Source-based routing and DNAT
Fri, 14 Jun 2002 16:31:35 -0700
Ok, first of all, I know that this question has been asked before, and
I've seen some of the workarounds, but as far as I have read, this
problem apparently remains unsolved.
I have a firewall with two internet connections. I use source-based
routing as described in the section 4.2.1 of the Advanced Routing &
Traffic Control HOWTO to ensure that the correct next-hop is chosen for
outgoing packets. This much works well.
The problem arises when I use a DNAT'ed connection to an internal
webserver. Using tcpdump I see that the syn+ack packet from the
webserver is un-NAT'ed correctly, but sent to the wrong next hop.
Something happens that prevents my "ip rule" from triggering.
Please do not reply and tell me that I can simply use a different
internal IP address to correspond to the different external IP address.
This is the "common workaround" and it is not acceptable for my purposes.
Does anyone have the right answer to this? Does "PREROUTING" not mean
pre-routing? Or is the ip rule that selects a route table run before
Even if the answer is, "it can't be done", can anyone definitively say
so and why?
Thanks for your great work guys!