Re: 2 ISP problem 1

Charrua
Mon, 26 Dec 2005 19:28:27 -0000

Thanks Tom,

>a) I think that you will have continuous problems with the way that you
>have configured your local network (public /27 and many private >networks
>on the same LAN). You can already see hints of the problems in this log
>message:

>Dec 23 07:25:40 FORWARD:REJECT: IN=eth2 OUT=eth2 SRC=200.58.129.2
>DST=192.168.107.2 LEN=84 TOS=00 PREC=0x00 TTL=62 ID=0 DF >PROTO=ICMP
TYPE=8
>CODE=0 ID=62326 SEQ=0

>Check Shorewall FAQ 17 to understand what this message means.

I don´t understand, I need "routeback" option in eth2?


>b) Your configuration files seem to have MANY duplicate entries in them.
>Both /etc/shorewall/masq and /etc/shorewall/tcrules have 192.168.100.0/25
>and 192.168.108.0/25.

I understood from the documentation that in "masq" file I had to put
the
subnets with which I want to make SNAT. What I did was add for each IP one
line for eth1 and another identical one for ppp0. In this way, when I want
to route by the ADSL, the SNAT is already configured.
Is this wrong? or am I right?

In the tcrules file I add one line for each IP that I want to route.
I configured both files this way because what I want to do in this moment is
to route the public and private IPs'' traffic
by the provider connected to ETH1, but I don''t want to make dyanamic
balancing.
If at some moment I need to route one of these subnets by th ADSL, all I
have to do is change just one line in the tcrules file.
Again, Is this wrong? or am I right?


>c) I find the use of /25''s rather than /24''s curious --
any reason for
>that?

Some time ago, somebody recommended me that for doing load balancing it was
necessary to split in two subnets, one by the ADSL and the other by the
second connection.
Today I understand that this is not really necessary


>d) You didn''t say which "public IP address" you were
using,

I connect from: 200.58.129.2

----- Original Message -----
From: "Tom Eastep" <teastep@shorewall.net>
To: <shorewall-users@lists.sourceforge.net>
Cc: "Charrua" <charrua@kernel.net.uy>
Sent: Monday, December 26, 2005 12:51 PM
Subject: Re: [Shorewall-users] 2 ISP problem 1




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!