RE: RE: Problems with providers

Derek Murawsky
Wed, 27 Jul 2005 17:41:38 -0000

inline

> -----Original Message-----
> From: shorewall-users-admin@lists.sourceforge.net
[mailto:shorewall-users-
> admin@lists.sourceforge.net] On Behalf Of Jerry Vonau
> Sent: Wednesday, July 27, 2005 1:07 PM
> To: shorewall-users@lists.sourceforge.net
> Subject: Re: [Shorewall-users] RE: Problems with providers
>
>
> Derek:
>
> >After going through the debug output I had a brainstorm (more
> >like a trickle) and got the dual providers to work.  It had something
to
> >do with how I had assigned the extra external IP using ip addr in the
> >interfaces (Debian) file.
>
> Can you post the commands you were using?
Unfortunately no, I was in a bit of a caffeine induced frenzy trying to
get the system up again.  All I recall was that I had a stanza in
/etc/network/interfaces to set up an interface with 63.211.45.132 and in
the up section I had "ip addr 63.211.45.134/28 brd [broadcast] dev eth2
in the Debian interfaces file.  That worked fine initially, however, I
had to remove that to get dual providers to work.  After trying it and
noticing that it failed, I restored the old configs and it stopped
working.  I did flush the routing table and restarted a few times as
well.

>
> >However after getting that working, the DNATs
> >that I had set up no longer functioned.  Well, I ended up toasting
> >something obscure and had to reinstall the box.
> >I had two DNAT rules set up that were virtually identical, one
> >of which worked (port 25 to an exchange box), the other didn''t
(1494
to
> >citrix server).  Despite my best efforts at debugging, I
couldn''t
figure
> >out what happened and even copying in the old known-good configs
didn''t
> >repair it.  Any idea what could have caused this?  I had been messing
> >around with "ip addr" to add extra IPs to external interfaces
for the
> >forwarding.
>
> From your earlier trace, looks like you''re adding network routes
for
the
> aliases
> also, there should be only one network route and it should be with the
> primary ip
> address of that interface.
I didn''t think I had added any extra routes, just an ip addr.

> >Anyway, I''m going to rework this from the ground up.
> >-Derek
>
> Why not just let shorewall create the aliases for you?
I was under the impression from
http://www.shorewall.net/Shorewall_and_Aliased_Interfaces.html#id2452731
That I needed to do this through either shorewall''s start script or
through my own startup scripts.  How do you recommend I proceed?

> Jerry
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast.
http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

Thanks again,
-Derek


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click