Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a LAN with three routers on it, one connected to the Internet, one VPN router connected to a few remote sites, and a final route connected to a private network (using BGP to get prefix advertisements).

On the same LAN I have multiple Linux servers which needs access to the networks behind each router. I have achieved this by configuring static routes on the server, pointing the different network prefixes to the correct router.

This has worked well, but every time we connect to a new remote VPN, we have to change all the servers to be aware that the network is now accessible via the VPN, and not via the default Internet route.

What I want is a way to automatically update the routes on all of the servers, when the route is added to a routers.

Now, I could install Quagga or something similar on all the servers to receive router advertisements, but that seems like overkill. So my question is what is the easiest/simpliest way to update the routing tables on the server automatically, and what protocol is best suited for this purpose.

thanks

share|improve this question
1  
Route on your routers, not your servers. –  Shane Madden Jun 22 '11 at 2:10
    
@Shane, yes that sounds the obvious approach!. So your suggestion is to delegate one of the routers as the default, and use that to forward to the correct router? It seems a extra hop when the traffic is aimed at the non-default router. –  bramp Jun 22 '11 at 2:12
2  
It's not an extra hop in the sense that the traffic destined for one of the other networks won't be forwarded by the default gateway to that network. If I'm not mistaken, the default gateway should issue an ICMP redirect to the host, directing the host to the preferred gateway for the network in question. The only time the default gateway will forward traffic is when it doesn't have a route for the network in question (an external network), in which case it will forward it to it's default gateway. –  joeqwerty Jun 22 '11 at 2:39
1  
My comment is based on the assumption that all of the routers have an interface connected to the same LAN subnet (as implied in your question). –  joeqwerty Jun 22 '11 at 2:53
    
I had wondered if ICMP redirects would come into play. Thanks for the info, if either of you form this as a question I'll award you the points. –  bramp Jun 22 '11 at 12:48

2 Answers 2

Configure a dynamic routing protocol on all of the routers and configure the servers (and any other hosts) to use the "main" router as their DG. The DG should then handle redirecting traffic to the appropriate router based on entries in the dynamic routing table.

It's not an extra hop in the sense that the traffic destined for one of the other networks won't be forwarded through the default gateway to that network. If I'm not mistaken, the default gateway should issue an ICMP redirect to the host, directing the host to the preferred gateway for the network in question. The only time the default gateway will forward traffic is when it doesn't have a route for the network in question (an external network), in which case it will forward it to it's default gateway.

My comment is based on the assumption that all of the routers have an interface connected to the same LAN subnet (as implied in your question).

share|improve this answer

Can you switch do layer 3 routing? You could create two vlans on the switch and just have the switch as the default route on the servers, then the switch has either static routes pointing to the three routers or even better use a dynamic routing protocol on the switch too (OSPF or EIGRP if Cisco). However depending on how you do the VPN connections it may not be very easy to redistribute these routes to a routing protocol. Static tunnels aren't that great, using a routing protocol over GRE/Ipsec is a much nicer solution but may not always be an option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.