Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[lingnau]

Hello everyone.
I've been reading a lot of topics but didn't come to solution. Actually, i have a few doubts.

I have a DFL with one public IP on interface WAN1 and 5 public ip's on WAN2.

I've managed to create a VLAN on the DMZ interface and publish a http server with SAT/Allow rules. (Straightforward actually)
I've also managed to publish the same server on the first IP of the WAN2 interface, but as my routing rules are

WAN1 metric 80
WAN2 metric 85

i had to make a routing rule to "force" the use of WAN2 for returnin traffic, and it worked.

Now I need to publish a second public ip on the WAN2 interface and publish the http server on this second IP. I've read a few topics and they all tell me to publish the ARP entry, sometimes add a "core" route to the new IP, but I'm not pretty sure about the exact setup. Any tips?

A few screenshots:

The rules for the VLAN interface. Both work.


My main routing table. WAN1 has lower metric.


My return routing table set by the routing rule.


The routing rule (HTTP81VLAN2)

[danilovav]

To add (publish) an IP, you need perform 2 steps
1) Interfaces > ARP - add ARP publish on interface
2) Routing > Routing tables > main - add route core add_ip 0
If you want to add new subnet on interface, you also need to add subnet route like wannet or lannet

After, i would recommend you to change your PBR rules to pass all inbound traffic from wan2 thru this interface - make it like wan2/all-nets, any/all-nets. If will affect additional IPs also.

[lingnau]

Danilo, thanks for the reply.

I will try this monday.

Just one answer tough, my route "Retorno_WAN2" that is used by the PBR, does have an IP adress (SVC-WAN2_IP).
After publishing an additional IP (WAN2_IP2), wouldn't the route need to have the IP adress of the returning IP set(WAN2_IP2)?

[danilovav]

You don't need to change route
Just, make more PBR with additional wan2 IP or change existing PBR in according with my recommendation

[lingnau]

Thank you danilovav, it worked like a charm.

I did exactly what you suggested. Here are some screenshots of the working config for anyone who migh need it in the future.

The routing rule (PBR).


The route used by the PBR rule.


The ARP publish:


The main route with the added entry:


The SAT/Allow rule.


Thanks again danilovav. You're great.