SNAT with Multiple ISPs

Hi, Aaron, and welcome to the UTM Community!

It's not possible to use a Multipath rule to send traffic out a specific IP on an interface.

You shouldn't need to manually enable or disable anything if I understand your scenario.  What you want is to bind specific traffic primarily to an interface and then use SNAT or Masquerading to send from a specific IP.

If you'd like more help, please be more specific with one example of specific traffic and DNAT/SNAT rules.  Pictures work!

Cheers - Bob

OK great! Here is one simple example of my NAT configuration for a separate VPN appliance.

So basically, I have my backup ISP rules on the top, but disabled. If I have a failure of my primary ISP, I enable them so everything works fine.  I cant have the rule on, because if its at the top of the list, my outbound traffic would get sent out the backup connection every time. If the rule is on, but at the bottom of the list, I don't think the rule would ever catch, even if my primary ISP was down (there is no option in the NAT rule to skip if interface is down, like in the multipath rules.

Masquerading I have not messed with except for my original rule that was created when we installed the firewall. Basically all my internal networks are routed out uplink interfaces

What am I missing? That would be fantastic if I can make this process automated.

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

BAlfson said:

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

 

I finally had some time to test your configuration out. It looks like it is working! I disabled the SNAT and replaced with two masquerading rules (one for my primary ISP and one for the secondary).

The DNATS are for inbound. I suppose I could have left those on for the secondary connection. It just felt wrong having the DNATS on and the SNATS off :-) They are on now.

My only thing I want to confirm is that if my primary ISP fails, the second masquerading rule will automatically be used? My fear would be the UTM will timeout on the first rule and never get to the second rule.

I also took a look at your cleanup tips. Good stuff! There always a ton of different ways to accomplish the same result. Some ways are better than others. It is rather elegant to lock down the NAT, and use an automatic firewall rule vs. leaving the NAT wide open and creating a manual firewall rule. That way you only have one place to look when you are troubleshooting/making changes.

The change from one link to the other is accomplished by Uplink Balancing.  The last thing that happens before a packet leaves an interface is Masq/SNAT (see the image at the bottom of the Rulz post).

Cheers - Bob

Great thank you very much! I will need to schedule a time to test everything, but it appears everything should work.