Static NAT and multiple WAN (DSL) ports

Question

Hi,
we have a hardware router with 3 ADSL/SDSL lines. The SDSL has a range of public IP addresses.
We assigned these public IP adresses as DMZ to the hardware router, and added some of the IP's as secondary IP addresses on the BM's public interface. Filters have been disabled for testing, and we could ping the secondary IP's from the internet.
In the next step, we set up a static NAT to a server in the private LAN, which should be reached from travelling users. Pinging the natted address from the internet reached the server (seen with etherreal), but BM did not set the public IP as the source of the ping reply.
For testing, we set a static route on the BM to the PC on the internet, using the DMZ as default gateway, which was used for testing, and that worked fine.
Is there a chance to get the reply from the natted Server back to the DMZ, where the request came from? Setting static routes isnt possible, because users come with changing IP addresses.
Detlef

Answer 1

In article <[email protected]>, Pinkel wrote:
> Is there a chance to get the reply from the natted Server back to the
> DMZ, where the request came from? Setting static routes isnt possible,
> because users come with changing IP addresses.
>
This is a routing issue, with a possible workaround.
When the BMgr server gets a packet it needs to route, it's going to look
in its routing tables to know which interface to send it from, and which
IP address will be the next hop. Traffic coming inbound will naturally
leave the private interface and route normally to the internal address.
Traffic going back to the internet is another matter.
Traffic from the internet is, naturally, going to have a public IP
address that will not be in the BMgr server's routing tables, unless you
put in a static route. If the destination address for a packet is not
in the BMgr routing table, it will send the packet to the only choice it
has: the default route. Thus, all outbound non-static-nat'd traffic
will end up going out the default route.
I have used, on occasion, a workaround that forces traffic coming in
from one link to go back out that link. If you think of how BMgr
(NetWare) is routing replies to these packets, you realize that the only
way it is going to go back out link B (if link A is the default) is if
the packet actually comes from the address for link B. The way I've
made this happen is to enable dynamic NAT on the link B address. (For
instance, Cisco router with link B, totally different subnet - due to
isp changeover - from link A. Link A was the default. Enabled NAT with
overload on link B LAN address, and BMgr then saw all packets coming in
from that router as local packets simply coming from the link B LAN
address. So it replied to link B. However, all outbound (non-reply)
traffic to the internet still went out link A. I've also configured a
second internet link for VPN only usage, but that was no more than a
static route entry.)
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***