Subject: multi-homed routing problems
To: None <netbsd-help@netbsd.org>
From: Paul Newhouse <newhouse@rockhead.com>
List: netbsd-help
Date: 10/02/1999 00:55:13
Platform i386.

I have a routing problem that I think can be solved with ipf but,
I don't know exactly how.  This is the configuration:


                  (Internet cloud)
                 /               \
                /                 \
               /                   \
              /                     \
             /                       \
          @home                   my DSL ISP
   24.1.4.193\                       /205.219.89.41 (FlowPoint Router)
              \                     /
               \                   /
                \                 /
       24.1.4.202\               /205.219.89.46
              ne0 \             /  de1
				  NAT         NAT
                  (NetBSD machine)
                         |
                     de0 | 172.16.89.45

    route add default 205.219.89.41
    route add -net 24 netmask 255.0.0.0 24.1.4.193


If I run netscape on the NetBSD machine and use the @home proxy (24. 
something) and then request a URL from 205.219.89.46 I see the requests 
come in on port 80 of 205.219.89.46.  Since I have a route for the 24 
net going out ne0 the responses to the proxy request go out the ne0 
interface.  So, the proxy gets responses that have been NAT'd to be from 
24.1.4.202 instead of 205.219.89.46.

I use an ipf statement:

   pass out log quick on de1 to ne0 from 24.1.4.202 to any

to make sure packets that came in the ne0 interface go back out that interface.
If I add the same kind of statement to route out the de1 interface it would
just defeat the route add for the 24 net.  

Even if I can figure out which requests going to the proxy I should leave 
as coming from 205.219.89.46, I'm pretty sure it would violate the @home AUP.
They'd claim I was running a server on their network (even though I have
port 80 blocked on ne0 and are saving them traffic thru their peering points).

Is there some way to get this to work the way I want or am I burnt toast
on this one?

TIA,
Paul