.16.246  dev ppp0 weight 2
        nexthop via 84.101.240.1  dev ppp1 weight 1


I try to achieve the following:

Incoming connections based on the port used should be forwarded to the
correct machine in the DMZ.
For example a connection to port 25 should go to the mail server like this
in my rule file:
DNAT    net             dmz:192.168.17.4        tcp     25      -

This should work for both ISP.

If I have the following default route:
Destination     Passerelle      Genmask         Indic Metric Ref    Use
Iface
lo1-lns101-tip- *               255.255.255.255 UH    0      0        0 ppp0
1.240.101-84.re *               255.255.255.255 UH    0      0        0 ppp1
192.168.2.0     *               255.255.255.0   U     0      0        0 eth1
192.168.18.0    *               255.255.255.0   U     0      0        0 eth4
localnet        *               255.255.255.0   U     0      0        0 eth0
192.168.17.0    *               255.255.255.0   U     0      0        0 eth3
192.168.16.0    *               255.255.255.0   U     0      0        0 eth2
default         lo1-lns101-tip- 0.0.0.0         UG    0      0        0 ppp0

emeraude:/etc/shorewall# ip route
62.4.16.246 dev ppp0  proto kernel  scope link  src 80.65.224.153
84.101.240.1 dev ppp1  proto kernel  scope link  src 84.101.240.204
192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
192.168.18.0/24 dev eth4  proto kernel  scope link  src 192.168.18.1
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
192.168.17.0/24 dev eth3  proto kernel  scope link  src 192.168.17.1
192.168.16.0/24 dev eth2  proto kernel  scope link  src 192.168.16.1
default
        nexthop via 62.4.16.246  dev ppp0 weight 2
        nexthop via 84.101.240.1  dev ppp1 weight 1

The 2 incoming connections are working fine allowing the smtp connections,
but I''m not able to surf the web from the LAN interface nor the DMZ or
Wifi.

I get also a message on the console "MASQUERADE: Route sent us somewhere
else."

A copy of the shorewall status is available here:
http://goodies.escapade.ch/shore-stat.txt

And a copy of the shorewall.conf is available here:
http://goodies.escapade.ch/shorewall.com


Thanks for reading so far. If I didn''t provide enough information I
would be
more than happy to share more, just let me know what is needed.

Best regards.

Manuel.