Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I searched a lot about the question, but can't find solution for my situation.

We've got a Windows 2003 server that runs Advantage Database Server (ADS) through which our site connects to our accounting system. The site connects to static IP 82.xxx.xxx.147, runs several queries and disconnects. And does it every 5 minutes. Server has 2 NICs - one is for the site (192.168.5.1), another is for local network (192.168.0.1). Server connected to internet via ADSL modem/router (LAN IP 192.168.5.9), router's NAT is configured to forward port 45677 to the server.

Everything works fine, except for one thing - internet connection is not stable enough. So we got another ADSL connection with another IP address 178.xxx.xxx.181 and also forwarded that port to the server. Second modem/router's LAN IP is 192.168.5.3.

Our site is checking IP address 82.xxx.xxx.147 and if it's not responding, it tries another IP 178.xxx.xxx.181. But it doesn't connect. It looks like server rejects connections from the second router.

I tried to add second router's IP 192.168.5.9 as a second gateway in advanced TCP/IP settings of to server NIC's. But it doesn't help.

I understand, that it's something connected with routes, but I can't understand anything in those masks, metrics, gateway IPs. It's too tough for me.

I don't want the server to use any of the gateways for internet access (browser and other services). I just want it to receive incoming connections from both gateway IPs from fixed port number. Is that possible?

share|improve this question
2  
Short answer is that Windows can't do this. there is nothing you can do in Windows. Some Dual-WAN routers can do some NAT or stateful connection tracking magic on incoming connections to make this work. If your current routers are running Linux or can be re-flashed to run-Linux you can also apply the right magic. –  Zoredache Dec 27 '13 at 0:45
    
Just a thought, when you added 192.168.5.9, did you update the forward on the second router to forward to 192.168.5.9? I've never tried what you are trying, so Zoredache may be right. –  BillN Dec 27 '13 at 1:09
1  
@BillN You mean, did I update NAT record in second router to forward this port to 192.168.5.1? Yes. I also tried to forward port 45677 in router 192.168.5.3 to 192.168.5.9, but it didn't help either. –  pablomedok Dec 27 '13 at 22:52
    
From memory it's all to do with source routing. I don't think windows can do it. The easiest fix is to insert a router such as those from Mikrotik that can handle multiple default gateways appropriately. –  Matt Dec 29 '13 at 21:20
add comment

2 Answers

up vote 0 down vote accepted

Unless I have misunderstood your design, which I believe could be described with less ambiguity:

So your site has a really good internet connection. It connects to another place on the internet where your accounting is taken care of. This other place has two internet connections, one public address each, due to poor internet uptime. Both of these public addresses should be usable by your site to reach your accounting system on its local address. The accounting system has only one active default route which points to either but not both of its internet connection routers. It is unaware of the state of the routers.

You could either go redundant appliance configured as a HA pair with (for example) internal VRRP set to failover on external link loss and dual WAN support, as stated in another answer.

Or perform source address rewriting (aka Source NAT or snat), whereby your server will perceive that the client is a local address rather than a remote address. Therefore it will not use its default route to communicate with your site, but either of your snat:ing router interfaces (either the traffic came from 192.168.5.3 or from 192.168.5.9). This assuming that your routers are capable of doing snat on incoming connections.

If they can't you could configure intermediary devices (one per router, default routing that-a-way) which can. This technique is commonly used by load balancers in order to short-circuit the default route which the internal server(s) would otherwise use, instead of replying through the load balancer(s) which one commonly wants.

So if your routers aren't up to the task you could get cheap load balancers or use free software (two solutions in one link) as intermediaries. Or use state-of-the-art stuff, but somehow this seems like not that kind of scenario.

share|improve this answer
    
Thank you, @ErikE. Your advice about sNAT worked fine for me. It is much simpler as VRRP/HSRP and our firewall is able to do it. Actually, I've tried sNAT and different load balancing options of it before that, but I didn't do both sNAT and NAT mapping. –  pablomedok May 16 at 21:14
add comment

You need a server accepting incoming requests via 2 redunant routers with 2 WAN Interfaces. This is a typical HSRP/VRRP setup. One router will run as HSRP Active router, i.e. primary WAN for incoming and outgoing traffic. 2nd router will run as HSRP Standby router. There are 2 cases that will make a Standby router become the Active router, either when the Active router is Down, and does not respond to Standby router, OR, when Active router downgrades it's priority due to it's WAN link is Down. Now, about the default gateway, in order to work, HSRP gives you a Virtual Default Gateway IP Address, that you will configure on your server, which makes the dual router setup transparent to the server, i.e. server does not know that their are 2 routers running, as it is always using the virtual ip address for it's default gateway. The HSRP Active router always responds to the virtual IP. Look for HSRP/VRRP support on your routers. Check also the VRRP RFC http://tools.ietf.org/search/rfc5798.

share|improve this answer
    
While Active/Passive is one way to solve this, and HSRP is a Cisco proprietary solution implementing interface failover, it's certainly not the only way to solve the issue. There are Active/Active solutions as well. –  Chris S Dec 29 '13 at 21:35
    
active/active mean load sharing on the wan, noting that the objective here is to backup the unstable link. VRRP is not propriety and can be used same as HSRP. –  aseaudi Dec 29 '13 at 22:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.