Re: Multi-ISP in 2.4.0

Jerry Vonau
2005-06-06T11:27:08Z

----- Original Message -----
From: "Manuel Goepfert" <manuel@escapade.ch>
To: <shorewall-users@lists.shorewall.net>
Sent: Monday, June 06, 2005 01:53
Subject: [Shorewall-users] Multi-ISP in 2.4.0


> Hello Shorewall list,
>
> I''m a happy Shorewall user since a few years now and everything
works fine
> for me except one thing that I try to implement since a week, the
multi-isp.
>
> I''ve downloaded the 2.4.0 Stable release yesterday and tried the
RC2
since a
> week.
>
> My config is a Debian running a kernel 2.4.27 home made with the
> CONNMARK.diff patch applied
>
> I''m using 2 ISP, one is Nerim with a fixed IP and the other is
neuf
telecom
> with a dynamic IP.
> I use NAT on both lines. The interfaces are:
> ETH0=PPP0 ISP nerim
> ETH1=PPP1 ISP neuf telecom
> ETH2=LAN
> ETH3=DMZ
> ETH4=Wifi.
>
> The features available in the kernel are:
>
>    NAT: Available
>    Packet Mangling: Available
>    Multi-port Match: Available
>    Extended Multi-port Match: Not available
>    Connection Tracking Match: Available
>    Packet Type Match: Available
>    Policy Match: Not available
>    Physdev Match: Not available
>    IP range Match: Not available
>    Recent Match: Available
>    Owner Match: Available
>    Ipset Match: Not available
>    ROUTE Target: Not available
>    Extended MARK Target: Not available
>    CONNMARK Target: Available
>    Connmark Match: Available
>
>
> My providers file is:
>
> nerim   200     200     main            ppp0            detect
> track,balance=2
> n9uf    201     201     main            ppp1            detect
> track,balance=1
>
> My masq file is:
>
> ppp0                    eth2            -
> ppp1                    eth2            -
> ppp0                    eth3            -
> ppp1                    eth3            -
> ppp0                    eth4            -
> ppp1                    eth4            -
>
> Here a copy of the route and ip route:
>
> emeraude:/etc/shorewall# route
> Table de routage IP du noyau
> Destination     Passerelle      Genmask         Indic Metric Ref
Use
> Iface
> lo1-lns101-tip- *               255.255.255.255 UH    0      0
0 ppp0
> 1.240.101-84.re *               255.255.255.255 UH    0      0
0 ppp1
> 192.168.2.0     *               255.255.255.0   U     0      0
0 eth1
> 192.168.18.0    *               255.255.255.0   U     0      0
0 eth4
> localnet        *               255.255.255.0   U     0      0
0 eth0
> 192.168.17.0    *               255.255.255.0   U     0      0
0 eth3
> 192.168.16.0    *               255.255.255.0   U     0      0
0 eth2
> default         lo1-lns101-tip- 0.0.0.0         UG    0      0
0 ppp0
>
> emeraude:/etc/shorewall# ip route
> 62.4.16.246 dev ppp0  proto kernel  scope link  src 80.65.224.153
> 84.101.240.1 dev ppp1  proto kernel  scope link  src 84.101.240.204
> 192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
> 192.168.18.0/24 dev eth4  proto kernel  scope link  src 192.168.18.1
> 192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
> 192.168.17.0/24 dev eth3  proto kernel  scope link  src 192.168.17.1
> 192.168.16.0/24 dev eth2  proto kernel  scope link  src 192.168.16.1
> default
>         nexthop via 62.4.16.246  dev ppp0 weight 2
>         nexthop via 84.101.240.1  dev ppp1 weight 1
>
>
> I try to achieve the following:
>
> Incoming connections based on the port used should be forwarded to
the
> correct machine in the DMZ.
> For example a connection to port 25 should go to the mail server
like this
> in my rule file:
> DNAT    net             dmz:192.168.17.4        tcp     25      -
>
> This should work for both ISP.
>
> If I have the following default route:
> Destination     Passerelle      Genmask         Indic Metric Ref
Use
> Iface
> lo1-lns101-tip- *               255.255.255.255 UH    0      0
0 ppp0
> 1.240.101-84.re *               255.255.255.255 UH    0      0
0 ppp1
> 192.168.2.0     *               255.255.255.0   U     0      0
0 eth1
> 192.168.18.0    *               255.255.255.0   U     0      0
0 eth4
> localnet        *               255.255.255.0   U     0      0
0 eth0
> 192.168.17.0    *               255.255.255.0   U     0      0
0 eth3
> 192.168.16.0    *               255.255.255.0   U     0      0
0 eth2
> default         lo1-lns101-tip- 0.0.0.0         UG    0      0
0 ppp0
>
> emeraude:/etc/shorewall# ip route
> 62.4.16.246 dev ppp0  proto kernel  scope link  src 80.65.224.153
> 84.101.240.1 dev ppp1  proto kernel  scope link  src 84.101.240.204
> 192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
> 192.168.18.0/24 dev eth4  proto kernel  scope link  src 192.168.18.1
> 192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
> 192.168.17.0/24 dev eth3  proto kernel  scope link  src 192.168.17.1
> 192.168.16.0/24 dev eth2  proto kernel  scope link  src 192.168.16.1
> default
>         nexthop via 62.4.16.246  dev ppp0 weight 2
>         nexthop via 84.101.240.1  dev ppp1 weight 1
>
> The 2 incoming connections are working fine allowing the smtp
connections,
> but I''m not able to surf the web from the LAN interface nor the
DMZ
or Wifi.
>
> I get also a message on the console "MASQUERADE: Route sent us
somewhere
> else."
>

I think that has something to do with using masq instead of snat,
having said that,
I''d try to use the snat switch in the masq file:
ppp0                    eth2            $ipisp1
ppp1                    eth2            $ipisp2
repeat as required

You say you have a one fixed and one dynamic ip address,
this is a problem, you''ll need to use the params file to define
the above variables. Sorry I have cable, anybody have a script
that can grab the external ip of a ppp interface, I''m drawing a
blank here. (must go for coffee)

Just wondering, what does ''ip rule show'' give you?
There maybe some we can do there.


> A copy of the shorewall status is available here:
> http://goodies.escapade.ch/shore-stat.txt
>
> And a copy of the shorewall.conf is available here:
> http://goodies.escapade.ch/shorewall.com
>
>
> Thanks for reading so far. If I didn''t provide enough information
I
would be
> more than happy to share more, just let me know what is needed.
>
> Best regards.
>
> Manuel.

Jerry Vonau