Dear Linux Network Gurus,
Consider the following network:
The linux box has (3) interfaces,
eth0 can get to the Internet via a pure IP connection and to Internal
Network A via a router.
eth1 is a private network and not routed
eth2 can get to the Internet via a NAT/Firewall is directly connected to
Internal Network B.
The linux box does NOT have to route for the network, but has to do source
routing because the Firewall runs NAT and translates addresses, thus
anything that comes in from the Internet, needs to go out via the same
interface/path it came in on. The main purpose of this server is to accept
incoming SSH connections from all interfaces and host a SQUID proxy server.
Source routing works fine using the following "ip" commands:
# Setup Source Routing for ISP#1
ip rule add from 126.96.36.199 lookup 1
ip route add 0/0 via 188.8.131.52 table 1
# Setup Source IP Routing for ISP#2
ip rule add from 184.108.40.206 lookup 2
ip route add 0/0 via 220.127.116.11 table 2
However, I can not seem to construct rules/routes that get traffic initiated
from the server to the respective networks.
For example, if I add this: "ip route add 18.104.22.168 via 22.214.171.124
I would expect an traffic destined for 126.96.36.199 to be forwarded to the
router interface 188.8.131.52, however both traceroute and ping fail. Even
if I put in a static route using the "route add -net 184.108.40.206 netmask
255.255.255.0 gw 220.127.116.11", I still can't get packets to leave the
To make it even more complex, the 18.104.22.168 is tricky since the
Inbound/Outbound interface are the same. This interface doesn't have a DMZ
and there are hosts sitting on the subnet.
I have been racking my brain on this for 2 days and reading everything I can
find on IP, but there isn't an example for my situation. I am sick of
driving out to the console of this server everytime I hose up the routing
tables. I have found many fine examples, but they do not address my
particular situation. This may just be something that the "ip route/rule"
command can't handle, but I doubt it.
As always, I appreciate the insight and help from this newgroup.
I don't think I'll figure this solution out on my own anytime soon.