Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 4 subscribers
  • Views 13557 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to route inbound and outbound traffic over additional address

jflex

Hello,

I have 5 external IPs, and I would like to route all traffic for a specific server over one of the IPs.

I have tried it with DNAT and SNAT but every time I check the outside ip on the server, it still comes back at the primary.

How do I make it so I can set devices to use an additional address for outbound and inbound. I can only set inbound through DNAT at the moment.

--------

EDIT:

It seems like I was able to get only 1 single VLAN to communicate out over one of my additional addresses. I setup a masquerade for VLAN_300(Network) -> External (WAN_2).

Now if I try to assign another VLAN a different IP in the same fashion, that vlan fails to resolve webpages.

Here is how I have my network Setup

Interfaces:

External (WAN) on eth0 - 1.2.3.78/21

Internal on eth1 -         10.0.1.1/24

VLAN_100 on eth1  -10.0.2.1/24

VLAN_200 on eth1  -10.0.3.1/24

VLAN_300 on eth1  -10.0.4.1/24

VLAN_400 on eth1  -10.0.5.1/24

Additional Addresses: 

WAN_2 - 1.2.3.79/32  on eth0

WAN_3 - 1.2.3.80/32  on eth0

WAN_4 - 1.2.3.81/32  on eth0

WAN_5 - 1.2.3.82/32  on eth0

I created a host definition group called "LANS"  and added All of the networks to it. (internal, vlan100, 200, 300 and 400).  I added LANS to allowed networks in DNS and NTP.

Firewall Rules.

LANS -> Any -> Any  - Allow

Internal Network \

Vlan_100 Network \

Vlan_200 Network  -   -> Any -> LANS   - Allow

Vlan_400 Network /

NAT Rules

Masquerading:

Internal -> External WAN

VLAN_100 -> External WAN_4

VLAN_200 -> External WAN_5

VLAN_300 -> External WAN_2

VLAN_400 -> External WAN

------

After doing all of this, I was able to successfully use VLAN_300 on another WAN_2. But all other vlans will not go outside the network.



This thread was automatically locked due to age.
Parents
  • 0

    Hi Jaesii,

    Masquerading should work with: VLAN -> Interface eth0 -> Use address another external.

    But: IP Range 1.2.3.78/21 ??? Did you mean /29?

    The additional addresses should created with the same subnet. /32 won't route to the gateway defined in eth0.

    Nathan

  • 0 in reply to NvA
    I have a dynamic IP, and the netmask my firewall picked up was a /21. I've actually tried punching in a bunch of random ips within that range and they all seem to work. I just picked 5 and set them as additional addresses.

    One of my co-workers suggested setting up an SNAT for SERVER > ANY > Internet v4 Change source to WAN_#

    I tried to set it up this way since I would like one sever on the same VLAN to have a different ext ip from the rest on that VLAN. It seemed to work for a while then would just stop working all together. Masquerading the VLAN seems like the only way I can route traffic over another ext ip.
Reply
  • 0 in reply to NvA
    I have a dynamic IP, and the netmask my firewall picked up was a /21. I've actually tried punching in a bunch of random ips within that range and they all seem to work. I just picked 5 and set them as additional addresses.

    One of my co-workers suggested setting up an SNAT for SERVER > ANY > Internet v4 Change source to WAN_#

    I tried to set it up this way since I would like one sever on the same VLAN to have a different ext ip from the rest on that VLAN. It seemed to work for a while then would just stop working all together. Masquerading the VLAN seems like the only way I can route traffic over another ext ip.
Children
No Data