On Thu, 2011-08-11 at 09:46 -0400, Jamie Begin wrote: > I have a LAN that uses a T1 for Internet connectivity. The service > includes a firewall managed by the telco that provides MPLS > connectivity to remote offices, NAT rules to destinations inside the > LAN, and a few other things. I am trying to boost the Internet > bandwidth while avoiding the cost of having to install another T1 > circuit. A Comcast cable connection has recently been installed for > this purpose. > > Ideally, I'd like to drop in a Shorewall box between the LAN and the > managed firewall without having to change anything. It should be > invisible to the clients and to the managed firewall. However, the > bulk of the outgoing connections (from LAN clients) should be routed > out the Comcast interface. > > I've configured Shorewall to use dual ISPs before and I've used it > with two interfaces linked together in a bridge, but I haven't done > both of these things at the same time. Any tips, tricks, or gotchas? > Or maybe is there a better way to accomplish the goals? Thank you.
This will be tricky because what you really want is a bridge, while
Multi-ISP support only works on a router. So you will need to use Proxy
ARP.
Lets assume that on the Shorewall box:
eth0 = Interface to telco firewall
eth1 = Interface to Comcast cable modem (or Business Class
Gateway Router)
eth2 = Interface to LAN.
w.x.y.z = IP address of telco firewall
w.x.y.0/24 = Local LAN
w.x.y.q/32 = Address assigned to eth0
w.x.y.r/24 = Address assigned to eth2
You will need to configure a static host route to w.x.y.z/32 out of eth0
and make w.x.y.z the default gateway for the Shorewall box.
In /etc/shorewall/proxyarp:
#ADDRESS INTERFACE EXTERNAL HAVEROUTE
PERSISTENT
w.x.y.z - eth2 Yes Yes
If the telco firewall also provides DNS services for the LAN, then you
will have to run a DNS proxy or a DNS server on the Shorewall box.
Caution: If the telco firewall is providing any other broadcast-based
services (such as UPnP), then this scheme won't work.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
