RE: RE: Problems with providers

Derek Murawsky
Thu, 28 Jul 2005 19:43:02 -0000

> -----Original Message-----
> From: shorewall-users-admin@lists.sourceforge.net
[mailto:shorewall-users-
> admin@lists.sourceforge.net] On Behalf Of Jerry Vonau
> Sent: Wednesday, July 27, 2005 2:52 PM
> To: Jerry Vonau; shorewall-users@lists.sourceforge.net
> Subject: Re: [Shorewall-users] RE: Problems with providers
>
>
> > >> Derek:
> > <snip>
> > >> Can you post the commands you were using?
> > >Unfortunately no, I was in a bit of a caffeine induced frenzy
trying to
> > >get the system up again.  All I recall was that I had a stanza in
> > >/etc/network/interfaces to set up an interface with 63.211.45.132
and
> in
> > >the up section I had "ip addr 63.211.45.134/28 brd
[broadcast] dev
eth2
> > >in the Debian interfaces file.  That worked fine initially,
however, I
> > >had to remove that to get dual providers to work.  After trying it
and
> > >noticing that it failed, I restored the old configs and it stopped
> > >working.  I did flush the routing table and restarted a few times
as
> > >well.
> >
> > I believe that should be just 63.211.45.134  dev eth2
>
> my error, it should work as you had it...
>
> > <snip>
> > >> From your earlier trace, looks like you''re adding
network routes
for
> > >the
> > >> aliases
> > >> also, there should be only one network route and it should be
with
> the
> > >> primary ip
> > >> address of that interface.
> > >I didn''t think I had added any extra routes, just an ip
addr.
> >
> > You don''t, but when you did the "ip addr
63.211.45.134/28
> > brd [broadcast] dev eth2", the /28 added/changed the route,
> > and it most likely changed the src in the routing table to .134
> > and not .132 which is the primary ip address. Need to see the
> > routing tables to tell.
> >
> Ok it''s getting clearer, eth1 and eth3 are your providers, eth5 is
the
> local zone. what are eth2 and eth4, dmz interfaces?
Eth2 is just another interface that has some additional IPs from one of
our providers.  This is where the DNAT entries forward from.  I suppose
the logic behind it was not to bog down one interface with too much
physical traffic.  I take it that these should be on the regular
provider interface to avoid problems down the line?

>
> Your error is:
> ++ ip route add table 2 63.211.45.128/28 dev eth3 proto kernel scope
> link src 63.211.45.130
>
> ++ ip route add table 2 63.211.45.128/28 dev eth2 proto kernel scope
> link src 63.211.45.132
>
> Your adding 2 nework routes to the same provider''s table, one from
> eth2(provider) and one from the eth3(dmz?).
>
> The way to do this is not have a network route on the providers
interface
> at all,
> to begin with, use a /32 instead of /28 on the providers interface
only,
> and add
> a host route on the provider''s interface to the gateway.
>
Ok, I''ll check this out.

> Where does eth4 fit into all this?
>
Eth4 is a second interface that is the DMZ interface for a class C that
we have through one of our providers.  We''re in the process of getting
an ASN number to route between the providers, but that comes
later.
> Jerry
>
>
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September
> 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
> Agile & Plan-Driven Development * Managing Projects & Teams *
Testing
& QA
> Security * Process Improvement & Measurement *
http://www.sqe.com/bsce5sf
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/shorewall-users

Again, thanks
-Derek


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO September
19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing
& QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf