Re: 2 ISP problem 1

Tom Eastep
Mon, 26 Dec 2005 15:51:06 -0000

On Monday 26 December 2005 04:57, Charrua wrote:
>  Hi,
>
>  I have two Internet connections from two different ISPs. Connection
"A" is
> ADSL, connection "B" is another kind of broadband connection
(LMDS).  In
> the ADSL link I have 1 public ip which changes dynamically, and in the
"B"
> connection I have 28 fixed public IP''s that I can use. Each of
them come
> into my network through a standard Ethernet 10BaseT connection.
>
>  I like:
>
>  1. A few users with public IPs.
>  2. The rest of the users with private IPs, and their traffic will go out
>  using NAT
>  3. Route some traffic by the connection "B" and other traffic by
conection
> "A"
>
>  I configured Shorewall(Leaf Bering uClibc 2.3 with Shorewall 2.4.2), but
> this configuration don`t work, I can''t access Internet(http, msn,
smtp,
> pop3, etc). I try acces from a public IP.
>
>  Please, can you check the configuration?
>

Here''s what I see in the "status" output (in no particular
order):

a)  I think that you will have continuous problems with the way that you have
configured your local network (public /27 and many private networks on the
same LAN). You can already see hints of the problems in this log message:

Dec 23 07:25:40 FORWARD:REJECT: IN=eth2 OUT=eth2 SRC=200.58.129.2
DST=192.168.107.2 LEN=84 TOS=00 PREC=0x00 TTL=62 ID=0 DF PROTO=ICMP TYPE=8
CODE=0 ID=62326 SEQ=0

Check Shorewall FAQ 17 to understand what this message means.

I personally advocate using 1-1 NAT for those users that you want to give a
public IP address. I think that you and your users will be happier in the
long run.

b)  Your configuration files seem to have MANY duplicate entries in them.
Both /etc/shorewall/masq and /etc/shorewall/tcrules have 192.168.100.0/25 and
192.168.108.0/25.

c)  I find the use of /25''s rather than /24''s curious -- any
reason for that?

d)  You didn''t say which "public IP address" you were using,
but I would guess
that it is 200.58.129.12. There are lots of entries in the conntrack table
like this:

tcp      6 13 SYN_SENT src=200.58.129.12 dst=83.45.219.45 sport=29249
dport=7922 [UNREPLIED] src=83.45.219.45 dst=200.58.129.12 sport=7922
dport=29249 use=1 mark=0

I can''t look at the traffic with tcpdump (have you? If not, you should)
but if
the firewall picked the route through ppp0 for this connection, you would see
this type of behavior. You need a rule in /etc/shorewall/tcrules such as:

2:P      200.68.129.0/27       0.0.0.0/0

The traffic from the public IPs MUST BE SENT FROM eth1!!!!!!!!!!

If tcpdump shows that the traffic IS being sent from eth1 then the problem is
that your ISP is apparantly not routing 200.68.129.0/27 through 200.68.129.34
which is what your configuration assumes.

HTH,