Home » forums » Imported debian.org Mailing Lists » Debian Firewall

routing by service

Tags:

Currently i have two small groups of computers, one formed by three
computer plus guests (portables), connected to an ADSL router that has a
static address of a.b.c.d and does natting, and is set to use dmz for
one of the computers, and assigning two ports to each of the local
computers for inbound service
these computer locally use addresses 192.168.2.17
and up to 30 with a /24 subnetting ( 192.168.2.1 is the router )
the second group is formed by one computer plus guests and is connected
via a bridge to the first one, and uses addresses from .49 upward.
All works fine except that sometimes bandwidth available for the second
group is insufficient (either since the internet band is saturated or is
just saturated the link between the two subgroups).
I decided to get a second ADSL link, with the same speed of the first one,
but with a dynamic address, from a different ISP (to reduce possible
problems), with a similar setup giving .33 to it)
Now i wish the following:
The first group continue to use the present ISP;
the second one should use the second ISP except in the following cases:
1. is connecting to certain hosts [ A] using certain ports on the
remote host
(typycally 25 80 443 631 that have applications that depend on the address
on the other side)
2. is connecting to certain hosts [ B] whitout respect of the port
used
3. bandwidth used on the second link from other application/computers is
above a certain threshold (to avoid slow response)
Of course in case of a break on each of the links both groups should use
the working one, and if one try to connect one of the computer in the
other subnet should use the "direct" link.

I thought of setting the two routers so they assing the correct gateway to
each computer, and this works fine (the bridge between slow the
connections enought so the address is always given by the dhcp server on
the "correct" side.
for case 2 of course is sufficent setting a static route.
how to do for case 1 and 3 ?
how to set routing (if possible by dhcp) to use a route for certain remote
ports and another for the others ?
how to start two ftp connections possibly to the same host, but asking to
use one route for one and another for the other ?
(it would be easy if the remote host would be multi homed, but how to do
if has a single address ? it is not a router problem this one but rather
an application issue, since the connection would go to two differnte
routers)
??

--

[/][/]
Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
0
‹ Articulos de interes: La soledad Customizing debian firewall install ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

routing by service

Submitted by Phil Dyer on Thu, 2007-08-16 22:00.

On 8/11/2007 5:18 PM, Leonardo Boselli wrote:
> Currently i have two small groups of computers, one formed by three
> computer plus guests (portables), connected to an ADSL router

[snip]

> I decided to get a second ADSL link, with the same speed of the first one,
> but with a dynamic address, from a different ISP (to reduce possible
> problems), with a similar setup giving .33 to it)
> Now i wish the following:
> The first group continue to use the present ISP;
> the second one should use the second ISP except in the following cases:
> 1. is connecting to certain hosts [ A] using certain ports on the
> remote host
> (typycally 25 80 443 631 that have applications that depend on the address
> on the other side)
> 2. is connecting to certain hosts [ B] whitout respect of the port
> used

[snip]

> how to set routing (if possible by dhcp) to use a route for certain >
> remote
> ports and another for the others ?

I tried to trim this as best i could. :)

First, using dhcp to assign gateways based on service isn't going to
work. I think the cheap, fairly reliable solution is to set a single
router with 2 (or more) interfaces. One for each DSL connection. Let
iptables on the router handle the routing issues.

Here's a good howto that may be what you're looking for.

http://linux-ip.net/html/adv-multi-internet.html

For what it's worth, i do this on a net that I admin. simple poor man's
load balancing. I have a T1 and an ADSL connection. In a nutshell, I
push web/ftp/streaming traffic over the dsl line and everything else
over the T1. I don't have a lot of fine grained control, but it does a
good job.

phil

--

[/][/]
»

routing by service

Submitted by Leonardo Boselli on Fri, 2007-08-24 16:00.

On Thu, 16 Aug 2007, Phil Dyer wrote:
> On 8/11/2007 5:18 PM, Leonardo Boselli wrote:
> I tried to trim this as best i could. :)
> First, using dhcp to assign gateways based on service isn't going to
> work. I think the cheap, fairly reliable solution is to set a single
> router with 2 (or more) interfaces. One for each DSL connection. Let
> iptables on the router handle the routing issues.

Your best is not enought for me.
There are three difficulties:
1. using a single router would set a single point of failure, that is one
thing I want to avoid;
2. the two groups of computer are separated and connected
via a bridge, using an old 10base2 cable that has a bandwidth even less
than the bandwidth of each of the links. Improving that one would cost me
more than what i plan to spend. keeping it would not work if two computer
from the satellite subnet are in use and the router is the other way ....
3. using a line for each group of service would not fit for me: here i
could have one computer tht is connected to another, possibly using the
same service, needing all that it can get. of course if i separate the two
links by service it would not work for this that is the most frequent case
i need bandwidth.
... stil waiting for help !
(the most noticeable problem is, aftersome personal replies:
i could set the power user'
computer using two ip one having as a router router A and the other
router B. For service such sftp where there is the option to bind to a
particular addres is easy, but for program such ftp, or just apt-get how
to tell for each connection what link to use [someone suggested to set up
one connection, then chage the ruls on the nat device to use the other
.... but i am not comfortable on it !])

--

»

routing by service

Submitted by Phil Dyer on Sat, 2007-08-25 10:00.

Leonardo Boselli wrote on 8/24/2007 4:44 PM:

> Your best is not enought for me.
Oucht.

good luck.
--
phil

--

»
Syndicate content