Multi-ISP configuration problem

Brad Clarke
Sat, 12 Apr 2008 03:43:47 -0000

I''m using a newly built Ubuntu 7.10 system and the shorewall package
 available from the gutsy repository. I have made the two patches for
 multi-ISP users listed on the home page. I think my setup might have
 gotten a little too complex for my brain but it seems like I have
 everything in place.

 I have 2 ISPs on 2 different interfaces and 1 more interface for my
 local network. I''m forwarding VPN connections made to either of the
 public IP addresses to an internal VPN server. During setup (I''ve gone
 through quite a bit of trial and error so I don''t recall exactly how
 setup things were at the time) both of the following were working but
 now that I have everything else in place I can''t make it happen
 anymore

 I have an apache installed on the shorewall machine. At one time I
 could make a connection from an internal IP to any of the 3 IPs on the
 shorewall machine and it would go to the apache server, but now
 connections to 216.111.163.33 are failing even though the other two
 addresses work fine. I''m attaching a dump (dump-apache.gz) of me
 trying to make one of these connections from 192.168.10.220.

 I had VPN connections from an internal address (192.168.10.x) to
 either of the external addresses routing the connection back to the
 internal VPN server. Now these connections will not work at all. It
 was showing up in my log as being REJECTed by the loc2fw rule so I
 added a rule to allow it (though I don''t recall having to do that
 before). There is no longer anything in the log but the connection
 will still not happen. I''m attaching a dump of that attempt as well
 (dump-vpn.gz).

 There are also a couple of other things that are bugging me about my
 configuration that may or may not be related but I''ll mention them at
 least.

 Try as I might I ended up having to remove routefilter from both of my
 external interfaces because VPN connection attempts from outside were
 showing up as martians. I think I did everything that was asked of me
 in the documentation to prevent that from happening but if someone can
 see anything in the dumps that might point to why I''m still seeing
 these connections as martians I''d love to be able to turn that option
 back on. It might also be worth telling people somewhere that after
 removing the routefilter option I had to reboot the machine for it to
 take effect (I could add it with just a shorewall restart though).

 Should I be setting the metrics on the interfaces like I am or does it
 matter at all once shorewall does it''s thing?

 Brad C