Re: 2 ISP problem 1

Tom Eastep
Mon, 26 Dec 2005 19:03:35 -0000

On Monday 26 December 2005 11:28, Charrua wrote:
> Thanks Tom,
>
> >a) I think that you will have continuous problems with the way that you
> >have configured your local network (public /27 and many private
>networks
> >on the same LAN). You can already see hints of the problems in this log
> >message:
> >
> >Dec 23 07:25:40 FORWARD:REJECT: IN=eth2 OUT=eth2 SRC=200.58.129.2
> >DST=192.168.107.2 LEN=84 TOS=00 PREC=0x00 TTL=62 ID=0 DF >PROTO=ICMP
> > TYPE=8 CODE=0 ID=62326 SEQ=0
> >
> >Check Shorewall FAQ 17 to understand what this message means.
>
> I don´t understand, I need "routeback" option in eth2?

Yes.

>
> >b) Your configuration files seem to have MANY duplicate entries in
them.
> >Both /etc/shorewall/masq and /etc/shorewall/tcrules have
192.168.100.0/25
> >and 192.168.108.0/25.
>
> I understood from the documentation that in "masq" file I had to
put the
> subnets with which I want to make SNAT. What I did was add for each IP one
> line for eth1 and another identical one for ppp0. In this way, when I want
> to route by the ADSL, the SNAT is already configured.
> Is this wrong? or am I right?

Your configuration is silly. While you seem uninterested in showing us the
actual file contents the rules that are generated suggest that you have:

ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25
ppp0	192.168.100.0/25

What possible reason would you have for doing that????

>
> In the tcrules file I add one line for each IP that I want to route.
> I configured both files this way because what I want to do in this moment
> is to route the public and private IPs'' traffic
> by the provider connected to ETH1, but I don''t want to make
dyanamic
> balancing.
> If at some moment I need to route one of these subnets by th ADSL, all I
> have to do is change just one line in the tcrules file.
> Again, Is this wrong? or am I right?

It''s right (other than the missing entry for your public IP addresses)
but
it''s silly to have multiple identical entries!

>
> >c) I find the use of /25''s rather than /24''s curious
-- any reason for
> >that?
>
> Some time ago, somebody recommended me that for doing load balancing it was
> necessary to split in two subnets, one by the ADSL and the other by the
> second connection.
> Today I understand that this is not really necessary

I''m lost.

>
> >d) You didn''t say which "public IP address" you were
using,
>
> I connect from: 200.58.129.2

There are a lot of UNREPLIED entries from that IP as well.