0

We have a network on its own AS with 2 routers connected to 2 AS via BGP (full routes).

The routers also both have a firewall on board that by default drops all traffic, except the one allowed. We allow traffic to specific ports on specific IP addresses to be forwarded, but nothing else.

There's also a rule that defines any connections opened by our servers should be tracked and return packets are allowed for those connections.

This all works fine as long as the outgoing and incoming traffic for a single connection is going through the same uplink, but when a connection attempt from a server to a remote host is sent outgoing on 1 link, but the return packet comes from the other link, the router logically won't forward it.

Does anyone have any suggestions on how we can resolve this ?

1 Answer 1

4

As you figured out, doing stateful firewalling on external links doesn't work well if you're multihomed. Typically, you either do stateless firewalling on external links, or place the firewall behind the routers so you don't have to deal with asymmetric routing.

3
  • I'm not sure how placing the firewall behind the routers would solve the issue, since you'd need 2 firewalls for redundancy and you'd be back to the same situation ? Unless I'm missing something ?
    – wimg
    May 20, 2023 at 23:36
  • 1
    Those firewalls are typically in an active/standby setup, so all traffic flows through one firewall.
    – Teun Vink
    May 21, 2023 at 0:05
  • Right... sadly that would complicate things quite a bit in our setup. Then again using stateless firewalling isn't ideal either...
    – wimg
    May 21, 2023 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.