by Dear Linux Network Gurus,
Consider the following network:
http://mywebpages.comcast.net/mgeorge3/network_layout.jpg
Summary
=======
The linux box has (3) interfaces,
eth0 can get to the Internet via a pure IP connection and to Internal
Network A via a router.
eth1 is a private network and not routed
eth2 can get to the Internet via a NAT/Firewall is directly connected to
Internal Network B.
The linux box does NOT have to route for the network, but has to do source
routing because the Firewall runs NAT and translates addresses, thus
anything that comes in from the Internet, needs to go out via the same
interface/path it came in on. The main purpose of this server is to accept
incoming SSH connections from all interfaces and host a SQUID proxy server.
Source routing works fine using the following "ip" commands:
# Setup Source Routing for ISP#1
ip rule add from 159.138.101.44 lookup 1
ip route add 0/0 via 159.138.101.3 table 1
# Setup Source IP Routing for ISP#2
ip rule add from 148.9.200.210 lookup 2
ip route add 0/0 via 148.9.200.4 table 2
However, I can not seem to construct rules/routes that get traffic initiated
from the server to the respective networks.
For example, if I add this: "ip route add 158.138.52.0 via 159.138.101.3
table 1"
I would expect an traffic destined for 159.138.52.0 to be forwarded to the
router interface 159.138.101.3, however both traceroute and ping fail. Even
if I put in a static route using the "route add -net 159.138.52.0 netmask
255.255.255.0 gw 159.138.101.3", I still can't get packets to leave the
server.
To make it even more complex, the 148.9.200.210 is tricky since the
Inbound/Outbound interface are the same. This interface doesn't have a DMZ
and there are hosts sitting on the subnet.
I have been racking my brain on this for 2 days and reading everything I can
find on IP, but there isn't an example for my situation. I am sick of
driving out to the console of this server everytime I hose up the routing
tables. I have found many fine examples, but they do not address my
particular situation. This may just be something that the "ip route/rule"
command can't handle, but I doubt it.
Fine Examples:
http://www.linuxgrill.com
http://www.samag.com
As always, I appreciate the insight and help from this newgroup.
I don't think I'll figure this solution out on my own anytime soon.
-Michael George
<--