SNAT with Multiple ISPs

Hi, Aaron, and welcome to the UTM Community!

It's not possible to use a Multipath rule to send traffic out a specific IP on an interface.

You shouldn't need to manually enable or disable anything if I understand your scenario.  What you want is to bind specific traffic primarily to an interface and then use SNAT or Masquerading to send from a specific IP.

If you'd like more help, please be more specific with one example of specific traffic and DNAT/SNAT rules.  Pictures work!

Cheers - Bob

OK great! Here is one simple example of my NAT configuration for a separate VPN appliance.

So basically, I have my backup ISP rules on the top, but disabled. If I have a failure of my primary ISP, I enable them so everything works fine.  I cant have the rule on, because if its at the top of the list, my outbound traffic would get sent out the backup connection every time. If the rule is on, but at the bottom of the list, I don't think the rule would ever catch, even if my primary ISP was down (there is no option in the NAT rule to skip if interface is down, like in the multipath rules.

Masquerading I have not messed with except for my original rule that was created when we installed the firewall. Basically all my internal networks are routed out uplink interfaces

What am I missing? That would be fantastic if I can make this process automated.

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

Some other observations about this...

I like to use UDP instead of TCP for the SSL VPN.  It should speed up the tunnel and leaves TCP 443 available for web access by the target device.

I like to keep my configurations compact and tidy, so I use Automatic firewall rules wherever I can.  Rather than use the "Any" service in a DNAT and then regulate access with a firewall rule that only allows the port used by the SSL VPN, I would restrict the DNAT to just that service needed and select auto rules.

Finally, I've seen very talented CCIEs make a mess of a UTM configuration because they'd never done one before. ("How hard can it be?")  The answer is that WebAdmin is a GUI that manipulates databases of objects and settings.  A single change there can cause the Configuration Daemon to rewrite hundreds of lines of the code used to run the UTM.  It's difficult to get a healthy design to start with and difficult to change any design in the future.

Cheers - Bob

Thank you Bob! I didn't have time to check this out today, but I will soon. I will post my results.

BAlfson said:

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

 

I finally had some time to test your configuration out. It looks like it is working! I disabled the SNAT and replaced with two masquerading rules (one for my primary ISP and one for the secondary).

The DNATS are for inbound. I suppose I could have left those on for the secondary connection. It just felt wrong having the DNATS on and the SNATS off :-) They are on now.

My only thing I want to confirm is that if my primary ISP fails, the second masquerading rule will automatically be used? My fear would be the UTM will timeout on the first rule and never get to the second rule.

I also took a look at your cleanup tips. Good stuff! There always a ton of different ways to accomplish the same result. Some ways are better than others. It is rather elegant to lock down the NAT, and use an automatic firewall rule vs. leaving the NAT wide open and creating a manual firewall rule. That way you only have one place to look when you are troubleshooting/making changes.

BAlfson said:

That's what I expected, Aaron.  You can indeed accomplish your goal automatically.

Replace the two SNATs with Masq rules at the top of the rule list:

1. PVS-VPN01 -> ISP-Verizon [          ]
2. PVS-VPN01 -> ISP-Comcast [          ]

You only use SNATs with multiple ISPs when dealing with traffic that goes through a Proxy.  Say you're using Web Filtering.  You would have a Masq rule like '3. Internal (Network) -> Uplink Interfaces'.  The Proxy automatically assigns the primary address of an Interface as the source of a packet, so you would need NAT rules like:

1. SNAT : ISP-Verizon (Address) -> Web Surfing -> Internet : from ISP-Verizon [           ] (Address)
2. SNAT : ISP-Comcast (Address) -> Web Surfing -> Internet : from ISP-Comcast [           ] (Address)

I'm confused about the need for the DNATs.  Either you can leave both activated or you don't need either one.

Cheers - Bob

 

I finally had some time to test your configuration out. It looks like it is working! I disabled the SNAT and replaced with two masquerading rules (one for my primary ISP and one for the secondary).

The DNATS are for inbound. I suppose I could have left those on for the secondary connection. It just felt wrong having the DNATS on and the SNATS off :-) They are on now.

My only thing I want to confirm is that if my primary ISP fails, the second masquerading rule will automatically be used? My fear would be the UTM will timeout on the first rule and never get to the second rule.

I also took a look at your cleanup tips. Good stuff! There always a ton of different ways to accomplish the same result. Some ways are better than others. It is rather elegant to lock down the NAT, and use an automatic firewall rule vs. leaving the NAT wide open and creating a manual firewall rule. That way you only have one place to look when you are troubleshooting/making changes.

The change from one link to the other is accomplished by Uplink Balancing.  The last thing that happens before a packet leaves an interface is Masq/SNAT (see the image at the bottom of the Rulz post).

Cheers - Bob

Great thank you very much! I will need to schedule a time to test everything, but it appears everything should work.