Slashdot Mirror

How do multiple external ip addresses cause an issue? I've been able to successfully have plenty of external ip addresses, and more particularly, multiple internet connections each with its own WAN and or CIDR block.

The trick to the former (multiple ips, one internet connection) is really managing via subinterfaces. Firewall rules to deal with the packets associated are pretty easy. This lets you DNAT things into the appropriate place via iptables. If you want to actually build a DMZ, you could use a proxy arp setup like this: http://www.sjdjweis.com/linux/proxyarp/

As for multiple internet connections, look into multiple routing tables via the ip command. Example:
ip route add default via table 100

Then use ip rule statements to choose when to use the particular route tables:
ip rule add to table 100
ip rule add from table 100

You can also pretty simply setup multiple SNAT rules to SNAT traffic over each link for different purposes. This lets you do things like SNAT to a specific host (read: internet connection) based on protocol, internal source address or destination. Handy for lots of things.

One nice thing to do with multiple internet connections is to have verbs in your firewall script that will allow you to manually failover your internet connection if one goes down. This obviously doesn't help external entities trying to reach hosts that sit in your DMZ on a failed connection, but it can let you continue to work with outgoing traffic while the problem is resolved.

If you're slick, you have your DNS hosted externally and you can then use this to update DNS for the DMZ to an alternate zone which specifies those public facing hosts as existing on the internet connection you just did a failover to. Make sure your A record TTL values are low.

This leads to a reconfiguration of the DMZ unless you have done full SNAT/DNAT mappings for each DMZ host in the firewall. Doing so can be a lot more work, but you can build a set of symmetric (or controlled in a script by a variable) configurations that swap out the DMZ nat rules so that they exist for one specific internet connection or the other.

I have my doubts that it will. The older POWER-based IBMs were MCA machines, which, doesn't work yet, and NetBSD efforts aren't much better. Your best bet is to keep AIX on that box for a bit longer until the porting effort bears fruit.

I wrote a small portion of an implementation of this. I'm almost ashamed of it, but you can find it on my site.

I don't worry too much about vibration for mine. I have it in a case in my trunk. Once my dsl comes back up, you can see it here.

It works fairly well, but I've only used it up to around 15 gigs.

I wish some of this cooperation would result in the release of specs for the older RS/6000 machines. I guess releasing an lvm system is more sexy than documentation on 5 year old machines.

A linux port is beginning at http://www.sjdjweis.com/linux/rs6k/, but there's very little there so far.

You've inspired me to make my own thing at http://www.sjdjweis.com/linux/730t/