1

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using an Ethernet connection. I keep a firewall running on this server and manage it using Shorewall package.

Recently I got another internet link to use as a redundant IP address for my clients to connect to and use the service. This ISP gives me a modem which should connect to my LAN switch and has an IP address of 192.168.1.10. I configured this modem to forward the service port to my server which is at 192.168.1.2.

The problem is users can not connect through the new connection to server, routing configuration on new modem is limited (I can't tell it to do SNAT) and I don't know what sort of configuration I need on the firewall on server.

In simple words I need to tell the firewall on server, when packets come from 192.168.1.10 on port 1234, send the replies back to 192.168.1.10, despite whatever destination IP address is.

My best bet so far from my searches is http://www.shorewall.net/MultiISP.html which requires playing with server routes.

Is there any simpler way to do this preferably using iptables and shorewall?

Edit:

The LAN for local users is at 192.168.1.0/24. I can change new router IP address, if it helps.

I want the new link to act just as a redundant IP address, which I will add as an alias to DNS, so clients can try it in round robin fashion, when the old IP address goes down, so achieving a level of redundancy and fault tolerance. Outgoing internet connections from local network and server just need to go through old link, and it does not matter if it goes down.

Unfortunately the server has only two ethernet ports, one has been used for old modem and the other for local network switch. So no free ports, but if that's the only solution, I can add another network card.

The Linux server acts as a router and a firewall. It also runs a transparent squid proxy for local network, if that's what you mean by proxy.

2
  • Please answer the following few questions before i can help: 1- What is the local range of your users. 2- Do you want both connections to work at the same time, i mean your new and your old link or you want to have it just as a backup link? 3- Do you have an extra interface on the linux Box you have ? 4- Does this linux box act as poxy or just a firewall and router ?
    – MohyedeenN
    Jan 7, 2014 at 8:23
  • I will edit the question.
    – zaadeh
    Jan 7, 2014 at 8:38

1 Answer 1

1

to make things easier and avoid any conflicts, You need to do the following:

1- Change the ip range of the new router to lets say 172.20.1.0/24 2- Add a new interface on the server. Assign it an ip of the router range.

Router 172.20.1.1  <----------> Linux Box 172.20.1.2

3- Use the iproute2 to create new routing table.

On that table set the default gateway to 172.20.1.1
Use ip rule command to add all packets returning from new internet connection
to the new created table.

Assuming the table name is NewLink ip rule add from 172.20.1.2 table NewLink

Use ip rule add add group of users to the new connection:

ip rule add from 192.168.1.0/28 table NewLink
[just a group of ips to allow them to use the new link]

4- Use source natting instead of MASQUARGE which most probably you are using. to nat each group of ips to their specified internet connection.

You need to go over the steps i have mentioned above, and search for further info, i took me over a week to make it working but now it takes only 5 mins to set up a new provider.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .