From owner-freebsd-questions@FreeBSD.ORG Fri Nov 16 13:54:33 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6390316A41A for ; Fri, 16 Nov 2007 13:54:33 +0000 (UTC) (envelope-from iaccounts@ibctech.ca) Received: from pearl.ibctech.ca (pearl.ibctech.ca [208.70.104.210]) by mx1.freebsd.org (Postfix) with ESMTP id 0A05A13C46A for ; Fri, 16 Nov 2007 13:54:32 +0000 (UTC) (envelope-from iaccounts@ibctech.ca) Received: (qmail 81067 invoked by uid 1002); 16 Nov 2007 13:54:21 -0000 Received: from iaccounts@ibctech.ca by pearl.ibctech.ca by uid 89 with qmail-scanner-1.22 (spamassassin: 2.64. Clear:RC:1(208.70.104.100):. Processed in 6.512264 secs); 16 Nov 2007 13:54:21 -0000 Received: from unknown (HELO ?192.168.30.110?) (steve@ibctech.ca@208.70.104.100) by pearl.ibctech.ca with (DHE-RSA-AES256-SHA encrypted) SMTP; 16 Nov 2007 13:54:14 -0000 Message-ID: <473DA109.6020707@ibctech.ca> Date: Fri, 16 Nov 2007 08:54:17 -0500 From: Steve Bertrand User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <6ae50c2d0711152118h2f2a9989q2b39eba077154041@mail.gmail.com> <20071116063832.GB4164@saraswathy.susmita.org> In-Reply-To: <20071116063832.GB4164@saraswathy.susmita.org> X-Enigmail-Version: 0.95.5 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: multihome network X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Nov 2007 13:54:33 -0000 Girish Venkatachalam wrote: > On 00:18:42 Nov 16, alexus wrote: >> Hello, >> >> I have two NICs on my box, one (primary) connected to switch and have >> private IP. that IP also have a static route on Cisco PIX for >> accessing this box from outside. the other interface has public IP >> that is connected to another switch, i configure both IPs through >> /etc/rc.conf, but I can not for some reason access my box through that >> public IP, no firewall rules would prevent me from doing so. here is >> my output for netstat -rn >> -- snip > Your default route is 192.168.1.1 and not 216.112.241.24 Yes, but if he changes that, then he won't be able to access the box via the PIX (private) connection. I will make these assumptions, then elaborate: The box in question is at your office. You are at home trying to access it. The connection works by connecting to the public IP of the PIX (that gets port-forwarded back), but does not work when accessing the direct Internet facing port. I'm willing to bet that if you run a tcpdump on your machine at home you are attempting the connection to the 216.112.241.x IP, you will actually find that the machine is getting back to you just fine. However, many OS's will drop a 'spoofed' packet. Essentially what is likely happening is this: - you send from home a packet to 216.112.241.x. - the office router/box accepts it - the office router looks up in it's routing table a path back to your home IP - it has no particular route, so it sends it out the default gateway (192.168.1.1) - your pc at home notices that the packet was sent to a destination IP, but it came back from a different one (the outside IP of the PIX) - the packet is dropped as the source address is spoofed There are a couple ways to fix this. The first and easiest is if you are only trying to connect to this box's public IP from one location, add a static route on the office box to that network that routes to it's public upstream The other way is to utilize policy-based routing. IPFW can do this, and (from what I understand) so can PF. (In Cisco-land, you would use a route-map). Steve