up vote 0 down vote favorite
share [g+] share [fb]

I have run into a snag with a network design project I'm working on. Our internal network is 192.168.1.x. We have two gateways out of our network, #1 is .20 and #2 is .52. Normally you could pick and choose your gateway at the machine level but here in lies our problem. We have a security device inline to our two gateways. No matter what layer 2 address that device receives when it forwards the packets on it receives the layer 2 address of the gateway on its bridge. I should mention that this behavior is only relevant on protocols that the device is monitoring ( http, smtp ) So, the end result is such, no matter what gateway the individual machines are configured with for the protocols in question they all get the same gateway no matter what.

I was tasked with having different servers use either gateway #1 or gateway #2 based on our needs. Well, not so great if those servers use an "inspected" protocol.

My idea now is to route the traffic after it exits the security device based upon the layer 3 protocol in the packet. I simply don't know what to use to do that though. Or for that matter if that's even the best approach.

D.

link|improve this question
77% accept rate
1  
Sounds like that firewall (it is a firewall, right?) is trying to play router; is it set in transparent mode? I'd say your best bet is to get your firewall to stop messing with stuff; support for something like policy-based routing will be hit-or-miss. We'll need to know at least the manufacturer of that device to assist with that part. – Shane Madden Mar 31 '11 at 0:49
Its and IBM server running packet inspection software from Websense. I believe their software runs atop CentOS but I've investigated the issue with Websense and although they state in their literature its "transparent" they neglected to say "only at layer 2". That's how I've found myself in this predicament. – Donovan Aug 23 '11 at 17:28
feedback

2 Answers

up vote 0 down vote

The best approach is to 'fix' this security device! However, the second best is to configure some sort of L3 capable routing on whichever device you control. If you control the gateways you could use something like iptables to configure either the source/destination addresses or reroute the packet entirely to the other gateway.

Here is some info on using iptables to masquerade:

http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html

link|improve this answer
feedback
up vote 0 down vote

You could use a free firewall/router appliance called pfSense. It allows making routing decisions based on port numbers and similar.

link|improve this answer
I took a look at the sight. It looks as if its just BSD to be run on whatever hardware you choose. Not exactly an "appliance" i suppose but it might get the job done. – Donovan Aug 23 '11 at 17:25
There are several commercial vendors which bundle pfSense with some hardware and/or support if you do not want to roll on your own. It is very well developed and easily beats many commercial closed-source products. BTW, what is wrong with the BSD kernel & networking stack? – snap Aug 23 '11 at 17:39
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.