dual wan tűzfal szabály

[Molnár Péter]

Hello!
Segitseget kernek.
Most probalkozom eloszor linuxos tuzfallal, igy nem igazan vagyok benne 
toppon.
Egy 2 ISP routert csinalnek eloszor.
A cel elso lepesben, hogy a benti gepek ki tudjanak menni a ket vonalon.
Ne ez nem sikerul tokeletesen.
Tovabbi cel, a kimeneti es bejovo szabalyok szigoritasa, de az mar egy 
kesobbi teendo.
eloszor az elsodleges cel kellene hogy menjen.

Szoval ha a lenti konfigban valaki lat hibat, akkor ne kimeljen...

A rendszer leirasa:
WAN1 (vertigo): 192.168.123.0/24, gw: 192.168.123.254
WAN2 (sulinet): 172.16.91.0/27, gw: 172.16.91.30
LAN: 10.0.0.0/8
Szerver cime: 10.1.1.143

Ubuntu 12.04
etc/network/interfaces tartalma:
auto lo
iface lo inet loopback
     up iptables-restore /etc/network/iptables

auto eth0 eth1 eth2
iface eth1 inet static
     address 192.168.123.139
     netmask 255.255.255.0

iface eth0 inet static
     address 10.1.1.143
     netmask 255.0.0.0
     dns_nameservers 10.1.1.8 10.1.1.3
     up ip rule add fwmark 1 lookup vertigo
     up ip rule add fwmark 2 lookup sulinet

iface eth2 inet static
     address 172.16.91.8
     netmask 255.255.255.224


/etc/network/iptables tartalma:
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
-A INPUT -s 10.0.0.0/8 -i eth1 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
:POSTROUTING ACCEPT
-A PREROUTING -j CONNMARK --restore-mark
-A PREROUTING --match mark --mark 1 -j ACCEPT
-A PREROUTING -i eth1 -j MARK --set-mark 1
-A PREROUTING --match mark --mark 2 -j ACCEPT
-A PREROUTING -i eth2 -j MARK --set-mark 2
-A PREROUTING -j CONNMARK --save-mark
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth2 -j MASQUERADE
COMMIT
*filter
:OUTPUT ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/8 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -s 10.0.0.0/8 -i eth0 -o eth2 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
COMMIT

ip route parancsok:
ip route add 192.168.123.0/24 dev eth1 src 192.168.123.139 table vertigo
ip route add default via 192.168.123.254 table vertigo
ip route add 172.16.91.0/27 dev eth2 src 172.16.91.8 table sulinet
ip route add default via 172.16.91.30 table sulinet
ip rule add from 192.168.123.139 table vertigo
ip rule add from 172.16.91.8 table sulinet
ip route add default scope global nexthop via 192.168.123.254 dev eth1 weight 5 nexthop via 172.16.91.30 dev eth2 weight 1
ip route flush cache



-- 

Udv:
Molnar Peter
http://www.petersoft.hu