Mail server behind Vyatta NAT with two WAN connections

Question

I have a Vyatta router with eth0 and eth1 on the same network segment ex. 99.99.99.0/24 where eth0 is .1 and eth1 is .2 and this is the wan network segment.

The traffic to the default gateway is through eth0.

Also there is an internal network ex. 1.1.1.0/24 with an email server on it .10.

What I want to achieve is all the internal traffic to be NAT-ed through eth0 except the mail traffic wHich I want to be through eth1.

Answer 1

It's possible using Policy Based Routing (PBR).

But the fact you have 2 interfaces in the same network makes it difficult because you cannot choose witch interface the router will use to reach the next-hop and you can only specify it by IP (and not interface) in Vyatta PBR.

Why do you have both interface in the same LAN? It will cause many issues.

At least you could have one interface with IP in the 99.99.99.0/24 network and the other interface with IP in the 1.1.1.0/24.

Even if both are actually in the same network segment that would dramatically simplify the configuration...

Edit :

OK misunderstood where the 1.1.1.0/24 was placed. The question remains... why?

This is not a good setup. Whatever the reason behind having 2 interfaces in the same IP network is, there should be a better solution.

In this configuration I don't see how to achieve what you want.

If you set another network between Vyatta eth1 and your gateway (a /30 for example) , then you can do it.

Edit 2 following last comment :

If you want to have your email server NATed to a different IP, to avoid blacklisting, then it's easy to do without bothering with 2 interfaces. You don't even have to set the IP on the interface, it works with nat rules only.

1 - remove the configuration on eth1

2 - set your nat source rule like:

rule 10 {

 description "Mail server"
 outbound-interface eth0
 source
     address 1.1.1.10/32
 translation {
     address 99.99.99.2
 }

rule 20 {

 description "all other machines"
 outbound-interface eth0
 source
     address 1.1.1.0/24
 translation {
     address 99.99.99.1
 }

You can even specify only TCP port 25 in rule 10 (add "protocol tcp" and "source port 25")

Of course, the key point here is to have the NAT rule for the mail server having a lower number than the more generic network NAT.

3 - Set a nat destination rule like:

rule 10 {

 description "Mail server"
 inboud-interface eth0
 destination
     address 99.99.99.2
     port 25  #add 80/443/110/143 if needed
 protocol tcp
 translation {
     address 1.1.1.10