Server with two default gateways won’t listen on the second gateway

gatewayroutingtcpip

I am testing a redundant internet connection setup that works like this –

I have a network segment, 192.168.80.X
It has two gateways –
192.168.80.1 – a FW connected to a frame relay line
192.168.80.2 – an ADSL modem/router

I set up a windows server with a static ip 192.168.80.10, subnet 255.255.255.0 and two default gateways – 192.168.80.1, 192.168.80.2 and set the metrics manually to give the frame relay line preference.

Both routers have port forwarding set up to forward port 80 from the WAN address to the server.

The problem is that when the default gateway selected by windows is 192.168.80.1, it won't accept incoming connections coming from the ADSL router, and vice-versa – if the gateway selected is 80.2 then connections coming to the WAN address of the FW don't get through.

Is this kind of setup even theoretically possible? If it is, I assume it's a routing issue that needs solving? Perhaps adding a route manually to the server/WAN routers?

I'm not networking-savvy enough to figure it out on my own.. some help will be appreciated.

Thanks!

Best Answer

It isn't that the incoming connection isn't coming it, it's that the routing table thinks that the return trip should go through the default gateway.

You should really consider splitting this off into 2 different subnets for the LANs between each WAN device and the server's NICs. That would be the proper way to handle this, and if it is a direct connection between the server NIC and a port on the "gateway" then something as simple as a /30 would work for each "route".

Use 2 different NICs in the Windows Server, each on their respective subnets and respective default gateways to each of these WAN devices. But you'd still have to manually fail over the gateway in the routing (disable one nic for instance during normal operation, and then enable it and disable the other during failover. It would all be manual).

I don't know if RRAS and dead gateway detection might work here...never used it myself, but you may look into it too.

Related Solutions

Linux – Handling Connections from Multiple Gateways

It is possible, and quite easy to setup. We will use iproute2 and iptables MARK and CONNMARK for this.

The idea is we will mark packets comming in from the second gateway (not the default gateway the server is using), and on reply we will route these packets out the same interface.

Suppose the IP address of the second gateway is 2.2.2.2 and the interface on the server connected to the gateway is eth2.

First let's set up a routing table for the second gateway (we use table 20 for this):

# ip route add default via 2.2.2.2 table 20

And set a rule that says packets marked with 200 will get routed using table 20:

# ip rule add fwmark 200 table 20

You can verify using:

# ip route list table 20
# ip rule list

Now using iptables we mark packets comming in from second gateway (in interface eth2) with mark 200:

1 # iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
2 # iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
3 # iptables -t mangle -A PREROUTING -i eth2 -j MARK --set-mark 200
4 # iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

For more explanation on how these MARK and CONNMARK work, see here

If 2 of your gateways are on the same network, and your server using only one interface to connect to both of them, then definitely the iptables command number 3 above will not work. You can use another, based on MAC address like this:

# iptables -t mangle -A PREROUTING -m mac --mac-source AA:BB:CC:DD:EE:FF -j MARK --set-mark 200

Of course, AA:BB:CC:DD:EE:FF is the MAC address of the second gateway.

Firewall – pfSense router on a LAN with two gateways

If you setup your whole setup something like this:

New WAN |  
         --> pfSense --> LAN
ADSL    |

so the pfSense gets 2 internet connections.

The above setup should work without too many problems, as the servers will now only have one gateway to use.

Best Answer

Related Solutions

Linux – Handling Connections from Multiple Gateways

Firewall – pfSense router on a LAN with two gateways

Related Topic