Re: Two gateways on same network

[Hans du Plooy <koffiejunkielistlurker@koffiejunkie.za.net>]

On Thu, 2006-12-07 at 11:32 -0500, Roberto C. Sanchez wrote:
> On Thu, Dec 07, 2006 at 04:57:03PM +0200, Hans du Plooy wrote:
> > Hi guys,
> > 
> > I'm setting up a Debian antispam mail relay.  I have two gateways on the
> > network (two separate internet connections):
> > 
> > 4mbit ADSL = 192.168.1.6
> > 128k line = 192.168.1.1
> > 
> > Both have NAT firewalls, both forward port 25 to the Debian box.  I'm
> > trying to do the following:
> > 
> > Always use 192.168.1.6 as the default gateway, except when:
> > 
> > 1.  Connections are received via 192.168.1.1.  Because if it doesn't
> > reply via the same gateway, the connection just times out.
> > 
> > 2.  192.168.1.6's connection goes down, for whatever reason.
> > 
> > So basically the leased line would be a backup MX.
> > 
> > I have put two network cards in, both with IPs on the same network, but
> > with different gateways specified in /etc/network/interfaces.  But for
> > some reason both try to use 192.168.1.1 as the gateway, regardless.
> > 
> > If the second network card is not necessary, that would be OK too.
> > 
> Use shorewall and read the Multi-ISP howto available on
> http://shorewall.net.

This is slightly different from what I'm trying to do - it deals with
two gateways on *different* networks, and with being a firewall/gateway.
My box is not a firewall/gateway, all it has to do is reply to the
interface it received a connection on.

I've done this before on SLES9, but the difference was there that the
gateway was the same for both interfaces.

I'm thinking something like this:

ip rule add from 192.168.1.18 table eth1
ip route add table eth1 via 192.168.1.1 dev eth1

Where eth0 is 192.168.1.17 with gateway 192.168.1.6 and 
      eth1 is 192.168.1.18 with gateway 192.168.1.1

This worked fine with two public IPs on the same network, with the same
gateway (colo provider gave me two IPs), but I'm not sure how being
behind two natting firewalls would impact this.  I also don't have
physical access to the box, so I've got to do it right first time :-)

Thanks
Hans