Re: Two ISPs setup: sometimes wrong source IP on one Interface

Tom Eastep
Tue, 12 Nov 2013 23:29:24 -0000

On 11/12/2013 3:25 PM, Axel Zöllich wrote:
>>> I forgot to say that this is only the case for packages originating
from
>>> the firewall itself. SNATed packages from the local network are
handled
>>> correctly.
>> Look carefully at http://www.shorewall.org/MultiISP.html#idp1955662608.
>> You are missing two entries.
>
> As i''ve got no public subnet behind the firewall (but outside) I
thought this
> is sufficient:
>
> masq:
> ppp0    192.168.122.0/24        bbb.152.162.192
> eth4    192.168.122.0/24        aaa.117.77.218
> ppp0    192.168.222.0/24        bbb.152.162.192
> eth4    192.168.222.0/24        aaa.117.77.218
> ppp0    192.168.223.0/24        bbb.152.162.192
> eth4    192.168.223.0/24       aaa.117.77.218
> ppp0    10.8.0.0/16             bbb.152.162.192
> eth4    10.8.0.0/16             aaa.117.77.218

It''s not. Why don''t you simply have this?

ppp0	0.0.0.0/0	bbb.142.152.192
eth4	0.0.0.0/0	aaaa.117.77.218

That way, any packet leaving either interface will always have the
proper source IP.

-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________