[CentOS] Not firewall, but what?

[Jussi Hirvi]

>> I have two public networks here, 62.220.237.x and 62.236.221.x. I want
>> to build a xen system, where some guests connect to one network, some
>> guest to the other one, and some to both. To reduce cabling, I would
>> like to do this with only two nics.

On 10.5.2010 15.48, Les Mikesell wrote:
> How do you handle the default route on the 'connect to both' guests?  Normally
> you only want one default gateway and it should be the same one where the
> connections are coming in.  Otherwise you have to do some very tricky things to
> make return packets go back the same path they came in, although asymmetrical
> routes are supposed to work if you don't have NAT or stateful firewalls in the way.

On that dual-network xen-guest, I don't handle the routing in any 
special way. Now only one nw connection works (because of these routing 
problems), but if they would both work, packets still might leave from 
only one interface (default route). I don't see why this would be a 
problem, though, even if it may not be very elegant.

Here is "ip route show" from that host:

62.236.221.64/28 dev eth0  proto kernel  scope link  src 62.236.221.71
62.220.237.96/27 dev eth1  proto kernel  scope link  src 62.220.237.111
169.254.0.0/16 dev eth1  scope link
default via 62.220.237.126 dev eth1

- Jussi

-- 
Jussi Hirvi * Green Spot
Topeliuksenkatu 15 C * 00250 Helsinki * Finland
Tel. +358 9 493 981 * Mobile +358 40 771 2098 (only sms)
jussi.hirvi at greenspot.fi * http://www.greenspot.fi