Re: Dual WAN set-up

[Andrew Beverley <andy@xxxxxxxxxxx>]

Thanks for the comprehensive answer Lloyd. A couple of minor points:

> 2. You would set up a custom routing table for the special DMZ traffic.
>   Use the info in the above link to do that.  Suppose it is called
> "DMZSPECIAL".  You will set up routing to the new DMZ interface using
> the MYDMZ table, something like this:
> 
> 	ip route add 10.x.x.x/8 dev ${DMZinterface} src ${wan} table DMZSPECIAL
> 	ip route add default via ${gateway} dev ${interface} table DMZSPECIAL
> 

[...]

> 3. You would NEW mark all packets from the special DMZ hosts with
> fwmark 1, like this (repeat for each source IP or subnet to use the new
> interface):

Using marks is one way to do this, and provides plenty of flexibility.
However, if all the traffic is coming from the same IP address /
interface, then you should be able to use straight iproute2 rules to
match those aspects, without even touching iptables (see ip rule).


> 	iptables -t mangle -A PREROUTING -m state --state NEW
> -s 10.x.x.x -j CONNMARK1
>

Also, if you do decide to use netfilter marks (which is certainly no bad
thing IMHO), then you probably don't need to mark connections and then
restore them. Instead just mark a packet straight away:

iptables -t mangle -A PREROUTING -s 10.x.x.x -j MARK --set-mark 1

Andy


--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html