PDA

View Full Version : Web surfing via a specific interface?



KBOYLE
22-Nov-2011, 08:16
My server is SLES11-SP1.

Interface-1 is my primary Internet access and default gateway. It's an
ADSL link at 5 Mbs with static IP's. I get a call from the Cable company
with an offer I can't refuse. Now I have a second Internet connection at
25 Mbs with a single dynamic IP address. I have a spare nic in the
server so interface-2 now connects to the Cable company.

The idea was to use interface-2 for web surfing but I can't see any way
to route only port 80 and 443 traffic. /etc/sysconfig/SuSEfirewall2
allows me to specify the subnets and ports to forward but it doesn't
seem to allow me to specify a particular interface.

How do I direct traffic to a particular interface based on port number?


--
Kevin Boyle
If you find this post helpful, please click on the star below!
------------------------------------------------------------------------
KBOYLE's Profile: http://forums.novell.com/member.php?userid=19359
View this thread: http://forums.novell.com/showthread.php?t=448538

amo vzug
22-Nov-2011, 14:46
Maybe possible with:

Code:
--------------------

# iptables -t nat -A PREROUTING -d 'IP of eth1' -p tcp --dports 80,443 -j DNAT --to 'IP of eth2'.

--------------------


Regards,
Tom


--
amo_vzug
------------------------------------------------------------------------
amo_vzug's Profile: http://forums.novell.com/member.php?userid=25342
View this thread: http://forums.novell.com/showthread.php?t=448538

ab
22-Nov-2011, 15:03
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This may be tricky. You're talking about doing routing at layer 3 (IP)
based on data at layer 4 (TCP) which is encapsulated in IP and,
therefore, not really cared-about by the layer 3 stuff. Your default
gateway would be the easiest thing to change to get things going over
the Cable-based connection and then you could do the few things that
need the other connection some other way. If it's all inbound traffic
of some sort (SSH, VPN, whatever) that you want to do over the other
interface with the static IP then that may work easily. Knowing more
about those services may help. Most of the time layer 4 switches tend
to be dedicated devices that are doing switching based on the
destination port and they only do it for a couple of destinations (LDAP
servers for example). I've also heard of people in a situation like
yours that basically use one connection until it dies and then failover
to the other one.

Good luck.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJOy6tmAAoJEF+XTK08PnB5u58P/jtdTt9+dObaQyQEy+cqjY+U
eEESjkZUNyMVSLZYcJVF+0mDvk013JAQ3BAvQzC3WU2FAlGiup hdakFZP8ZKVgZU
wLl/Bx7We0wfwAByrw+vs2i3QOylbD+FG/s/tcLbnaHhZKUx+vZRQMR3FP+JcHMb
yoF1pBezGRoOAjGenjYRER/Zufvoxha8PYmAoEWw+R2mRw4sRbUzEEtLmeCIxyGb
ykZSQaywmSNS89Nc4kj2xkpEZqnclB8MVPtaQa6G1UVIudg9Gk SAEIbi6qU3WTnP
NeG70dSQb4V6Eb18VWEq0bPMwkWPbns08zukSfwG2OrweLiLXW tfGBep7x4fYm8o
6Be3eDzhL84ZxeQvBAaijdETF/N+UfGpjE/A8DQcm822rEHokwuYisr5ZSpGmg65
H74NDdxrFUGL8Sva+WCW/geVC8uLn2ZKjZsY+VwppCq81+2Hon/mH85DQR/7UF5N
uU95u5I+REO/n9gwLOe+O+JlwLsU+hBjzRWd4hbLxwnDmRcFHJUohvC/Rs5nLbLR
zG6AGbkHOI8yZRYZmRxRaBGh9hQ2hUl9i4wXNP21egUNWxaqI6 6ZEnAj2D3lBQEf
lj1ALCmmpM1ed6MkPyQJEhmpzVCiAzEHi/duOpNwRcho63IqepflEgHiOfrOh6HM
T3efMC3t86DPxvb3kLow
=BBj6
-----END PGP SIGNATURE-----

KBOYLE
22-Nov-2011, 17:16
ab;2155569 Wrote:
>
> This may be tricky.
Hi Aaron,

I've worked with a dual interface router and had issues with traffic
incoming via ISP #1 and the response sent via ISP #2. It does get messy,
especially when the ISP #2 interface uses NAT. I had hoped to keep this
relatively simple by only using the Cable ISP for surfing.

