Shorewall version: 4.4.19
I need a little advice before flailing around some more :)
I have a multi-ISP setup using 5 providers which works very nicely.
I'm trying to introduce OSPF routing updates into the picture but the
software only updates the main routing table, which poses a problem for me
with my current configuration, namely:
USE_DEFAULT_RT is currently set to Yes
All providers have "main" as their duplicate.
As the routing suite I am using will only update the main routing table,
those copies made for each provider become invalid.
I tried setting USE_DEFAULT_RT to No and using "-" for the duplicate in the
providers file. This reduced all the provider routing tables down to the
default routes as it should and placed main (with no default route) before
everything else. I used to have a default route for everybody who did
*not*have a provider which was in the main table, that is no longer
present in
the main table, of course. The problem I believe I am experiencing is from
the default table:
default
nexthop via 10.1.5.3 dev eth1.5 weight 1
nexthop via 24.52.191.241 realm 3 dev eth1.9 weight 1
nexthop via 10.3.11.1 realm 4 dev eth1.9 weight 1
nexthop via 10.3.11.1 realm 5 dev eth1.9 weight 1
which is "load-balancing" new connections and causing all kinds of issues
(traffic goes out wrong interface, doesn't get NAT'd, etc)
I want only the first line (my "default" ISP, if there is such a thing)
I am thinking that maybe I should be explicitly marking packets so they do
not hit the default table:
(from MultiISP <http://www.shorewall.net/MultiISP.html>)
The bottom line is that if you want traffic to go out through a particular
provider then you must mark that traffic with the provider's MARK value in
/etc/shorewall/tcrules and you must do that marking in the PREROUTING
chain; or, you must provide the appropriate rules in
/etc/shorewall/route_rules
Or is there a way to force that default table NOT to have nexthops from
particular providers? I considered the fallback option in the Providers
file, but that didn't seem right.
I've have a shorewall dump before/after these changes if somebody is
interested in looking over it all. It's about 100K compressed.
Thanks -- Lee
------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
