Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256207 > unrolled thread

debian server with two public IPs

Started byfh@dnsbed.com
First post2023-03-20 08:40 +0100
Last post2023-03-20 11:30 +0100
Articles 8 — 5 participants

Back to article view | Back to linux.debian.user

Contents

  debian server with two public IPs fh@dnsbed.com - 2023-03-20 08:40 +0100
    Re: debian server with two public IPs <tomas@tuxteam.de> - 2023-03-20 09:30 +0100
    Re: debian server with two public IPs Stanislav Vlasov <stanislav.v.v@gmail.com> - 2023-03-20 09:50 +0100
      Re: debian server with two public IPs Jeremy Ardley <jeremy@ardley.org> - 2023-03-20 10:20 +0100
        Re: debian server with two public IPs <tomas@tuxteam.de> - 2023-03-20 10:30 +0100
          Re: debian server with two public IPs Jeremy Ardley <jeremy@ardley.org> - 2023-03-20 10:50 +0100
      Re: debian server with two public IPs fh@dnsbed.com - 2023-03-21 01:00 +0100
    Re: debian server with two public IPs Tim Woodall <debianuser@woodall.me.uk> - 2023-03-20 11:30 +0100

#256207 — debian server with two public IPs

Fromfh@dnsbed.com
Date2023-03-20 08:40 +0100
Subjectdebian server with two public IPs
Message-ID<Gbihz-dKhg-3@gated-at.bofh.it>
Hello list,

I have a networking question that I can't understand for.
I have the Debian 11 host with two ethernet cards.
There is public IP and gateway for each ethernet card.
(they are public IPs from two different net address blocks.)

Say:
eth0 ip: 193.36.132.10  gw: 193.36.132.1
eth1 ip: 5.255.106.10 gw: 5.255.106.1

The system's default gw is the first one (eth0).
When clients from outside access eth1 ip (such as HTTP access), they can 
reach there.
But, the returned packages from debian server to clients are always 
coming from eth0 gw.
I expect the returned package also come from eth1 gw (since clients are 
accessing eth1 address).

How can I setup this? Thanks for any hints.

regards
Corey H

[toc] | [next] | [standalone]

#256208

From<tomas@tuxteam.de>
Date2023-03-20 09:30 +0100
Message-ID<Gbj3X-dKOv-1@gated-at.bofh.it>
In reply to#256207

[Multipart message — attachments visible in raw view] — view raw

On Mon, Mar 20, 2023 at 03:23:15PM +0800, fh@dnsbed.com wrote:
> Hello list,
> 
> I have a networking question that I can't understand for.
> I have the Debian 11 host with two ethernet cards.
> There is public IP and gateway for each ethernet card.
> (they are public IPs from two different net address blocks.)
> 
> Say:
> eth0 ip: 193.36.132.10  gw: 193.36.132.1
> eth1 ip: 5.255.106.10 gw: 5.255.106.1
> 
> The system's default gw is the first one (eth0).
> When clients from outside access eth1 ip (such as HTTP access), they can
> reach there.
> But, the returned packages from debian server to clients are always coming
> from eth0 gw.
> I expect the returned package also come from eth1 gw (since clients are
> accessing eth1 address).
> 
> How can I setup this? Thanks for any hints.

Disclaimer: I haven't found the time to wrap my head around
that and actually run some tests. It's on my TODO. So take
this with two fists of salt.

You might want to play with /proc/sys/net/ipv4/conf/*/rp_filter [0] [1].

Cheers

[0] https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
[1] https://www.rfc-editor.org/rfc/rfc3704
-- 
t

[toc] | [prev] | [next] | [standalone]

#256209

FromStanislav Vlasov <stanislav.v.v@gmail.com>
Date2023-03-20 09:50 +0100
Message-ID<Gbjnj-dKVO-1@gated-at.bofh.it>
In reply to#256207
пн, 20 мар. 2023 г. в 12:33, <fh@dnsbed.com>:

> I have a networking question that I can't understand for.
> I have the Debian 11 host with two ethernet cards.
> There is public IP and gateway for each ethernet card.
> (they are public IPs from two different net address blocks.)
[...]
> When clients from outside access eth1 ip (such as HTTP access), they can
> reach there.
> But, the returned packages from debian server to clients are always
> coming from eth0 gw.
> I expect the returned package also come from eth1 gw (since clients are
> accessing eth1 address).

> How can I setup this? Thanks for any hints.
>

https://lartc.org/ will help you.
Exactly https://lartc.org/howto/lartc.rpdb.multiple-links.html
In my same setup i was add some 'up ip rule add ...' lines into
/etc/network/interfaces

-- 
Stanislav

[toc] | [prev] | [next] | [standalone]

#256210

FromJeremy Ardley <jeremy@ardley.org>
Date2023-03-20 10:20 +0100
Message-ID<GbjQl-dLln-5@gated-at.bofh.it>
In reply to#256209
On 20/3/23 16:39, Stanislav Vlasov wrote:
> пн, 20 мар. 2023 г. в 12:33, <fh@dnsbed.com>:
>
>> I have a networking question that I can't understand for.
>> I have the Debian 11 host with two ethernet cards.
>> There is public IP and gateway for each ethernet card.
>> (they are public IPs from two different net address blocks.)
> [...]
>> When clients from outside access eth1 ip (such as HTTP access), they can
>> reach there.
>> But, the returned packages from debian server to clients are always
>> coming from eth0 gw.
>> I expect the returned package also come from eth1 gw (since clients are
>> accessing eth1 address).
>
> https://lartc.org/ will help you.
> Exactly https://lartc.org/howto/lartc.rpdb.multiple-links.html
> In my same setup i was add some 'up ip rule add ...' lines into
> /etc/network/interfaces

I get the impression the problem is to send return traffic back out on 
the interface it came in on.

