The Case:-
We have a configuration similar to the following:-
WAN Link – 199.188.81.18 /29 – connected to the Leased Line
LAN link – 192.168.0.15 /24 – connected to the LAN core switch
Now, as our MX record, which is the only published service record on our ISP DNS, is 199.188.81.19, we added an “additional IP address” to the leased line interface with the IP 199.188.81.19, in order to guarantee there are no problems sending and receiving emails, especially when other mail server performs reverse MX lookup.
Than we added the following SNAT rule:-
Traffic selector: internal mail server address → SMTP→ Any
Source translation: Leased Line [MX-Record-WAN-IP] (Address) (199.188.81.19)
So, now our SMTP traffic will go out to the internet through the leased line interface with a source IP address of 199.188.81.19.
Now, as we are willing to add full redundancy to our internet connection we added a new ADSL line that is connected to the Astaro box with a configuration similar to the following:-
ADSL line – 144.23.99.6 /24 – DHCP but fixed and guaranteed by our ISP.
Failover Configuration
Now, by default traffic leaving this interface will have a source IP address of 144.23.99.6, which is fine for http traffic, however, for the same reason explained above we want also the SMTP packets leaving the ADSL line to a have source IP address of 199.188.81.19 which the IP of our MX record. We tried doing so but it did not work, as it seems to use an IP address in NAT the address must be bound to the interface through which the traffic will be forwarded, is this the case? Can’t we define a virtual address that is not bound to any interface and change the source of any packet leaving to the internet – whether through the ADSL or leased line – to that virtual address?
In addition, I do not really understand how NAT works on Astaro. I mean, I tried disabling all masquerading rules and all DNAT/SNAT rules and still able to reach the internet with the IP address of my WAN connection; how does this happen?
I highly appreciate your help guys.
Thnaks a lot
This thread was automatically locked due to age.
