[ale] two connections to internet??
Bao C. Ha
baoha at sensoria.com
Fri Aug 31 16:30:14 EDT 2001
This is a good concrete example on how to do it using iproute2 and
iptables/netfilter.
Have anybody been successful with ipchains? I have tried with
ipfwadm and it fails miserably.
Thanks.
Bao
> -----Original Message-----
> From: owner-ale at ale.org [mailto:owner-ale at ale.org]On Behalf Of James
> Kinney
> Sent: Thursday, August 30, 2001 11:42 AM
> To: hirsch at zapmedia.com
> Cc: Gary MacKay; ale at ale.org
> Subject: Re: [ale] two connections to internet??
>
>
> Almost right Michael. If you are using a properly configured
> ISP to send
> mail to, if they get mail from another access point other
> than one they
> have authenticated you on, it will get bounced. Earthlink is
> very good at
> that.
>
> The best solution is the NAT/firewall/port routing solution.
> I have it up
> and running. It works great. 2 DSL lines, one fast and cheap
> and dhcp, the
> other slow, expensive and static IP. All incomming mail,
> http, ssh and ftp
> connection requests are allowed on the static and denied on
> the dhcp. All
> internal mail is grabbed by the routing firewall and marked
> to go out the
> static line. All return http goes out the static line.
>
> excerpts from the firewall setup script:
> # load modules as needed
> /sbin/modprobe ipt_mac
> /sbin/modprobe ipt_limit
> /sbin/modprobe ipt_tos
> /sbin/modprobe ipt_mark
> /sbin/modprobe ipt_LOG
> /sbin/modprobe ipt_MARK
> /sbin/modprobe ipt_TOS
> /sbin/modprobe ipt_owner
> /sbin/modprobe ipt_state
> /sbin/modprobe ipt_unclean
>
> # Turn on forwarding
> #
> echo 1 > /proc/sys/net/ipv4/ip_forward
> echo 1 > /proc/sys/net/ipv4/tcp_syncookies
>
> /sbin/iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK
> --set-mark 1
> # use mindspring
> /sbin/iptables -t mangle -A OUTPUT -d 198.99.146.10 -j MARK
> --set-mark 1
> # use mindspring news
> /sbin/iptables -t mangle -A OUTPUT -d 207.69.200.57 -j MARK
> --set-mark 1
> # use mindspring mail
> /sbin/iptables -t mangle -A OUTPUT -d 207.69.188.185 -j MARK
> --set-mark 1
> # use mindspring DNS
>
> And from further down:
>
> ### setup routing to handle the marks
> /sbin/ip ru del fwmark 1 table 1 pref 1010 #kills off
> running versions
> /sbin/ip ro del default dev eth1 table 1 #kills off
> running versions
> /sbin/ip ru del fwmark 2 table 2 pref 1020 #kills off
> running versions
> /sbin/ip ro del default dev eth2 table 2 #kills off
> running versions
> /sbin/ip ru del fwmark 5 table 10 pref 1000 #kills off
> running versions
> /sbin/ip ro del default dev eth0 table 10 #kills off
> running versions
> /sbin/ip ru add fwmark 0x1 table 1 pref 1010
> /sbin/ip ro add 0/0 via 199.174.105.193 dev eth1 table 1
> /sbin/ip ru add fwmark 0x2 table 2 pref 1020
> /sbin/ip ro add 10.0.0.0/0 dev eth2 table 2
> /sbin/ip ro add 0/0 dev eth2 table 2
> /sbin/ip ru add fwmark 0x5 table 10 pref 1000
> /sbin/ip ro add 192.168.0.0/24 via 192.168.0.2 dev eth0 table 10
> /sbin/ip ro flush cache
>
> /sbin/ip ro li
> /sbin/ip ru li
> /sbin/ip ro li table 1
> /sbin/ip ro li table 10
> /sbin/ip ro li table 2
>
>
> eth0 in internal, eth1 is static, eth2 is dhcp.
> Add other specific blocks and locks as needed.
>
> On Thu, 30 Aug 2001 hirsch at zapmedia.com wrote:
>
> > Gary MacKay writes:
> > > Fantastic idea! My only problem is that I'm OK at
> routing, but far from
> > > an expert. I'm not sure how to do it so that ONLY email
> goes in/out the
> > > DSL card and everything else uses the cable modem. My
> goal is that all
> > > the workstation traffic uses the cable modem. The _only_
> reason I have
> > > DSL is for the static IP for the email/web server.
> >
> > Why not send all outgoing traffic out the cable modem since the only
> > point of the DSL is for incoming traffic. There is no rule that
> > traffic has to go back the way it came in.
> >
> > So all you need to do is configure the DSL NIC to have the
> proper IP,
> > then route everything out the cable NIC.
> >
> > --Michael
> >
> > >
> > >
> > > Leonard Thornton wrote:
> > > >
> > > > Wht not build a single firewall with 3 Ethernet cards?
> (2 external
> > > > connection and 1 internal connection) Setup you DSL
> as a primary route
> > > > and the cable as secondary in your routing entries.
> Use NAT and
> > > > prtforwarding to route traffic to your mail / web /
> ftp servers on the
> > > > internal network from the outside world.
> > > >
> > > > Gary MacKay wrote:
> > > >
> > > > > Ok, here's a weird question for you. I had
> RoadRunner service and
> > > > > recently installed a DSL line so I could have a
> dedicated IP. (Yes, I'm
> > > > > aware of dyndns.org, but choose not to for now.)
> Currenly my firewall
> > > > > box is connected to the DSL and my cable modem is
> sitting here mocking
> > > > > me with it's little blinking lights. It was way
> faster than this DSL,
> > > > > and I just can't bring myself to shut if off. My
> question is, can I have
> > > > > both? :) Something like this?
> > > > >
> > > > >
> > > > > Internet Internet
> > > > > | |
> > > > > firewall 1 firewall 2
> > > > > | |
> > > > > +------- hub --------+
> > > > > |
> > > > > / \
> > > > > mail workstation(s)
> > > > > srvr
> > > > >
> > > > > I envision just setting the gateway address of my
> workstion(s) to
> > > > > firewall-2 so I can enjoy the fast connection for
> every day browsing,
> > > > > but the email/web server will use firewall-1 as it's
> gateway so the
> > > > > fixed IP will work for it. Will it work? An added
> benefit would be if
> > > > > one goes down, I could switch the gateway addr and
> keep browsing!
> > > > >
> > > > > I realize I could split them apart as two seperate
> networks, but then my
> > > > > workstations would have to go out the cable modem
> and back in the DSL
> > > > > line to check email. Seems kind of wierd when the
> boxes sit about four
> > > > > inches apart!!
> > > > >
> > > > > - Gary
> > > > > --
> > > > > To unsubscribe: mail majordomo at ale.org with
> "unsubscribe ale" in message body.
> > > > >
> > > > >
> > > >
> > > > --
> > > > The difficult while you wait...the impossible overnight.
> > > >
> > > > Leonard Thornton
> > > > Intelis, Inc
> > > > leonard at intelis-inc.net
> >
> >
> >
> > --
> > To unsubscribe: mail majordomo at ale.org with "unsubscribe
> ale" in message body.
> >
>
> --
> James P. Kinney III \Changing the mobile computing world/
> President and COO \ one Linux user /
> Local Net Solutions,LLC \ at a time. /
> 770-493-8244 \.___________________________./
>
> --
> To unsubscribe: mail majordomo at ale.org with "unsubscribe ale"
> in message body.
>
--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.
More information about the Ale
mailing list