DNAT with Multimac OR Multiple IP Setup v2

Donald
2009-08-27T15:15:05Z

Hello List!

Sorry, I sent the email prematurely.  This email outlines the problem I was
having.

This may be one of those, you''re doing it wrong, and there is a far
easier
way to do it than the way you are doing it.  Please let me know.

*Problem*
**- Seems like rules to the firewall work fine.  However, the DNAT rule will
not work over its dead body.  When I had the 3 NIC setup, that DNAT rule
worked fine.
-Also, I can''t use the shorewall show status commands because
/var/log/shorewall.log is empty.

*Overview
*-Cable Provider provides 2x IPs
-IPs are given out via DHCP.  Static costs $$ (double/triple the monthly
cost).
-Bandwidth is 7Mb down/2Mb up, but shared between two ips.

*Goal*
- Use both IPs and do traffic shaping on both of them.  IP1 gives access to
router.  IP2 gives access to other machines on LAN using DNAT.
- My goal is that I could have usenet or bt going full throttle, but
immediately slows down once someone makes a voip phone call or starts
browsing the internet.
- If I didn''t need to do the traffic shaping, using 3 NICs with the
multi-isp shorewall setup would work fine.

*Rationale and other strategies*
- Tried using 3 NICs, 2 on the internet getting IPs via DHCP, and 1 for the
lan.  Couldn''t do traffic shaping well, since the bandwidth is shared
between the two ips.  If each IP got dedicated bandwidth it''d be
fantastic,
but I couldn''t figure out what to do to keep latency down, tried
halving the
bandwidth on each interface, but to no avail.  Perhaps go back to this
setup, but use IFB''s to shape the download bandwidth?  Ultimately, the
only
reason this seems to be a difficult problem is because I need to try to get
traffic shaping shared between two ips.

*Current Physical Setup*
*=========================*- Two NICs: eth0-LAN,eth1-INTERNET
- Using bridge-br0 interface to bridge eth1 & tap0
- Using Program called Multimac to create tap1 & tap2 interfaces with unique
MAC addresses that request ips via DHCP.  Multimac works by copying all
traffic on tap0 to tap1 & tap2.  Call it another bridge.  I tried to not use
multimac and create tap interfaces, add them to the bridge and assign unique
MACs and IPs, but couldn''t get it to work, so I just ended up using the
multimac application.

**
*Current Setup
**=========================*- Version: Shorewall-perl 4.0.15 on Debian lenny

*zones
=========================*fw    firewall
loc    ipv4
ptd1    ipv4
ptd2    ipv4

world    ipv4
wan:world    bport4
dmz:world    bport4
*
Interfaces
**==========================*
world    br0        -        bridge,dhcp
wan    br0:eth1    -
dmz    br0:tap0    -

ptd1    tap1        detect        dhcp,routeback,upnp
ptd2    tap2        detect        dhcp,routeback,upnp
loc     eth0            detect          dhcp,routeback*

Policy
**=========================*wan        dmz        ACCEPT
dmz        wan        ACCEPT

# Firewall Policy
loc        ptd1        ACCEPT
loc        ptd2        ACCEPT
loc        $FW        ACCEPT
loc        all        REJECT        info

$FW        ptd1        ACCEPT
$FW        ptd2        ACCEPT
$FW        loc        ACCEPT
$FW        all        REJECT        info

ptd1        $FW        DROP        info
ptd1        loc        DROP        info
ptd1        all        DROP        info

ptd2        $FW        DROP        info
ptd2        loc        DROP        info
ptd2        all        DROP        info

