From owner-freebsd-net@FreeBSD.ORG Thu Jul 12 10:53:21 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 64CA016A469 for ; Thu, 12 Jul 2007 10:53:21 +0000 (UTC) (envelope-from ml@netfence.it) Received: from parrot.aev.net (parrot.aev.net [212.31.247.179]) by mx1.freebsd.org (Postfix) with ESMTP id E02D413C45A for ; Thu, 12 Jul 2007 10:53:20 +0000 (UTC) (envelope-from ml@netfence.it) Received: from soth.ventu ([151.77.235.121]) (authenticated bits=128) by parrot.aev.net (8.14.1/8.13.8) with ESMTP id l6CAQEGp057351 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Thu, 12 Jul 2007 12:26:21 +0200 (CEST) (envelope-from ml@netfence.it) Received: from alamar.ventu (alamar.ventu [10.1.2.18]) by soth.ventu (8.14.1/8.13.8) with ESMTP id l6CAF01x009717 for ; Thu, 12 Jul 2007 12:15:01 +0200 (CEST) (envelope-from ml@netfence.it) Message-ID: <4695FEF4.4030708@netfence.it> Date: Thu, 12 Jul 2007 12:14:12 +0200 From: Andrea Venturoli User-Agent: Thunderbird 2.0.0.4 (X11/20070617) MIME-Version: 1.0 To: freebsd-net@freebsd.org Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.61 on 212.31.247.179 Subject: Again two ADSL lines, routing problems X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Jul 2007 10:53:21 -0000 Hello. I have a setup where a FreeBSD box is connected to two ADSL routers: default gateway is set to the first and, in case of failure, is moved to the other one. This works perfectly for outgoing connections: in the event of the switch, I'll have to reconnect, but that's acceptable. The problem is in the incoming connections: if I get one on the "backup" router, this will reach the server, which will however answer through its "default" router. Thus the remote client will see packets coming back from a different host and things won't work. Just to be clear, the packets travel as follows (with source and dest IP in brackets): Client (x.x.x.x) -> Backup router (y.y.y.y) Backup router (x.x.x.x) -> Server (z.z.z.z) Server (z.z.z.z) -> Default router (x.x.x.x) Default router (v.v.v.v) -> Client (x.x.x.x) So the client (x.x.x.x) connects to y.y.y.y (the backup ADSL public IP), but gets answers from v.v.v.v (the master ADSL public IP). AFAIK there is no solution to this, but I tought I'd ask before giving my official opinion to my customer. Perhaps there's some sort of hack we could use, that through ipfw/natd/other diverting daemon/whatever delivers answers based on the MAC address of the incoming connections (if the MAC address belongs to the backup router, use that for answers)... does anyone know? bye & Thanks av.