In that case I image connection tracking would be used but I'm not 
expert enough to suggest an optimal solution.

-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256212

From<tomas@tuxteam.de>
Date2023-03-20 10:30 +0100
Message-ID<Gbk01-dLoR-5@gated-at.bofh.it>
In reply to#256210

[Multipart message — attachments visible in raw view] — view raw

On Mon, Mar 20, 2023 at 05:15:57PM +0800, Jeremy Ardley wrote:
> 
> On 20/3/23 16:39, Stanislav Vlasov wrote:
> > пн, 20 мар. 2023 г. в 12:33, <fh@dnsbed.com>:
> > 
> > > I have a networking question that I can't understand for.
> > > I have the Debian 11 host with two ethernet cards.
> > > There is public IP and gateway for each ethernet card.
> > > (they are public IPs from two different net address blocks.)
> > [...]
> > > When clients from outside access eth1 ip (such as HTTP access), they can
> > > reach there.
> > > But, the returned packages from debian server to clients are always
> > > coming from eth0 gw.
> > > I expect the returned package also come from eth1 gw (since clients are
> > > accessing eth1 address).
> > 
> > https://lartc.org/ will help you.
> > Exactly https://lartc.org/howto/lartc.rpdb.multiple-links.html
> > In my same setup i was add some 'up ip rule add ...' lines into
> > /etc/network/interfaces
> 
> I get the impression the problem is to send return traffic back out on the
> interface it came in on.

If this is it, then rp_filter, as I proposed elsewhere in this
thread, seems like exactly made for this.

Cheers
-- 
t

[toc] | [prev] | [next] | [standalone]

#256214

FromJeremy Ardley <jeremy@ardley.org>
Date2023-03-20 10:50 +0100
Message-ID<Gbkjn-dLwr-9@gated-at.bofh.it>
In reply to#256212
On 20/3/23 17:21, tomas@tuxteam.de wrote:
>>
>> I get the impression the problem is to send return traffic back out on the
>> interface it came in on.
> If this is it, then rp_filter, as I proposed elsewhere in this
> thread, seems like exactly made for this.
>
I'm afraid poking kernel parameters is beyond my pay grade, but I can 
just about do a nat and firewall using iptables.

I was thinking it should be possible to use iptables to do connection 
tracking and return data on the incoming interface, or better, prefer to 
return on that but use the other interface if not possible


-- 
Jeremy
(Lists)

[toc] | [prev] | [next] | [standalone]

#256238

Fromfh@dnsbed.com
Date2023-03-21 01:00 +0100
Message-ID<GbxzY-dTKl-3@gated-at.bofh.it>
In reply to#256209
> 
> https://lartc.org/ will help you.
> Exactly https://lartc.org/howto/lartc.rpdb.multiple-links.html
> In my same setup i was add some 'up ip rule add ...' lines into
> /etc/network/interfaces

I finally resolved the issue with the helps of your article and this 
one:
https://blog.scottlowe.org/2013/05/29/a-quick-introduction-to-linux-policy-routing/

Thanks a lot.

[toc] | [prev] | [next] | [standalone]

#256215

FromTim Woodall <debianuser@woodall.me.uk>
Date2023-03-20 11:30 +0100
Message-ID<GbkW5-dLZw-5@gated-at.bofh.it>
In reply to#256207
On Mon, 20 Mar 2023, fh@dnsbed.com wrote:

> Hello list,
>
> I have a networking question that I can't understand for.
> I have the Debian 11 host with two ethernet cards.
> There is public IP and gateway for each ethernet card.
> (they are public IPs from two different net address blocks.)
>
> Say:
> eth0 ip: 193.36.132.10  gw: 193.36.132.1
> eth1 ip: 5.255.106.10 gw: 5.255.106.1
>
> The system's default gw is the first one (eth0).
> When clients from outside access eth1 ip (such as HTTP access), they can 
> reach there.
> But, the returned packages from debian server to clients are always coming 
> from eth0 gw.
> I expect the returned package also come from eth1 gw (since clients are 
> accessing eth1 address).
>
> How can I setup this? Thanks for any hints.
>
> regards
> Corey H
>
>

I use policy based routing and tag in iptables.

firewall17:~# ip rule show
0:      from all lookup local
10000:  from all fwmark 0x20000/0x20000 lookup T_2_0
20000:  from all fwmark 0x10000/0x10000 lookup T_1_0
32766:  from all lookup main
32767:  from all lookup default
firewall17:~#

firewall17:~# ip route show table T_2_0
default via 192.168.100.108 dev eth0
...
firewall17:~# ip route show table T_1_0
default via 192.168.9.2 dev tun2
...
firewall17:~# ip route show table main
default dev isp scope link
default via 192.168.9.2 dev tun2 metric 2048
...
firewall17:~#

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web