# THE FOLLOWING POLICY MUST BE LAST
all        all        REJECT        info*

Masq
**==========================*
tap1    192.168.1.0/24        24.102.132.193
tap1    24.102.139.228        24.102.132.193
tap2    192.168.1.0/24        24.102.139.228
tap2    24.102.132.193        24.102.139.228*

providers**
**==========================*
ptd1 1 1 main tap1 detect track,balance,optional eth0
ptd2 2 2 main tap2 detect track,balance,optional eth0*

route_rules
**==========================*
192.168.1.2    -        ptd2        1000
192.168.1.0/24    -        ptd1        1000*

tcclasses
**==========================*
tap0    1    25*full/100    full    1    tos=0x68/0xfc,tos=0xb8/0xfc
tap0    2    15*full/100    full    2
tap0    3    20*full/100    full    3    tos-minimize-delay
tap0    4    30*full/100    full    4
tap0    5    10*full/100    75*full/10    5    default
*
tcdevices
**==========================*
tap0    1550kbit    5600kbit*

tcrules
**==========================*
1:T    0.0.0.0/0    0.0.0.0/0    icmp    echo-request
1:T    0.0.0.0/0    0.0.0.0/0    icmp    echo-reply
1:T    192.168.1.5    0.0.0.0/0
1:T    0.0.0.0/0    192.168.1.5
2:T    0.0.0.0/0    0.0.0.0/0    udp    53
2:T    0.0.0.0/0    0.0.0.0/0    tcp    53
3:T    0.0.0.0/0    0.0.0.0/0    tcp    22
3:T    0.0.0.0/0    0.0.0.0/0    tcp    5900
4:T    0.0.0.0/0    0.0.0.0/0    tcp    80,443,8080,8088
# Bittorrent/Usenet
5:T    0.0.0.0/0    0.0.0.0/0    tcp    6974
5:T    0.0.0.0/0    0.0.0.0/0    udp    6974
5:T    0.0.0.0/0    192.168.1.2
5:T    192.168.1.2    0.0.0.0/0*

ip addr show
**==========================*
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:30:65:7b:b2:c4 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UNKNOWN qlen 1000
    link/ether 00:01:02:a6:54:0b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::201:2ff:fea6:540b/64 scope link
       valid_lft forever preferred_lft forever
4: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state
UNKNOWN qlen 1000
    link/ether 00:10:4b:c5:99:de brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::210:4bff:fec5:99de/64 scope link
       valid_lft forever preferred_lft forever
5: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc htb state
UNKNOWN
qlen 500
    link/ether 00:ff:6f:ae:70:0f brd ff:ff:ff:ff:ff:ff
    inet6 fe80::2ff:6fff:feae:700f/64 scope link
       valid_lft forever preferred_lft forever
6: tap1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 576 qdisc pfifo_fast state
UNKNOWN qlen 500
    link/ether 00:1e:2a:47:bf:0d brd ff:ff:ff:ff:ff:ff
    inet 24.102.132.193/24 brd 255.255.255.255 scope global tap1
7: tap2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 576 qdisc pfifo_fast state
UNKNOWN qlen 500
    link/ether 00:10:4b:c5:99:dd brd ff:ff:ff:ff:ff:ff
    inet 24.102.139.228/24 brd 255.255.255.255 scope global tap2
8: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state
UNKNOWN
    link/ether 00:01:02:a6:54:0b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::201:2ff:fea6:540b/64 scope link
       valid_lft forever preferred_lft forever*


ip route show
**==========================*
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
24.102.139.0/24 dev tap2  proto kernel  scope link  src 24.102.139.228
24.102.132.0/24 dev tap1  proto kernel  scope link  src 24.102.132.193
default
    nexthop via 24.102.132.1  dev tap1 weight 1
    nexthop via 24.102.139.1  dev tap2 weight 1
default via 24.102.132.1 dev tap1 *

*
*rules
**=========================*Ping/ACCEPT    ptd1        $FW
SSH/ACCEPT    ptd1:$NRDC,$NCXOFFICE,$ALAN    $FW
HTTP/ACCEPT    ptd1:$NRDC,$NCXOFFICE,$ALAN    $FW
DNAT        ptd2            loc:192.168.1.2:80    tcp    80     -     $PTD2*
*