I have two ADSL modem-routers and a server all in the same statically-assigned IP address range (192.168.0.1/24).
Internet 1 -- (18.104.22.168) Modem 1 (192.168.0.1) -- Switch -- (192.168.0.3) Server Internet 2 -- (22.214.171.124) Modem 2 (192.168.0.2) -----/
Each of the modems forward ports to the server, e.g. ssh. This works on one modem but not the other. If I do a packet trace, the ssh packets arrive at the server and are returned via the default gateway, which may have a different external IP to the origin. If it does not match the origin, the response is thrown away and the ssh connection times out.
e.g. If the default gateway in the server is 192.168.0.1, then the ssh packets would take the following paths:
Request: SSH to 126.96.36.199 -> 192.168.0.1 -> 192.168.0.3 Response: 192.168.0.3 -> 192.168.0.1 -> 188.8.131.52 Result: WORKS! :-D Request: SSH to 184.108.40.206 -> 192.168.0.2 -> 192.168.0.3 Response: 192.168.0.3 -> 192.168.0.1 -> 220.127.116.11 Result: WRONG RESPONSE IP (18.104.22.168 != 22.214.171.124)
I understand from chatting with the people on IRC ##networking that what I want is "Source-Based Routing", a type of Policy Based Routing.
From what I can tell, a PBR looks something like:
access-list 1 permit 192.168.0.1 access-list 2 permit 192.168.0.2 ! interface async 1 ip policy route-map equal-access ! route-map equal-access permit 10 match ip address 1 set ip default next-hop 192.168.0.1 route-map equal-access permit 20 match ip address 2 set ip default next-hop 192.168.0.2 route-map equal-access permit 30 set default interface null0
I have spent many hours looking at tutorials and examples on this, but they don't seem to come near my needs. Specifically, I can't seem to understand:
- How the originating IP is matched to the response IP,
- The meaning of 'async' in the above example,
- If the above example is even remotely correct for my needs, and
- Where I should put this configuration on a standard Ubuntu Server?