I think this will require a bit more research. :-(


--
Kevin Boyle
If you find this post helpful, please click on the star below!
------------------------------------------------------------------------
KBOYLE's Profile: http://forums.novell.com/member.php?userid=19359
View this thread: http://forums.novell.com/showthread.php?t=448538

KBOYLE
22-Nov-2011, 17:26
amo_vzug;2155557 Wrote:
> Maybe possible with:
> >
Code:
--------------------
> >
> # iptables -t nat -A PREROUTING -d 'IP of eth1' -p tcp --dports 80,443 -j DNAT --to 'IP of eth2'.
--------------------
> >
>
> Regards,
> Tom
Hi Tom,

So far, I have been able to use the SuSEfirewall2 config file to
configure my firewall. I've read a bit about iptables and suspected that
at some point I would need to understand it better. It looks like that
day has arrived...

Thanks for the tip!

Kevin


--
KBOYLE
------------------------------------------------------------------------
KBOYLE's Profile: http://forums.novell.com/member.php?userid=19359
View this thread: http://forums.novell.com/showthread.php?t=448538

KBOYLE
24-Nov-2011, 00:36
amo_vzug;2155557 Wrote:
> Maybe possible with:
> >
Code:
--------------------
> >
> # iptables -t nat -A PREROUTING -d 'IP of eth1' -p tcp --dports 80,443 -j DNAT --to 'IP of eth2'.
>
--------------------
> >
>
> Regards,
> Tom
Here's what I tried and the results I got.

Code:
--------------------
# iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dports 80,443 -j DNAT --to 222.222.222.222
iptables v1.4.6: unknown option `--dports'
--------------------



Code:
--------------------

# iptables -t nat -n -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

# iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dport 80 -j DNAT --to 222.222.222.222
# iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dport 443 -j DNAT --to 222.222.222.222
# iptables -t nat -n -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- 0.0.0.0/0 111.111.111.111 tcp dpt:80 to:222.222.222.222
DNAT tcp -- 0.0.0.0/0 111.111.111.111 tcp dpt:443 to:222.222.222.222

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.254.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0
MASQUERADE all -- 192.168.253.0/24 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

#

--------------------


Observations:

- I don't understand the need for the duplicate MASQUERADE entries. I
would think a single entry for each of the subnets should do. I
suspect it is just the way that SuSEfirewall2 generated the rules...
- The new entries to the PREROUTING chain have no effect. All
outbount packets are via 111.111.111.111.
- I don't understand what DNAT refers to.
- After a few minutes the nat table reverts back to the original
version without the additional entries to the PREROUTING chain. Do you
know why this might happen?


Do you have any additional suggestions?

Kevin


--
KBOYLE
------------------------------------------------------------------------
KBOYLE's Profile: http://forums.novell.com/member.php?userid=19359
View this thread: http://forums.novell.com/showthread.php?t=448538

jmozdzen
02-Dec-2011, 12:46
Hi Kevin,

is running a squid proxy on the machine an option? Then you might want
to look at the tcp_outgoing_address option (an make sure your proxy will
only listen on an internal interface, like 127.0.0.1 if all requests
origin on the sam machine - http_port option)...

Regards,

Jens


--
from the times when today's "old school" was "new school" :eek:
------------------------------------------------------------------------
jmozdzen's Profile: http://forums.novell.com/member.php?userid=32246
View this thread: http://forums.novell.com/showthread.php?t=448538

KBOYLE
03-Dec-2011, 01:26
jmozdzen;2158140 Wrote:
> Hi Kevin,
>
> is running a squid proxy on the machine an option? Then you might want
> to look at the tcp_outgoing_address option (an make sure your proxy will
> only listen on an internal interface, like 127.0.0.1 if all requests
> origin on the sam machine - http_port option)...
>
> Regards,
>
> Jens
Hi Jens,

This is a firewall machine. Most requests will originate from somewhere
on the LAN although some could/will originate from this server.

I'm relatively new to Linux with only a few years under my belt. I have
yet to play with a squid proxy or delve into iptables, both of which are
on my to do list.

I don't think it is too unusual these days to have a second ISP for
backup or load balancing. I have configured a Netgear FVS336G dual WAN
router/firewall for a customer. It provides load balancing and fail-over
but creating rules is very time consuming and the device has throughput
limitations. In my area, the cable company is offering 100 megabit
service which can tax many small routers. I would think a SLES firewall
should be able to provide the capabilities I need and accommodate the
higher throughput. I'm surprised this issue hasn't come up before...

I suspect iptables might be the solution. I'll just have to make some
time to learn a bit more about it. If anyone is interested, I can
recommend a good book. It's well organized and easy to read but there is
a lot of material to digest...

'Novell Press Books - Linux Firewalls, Third Edition '
(http://www.novell.com/training/books/book.html?book=bookAdm&val=2)

Thank you for your input.


--
Kevin Boyle
If you find this post helpful, please click on the star below!
------------------------------------------------------------------------
KBOYLE's Profile: http://forums.novell.com/member.php?userid=19359
View this thread: http://forums.novell.com/showthread.php?t=448538