The problem: client has three (3) ADSL interfaces, and a Linux mail server. The mail server now wants to do MailMan things, which implies having a web interface. Typing port numbers is too complicated for some of the people using the web interface <cringe>, but we can’t port-forward from tcp/80 on the primary/defaultroute ADSL interface because that already goes to a busy Win2k3 server which would be a PITA to securely set up to proxy the traffic, and we can’t just bolt the secondary or tertiary ADSL router into a second card on the mail server and forward stuff based on interface because they’re also busy with RDP traffic and need to be administered by someone without much of a Linux clue (and who is also seriously busy, so can’t take the time away from his other duties to pick up said clue, even though he’s otherwise quite a bright lad) and because the router might get replaced we can’t rely on MAC addresses either. Traffic forwarded to this box from the non-defaultroute interfaces would be returned through the default route which belongs to a different ISP, which would of course break some things.
The solution: get the tertiary router to port-forward port 80 to an IP alias on the mail server’s ethernet interface, and use iproute2 to answer all traffic to the alias back out through the tertiary router.
Defaultroute belongs to Swiftel, tertiary ADSL belongs to ArachNet, so step one is to add these two definitions to /etc/iproute2/rt_tables:
42 arachnet
43 swiftel
Defining 9.9.9.1 to be the defaultroute, 9.9.9.3 to be the tertiary router's LAN address, 9.9.9.100 to be the primary LAN address (eth0) of the mail server and 9.9.9.200 to be an alias (ie, the address given to eth0:0), set up two very simple iproute2 tables and two very simple rules to reference them:
ip route add default via 9.9.9.3 table arachnet
ip route add default via 9.9.9.1 table swiftel
ip rule add from 9.9.9.200 table arachnet
ip rule add from 9.9.9.100 table swiftel
The rules for swiftel are not strictly necessary since the ordinary “boring” routing rules would take care of it, but they allow the mail server to be seamlessly default-routed through the secondary ADSL router instread if so desired.
I don’t know if this is the very best way to do it, but it’s working and everyone here’s happy. (-:
Comments