1

I have a Vyatta router with eth0 and eth1 on the same network segment ex. 99.99.99.0/24 where eth0 is .1 and eth1 is .2 and this is the wan network segment.

The traffic to the default gateway is through eth0.

Also there is an internal network ex. 1.1.1.0/24 with an email server on it .10.

What I want to achieve is all the internal traffic to be NAT-ed through eth0 except the mail traffic wHich I want to be through eth1.

enter image description here

1 Answer 1

1

It's possible using Policy Based Routing (PBR).

But the fact you have 2 interfaces in the same network makes it difficult because you cannot choose witch interface the router will use to reach the next-hop and you can only specify it by IP (and not interface) in Vyatta PBR.

Why do you have both interface in the same LAN? It will cause many issues.

At least you could have one interface with IP in the 99.99.99.0/24 network and the other interface with IP in the 1.1.1.0/24.

Even if both are actually in the same network segment that would dramatically simplify the configuration...

Edit :

OK misunderstood where the 1.1.1.0/24 was placed. The question remains... why?

This is not a good setup. Whatever the reason behind having 2 interfaces in the same IP network is, there should be a better solution.

In this configuration I don't see how to achieve what you want.

If you set another network between Vyatta eth1 and your gateway (a /30 for example) , then you can do it.

Edit 2 following last comment :

If you want to have your email server NATed to a different IP, to avoid blacklisting, then it's easy to do without bothering with 2 interfaces. You don't even have to set the IP on the interface, it works with nat rules only.

1 - remove the configuration on eth1

2 - set your nat source rule like:

rule 10 {

 description "Mail server"
 outbound-interface eth0
 source
     address 1.1.1.10/32
 translation {
     address 99.99.99.2
 }

rule 20 {

 description "all other machines"
 outbound-interface eth0
 source
     address 1.1.1.0/24
 translation {
     address 99.99.99.1
 }

You can even specify only TCP port 25 in rule 10 (add "protocol tcp" and "source port 25")

Of course, the key point here is to have the NAT rule for the mail server having a lower number than the more generic network NAT.

3 - Set a nat destination rule like:

rule 10 {

 description "Mail server"
 inboud-interface eth0
 destination
     address 99.99.99.2
     port 25  #add 80/443/110/143 if needed
 protocol tcp
 translation {
     address 1.1.1.10
10
  • Yeah, a drawing of your network layout might help a lot to understand that very uncommon network layout...
    – xpac
    Feb 26, 2016 at 12:59
  • Here is the picture with the layout: network
    – rocordial
    Feb 26, 2016 at 13:17
  • see my edit. also you can edit the initial question to provide more details, and on Stack Exchange it's better to add relevant content in the post rather to link it to avoid broken link, so the content remains available to help futur users.
    – JFL
    Feb 26, 2016 at 13:36
  • Both 99... ips are on my isp network. The reason is if the 1.1.1.0 network has a virus (was a conficker in my case on an old xp sp2 box, now retired) and your main IP (99.99.99.1) get blacklisted then the mail server cannot send mail anymore. So I tried this solution. I'll try a differnet approach. Thank you!
    – rocordial
    Feb 26, 2016 at 13:47
  • see my last edit for how to do this.
    – JFL
    Feb 26, 2016 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.