Hello list membes
I have a linux running firewall/router machine, connecting LAN to the internet with two interfaces (no load balancing or other connections). One is a fast connection with dynamic IP (ADSL) which is the default route, the other is a static IP (T3) connection (used for mail sever and other services available from www).
Additional I want to provide our intranet (located in the LAN) access to workes outside the office, using a port on the static firewall IP, which will be redirected (dnat) by iptables prerouting rule and allowed forwarding to LAN intranet sever port.
The scenario is woking when the T3 connection is default gateway in the main routing table. It is not working when I switch the default gateway to the ADSL connection.
The incoming packets are trackable with tcpdump and dnat redirect in the prerouting table is working (notification in syslog by iptables). Missing are the packets on the interface to LAN and the forwarding notification by iptables is also missing. So I think this is a routing problem.
I hope someone can help, or getting me clues what to check.
Thank you,
Oliver
Here is some information on the network topology and snips from the routing/firewall script:
/-------------------\
| DMZ |
| static IP |
\-------------------/
|
2 |
/--------------------------------\
StaticIP | Static IP |
/----------\ 1 | | 0 /-----------------\
| T3 | -- | Firewall/Router | -- | LAN |
/ \----------/ | | | |
/ | | \-----------------/
/-------\ / \--------------------------------/
| WWW | ---< |
\-------/ \ 3 |
\ |
\ /----------\ |
| ADSL | ---------/
\----------/
DynamicIP
function SetIPROUTEmain () {
ExitStatus=0
echo -en " - Setting Routing table main " >>$MessageDev
$IP route add $LAN_IP_RANGE dev $LAN_IFACE src $LAN_IP
ExitStatus=$(($ExitStatus+$?))
$IP route add $ADSL_IP_RANGE dev $ADSL_IFACE src $ADSL_IP
ExitStatus=$(($ExitStatus+$?))
$IP route add $DMZ_IP_RANGE dev $DMZ_IFACE src $DMZ_IP
ExitStatus=$(($ExitStatus+$?))
$IP route add $T3_GATEWAY dev $T3_IFACE src $T3_IP
ExitStatus=$(($ExitStatus+$?))
$IP route add default via $ADSL_GATEWAY dev $ADSL_IFACE
ExitStatus=$(($ExitStatus+$?))
$IP route flush cache
ExitStatus=$(($ExitStatus+$?))
PRINT_EXIT_STATUS $ExitStatus
echo >>$MessageDev
}
function SetIPROUTEadsl () {
ExitStatus=0
echo -en " - Setting Routing table ADSL " >>$MessageDev
$IP route add $ADSL_IP_RANGE dev $ADSL_IFACE src $ADSL_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route add $T3_GATEWAY dev $T3_IFACE src $T3_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route add $DMZ_IP_RANGE dev $DMZ_IFACE src $DMZ_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route add $LAN_IP_RANGE dev $LAN_IFACE src $LAN_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route add $LO_IP_RANGE dev $LO_IFACE src $LO_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route add default via $ADSL_GATEWAY dev $ADSL_IFACE table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP rule add from $ADSL_IP table ADSL
ExitStatus=$(($ExitStatus+$?))
$IP route flush cache
ExitStatus=$(($ExitStatus+$?))
PRINT_EXIT_STATUS $ExitStatus
echo >>$MessageDev
}
function SetIPROUTEt3 () {
ExitStatus=0
echo -en " - Setting Routing table T3 " >>$MessageDev
$IP route add $ADSL_IP_RANGE dev $ADSL_IFACE src $ADSL_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP route add $T3_GATEWAY dev $T3_IFACE src $T3_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP route add $DMZ_IP_RANGE dev $DMZ_IFACE src $DMZ_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP route add $LAN_IP_RANGE dev $LAN_IFACE src $LAN_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP route add $LO_IP_RANGE dev $LO_IFACE src $LO_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP route add default via $T3_GATEWAY dev $T3_IFACE table T3
ExitStatus=$(($ExitStatus+$?))
$IP rule add from $T3_IP table T3
ExitStatus=$(($ExitStatus+$?))
$IP rule add from $DMZ_IP_RANGE table T3
ExitStatus=$(($ExitStatus+$?))
$IP route flush cache
ExitStatus=$(($ExitStatus+$?))
PRINT_EXIT_STATUS $ExitStatus
echo >>$MessageDev
}
function IPT_Intranet () {
#-------------------------------------------------------------------------------
# Pierce Port 20080 to Intranet WWW
if [ "$Enable_INTRANET" = "y" ] ; then
ExitStatus=0
echo -ne " - Establish INTRANET rules " >>$MessageDev
$IPTABLES -t nat -A PREROUTING -p TCP -i $T3_IFACE --dport 20080 -j LOG --log-prefix "DNAT 20080:"
ExitStatus=$(($ExitStatus+$?))
$IPTABLES -t nat -A PREROUTING -p TCP -i $T3_IFACE -d $DMZ2_IP --dport 20080 -j DNAT --to-destination $WWW_SERVER_IP:81
ExitStatus=$(($ExitStatus+$?))
$IPTABLES -A FORWARD -p TCP -d $WWW_SERVER_IP -j LOG --log-level DEBUG --log-prefix "IPT FORWARD INTRANET:"
ExitStatus=$(($ExitStatus+$?))
$IPTABLES -A FORWARD -p TCP -i $T3_IFACE -d $WWW_SERVER_IP -o $LAN_IFACE --dport 81 -j ACCEPT
ExitStatus=$(($ExitStatus+$?))
PRINT_EXIT_STATUS $ExitStatus
echo >>$MessageDev
fi
}