송주환 2018-11

PBR을 적용하셔야 합니다.

닥터D 2018-11

PBR 예제들이 라우팅 테이블을 static으로 구성을 하더라구요...
WAN들은 유동아이피일텐데말이죠...

송주환 2018-11

Routing Table을 dynamic IP로 설정하는 것은 불가능한 것으로 알고 있습니다.
적어도 Edgerouter에서는요.

송주환 2018-11

다시 확인해 보니 interface 설정이 가능하네요. protocol - static - table - <num> - interface-route

닥터D 2018-11

set interfaces ethernet eth1 description LAN1
set interfaces ethernet eth1 address 192.168.10.1/24
set interfaces ethernet eth2 description LAN2
set interfaces ethernet eth2 address 192.168.11.1/24
set interfaces ethernet eth3 description WAN1
set interfaces ethernet eth3 address dhcp
set interfaces ethernet eth4 description WAN2
set interfaces ethernet eth4 address dhcp
set service dhcp-server disabled false
set service dhcp-server shared-network-name LAN1 authoritative enable
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 start 192.168.10.2 stop 192.168.10.254
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 default-router 192.168.10.1
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 dns-server 1.1.1.1
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 dns-server 1.0.0.1
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 lease 86400
set service dhcp-server shared-network-name LAN2 authoritative enable
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 start 192.168.11.2 stop 192.168.11.254
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 default-router 192.168.11.1
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 dns-server 1.1.1.1
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 dns-server 1.0.0.1
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 lease 86400
set protocols static table 11 interface-route 0.0.0.0/0 next-hop-interface eth3
set protocols static table 12 interface-route 0.0.0.0/0 next-hop-interface eth4
set firewall modify PBR_policy rule 20 description WAN1
set firewall modify PBR_policy rule 20 source address 192.168.10.0/24
set firewall modify PBR_policy rule 20 modify table 11
set firewall modify PBR_policy rule 30 description WAN2
set firewall modify PBR_policy rule 30 source address 192.168.11.0/24
set firewall modify PBR_policy rule 30 modify table 12
set interfaces ethernet eth1 firewall in modify PBR_policy
set interfaces ethernet eth2 firewall in modify PBR_policy

이렇게 설정을 했는데 되지를 않네요...

송주환 2018-11

SNAT 설정은 해주셨나요? 그리고 next hop distance를 1로 맞춰주십시오

닥터D 2018-11

SNAT으로 설정하려니 불가능한듯 보여서 masq로 설정을 했습니다.
DNS쿼리를 못하고 있어서 DNS설정도 바꾸었습니다.
내부 네트워크간 통신은 되는데요, 인터넷은 여전히 안되네요...

set system offload hwnat enable
set system offload ipsec enable
set interfaces ethernet eth1 description LAN1
set interfaces ethernet eth1 address 192.168.10.1/24
set interfaces ethernet eth2 description LAN2
set interfaces ethernet eth2 address 192.168.11.1/24
set interfaces ethernet eth3 description WAN1
set interfaces ethernet eth3 address dhcp
set interfaces ethernet eth3 dhcp-options name-server no-update
set interfaces ethernet eth4 description WAN2
set interfaces ethernet eth4 address dhcp
set interfaces ethernet eth4 dhcp-options name-server no-update
set service dhcp-server disabled false
set service dhcp-server shared-network-name LAN1 authoritative enable
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 start 192.168.10.2 stop 192.168.10.254
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 default-router 192.168.10.1
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 dns-server 192.168.10.1
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 lease 86400
set service dhcp-server shared-network-name LAN2 authoritative enable
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 start 192.168.11.2 stop 192.168.11.254
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 default-router 192.168.11.1
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 dns-server 192.168.11.1
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 lease 86400
set protocols static table 11 interface-route 0.0.0.0/0 next-hop-interface eth3 distance 1
set protocols static table 12 interface-route 0.0.0.0/0 next-hop-interface eth4 distance 1
set firewall modify PBR_policy rule 20 description WAN1
set firewall modify PBR_policy rule 20 source address 192.168.10.0/24
set firewall modify PBR_policy rule 20 modify table 11
set firewall modify PBR_policy rule 30 description WAN2
set firewall modify PBR_policy rule 30 source address 192.168.11.0/24
set firewall modify PBR_policy rule 30 modify table 12
set interfaces ethernet eth1 firewall in modify PBR_policy
set interfaces ethernet eth2 firewall in modify PBR_policy

set service dns forwarding listen-on eth1
set service dns forwarding listen-on eth2
set service dns forwarding name-server 1.1.1.1
set service dns forwarding name-server 1.0.0.1
set system name-server 127.0.0.1
set service dns forwarding cache-size 300
set system domain-name home.local
set service dhcp-server shared-network-name LAN1 subnet 192.168.10.0/24 domain-name area1.home.local
set service dhcp-server shared-network-name LAN2 subnet 192.168.11.0/24 domain-name area2.home.local

set service nat rule 5010 description 'masquerade for WAN1'
set service nat rule 5010 outbound-interface eth3
set service nat rule 5010 type masquerade
set service nat rule 5010 protocol all
set service nat rule 5010 source address 192.168.10.0/24
set service nat rule 4010 description 'masquerade for WAN1'
set service nat rule 4010 inbound-interface eth3
set service nat rule 4010 type destination
set service nat rule 4010 protocol all
set service nat rule 4010 inside-address address 192.168.10.0/24
set service nat rule 4010 destination address 192.168.10.0/24

송주환 2018-11

마스커레이드 룰은 outbound-interface만 설정하면 됩니다. NAT rule 4010은 지우시고요..

그리고 PBR 설정하신 뒤 라우팅 경로는 정상적으로 잡히는지, 게이트웨이와의 통신은 가능한지 점검해 보시구요.

닥터D 2018-11

라우팅 경로가 정상적으로 안잡히는것같습니다.
[기존공유기]---[ER-X]---[셋팅PC]
+---[다른PC]
이렇게 연결해두고 셋팅설정중인데요,
셋팅PC에서 기존공유기나, 다른PC로 연결은 잘됩니다.
nslookup으로 www.google.com쿼리하면 IP도 잘 찾습니다.
하지만 인터넷으로는 빠져나가지를 못하네요

masq룰은 아래처럼 변경하였습니다.
set service nat rule 5010 description 'masquerade for WAN1'
set service nat rule 5010 outbound-interface eth3
set service nat rule 5010 type masquerade
set service nat rule 5010 protocol all

송주환 2018-11

1. WAN2는 마스커레이딩 안하시는지요
2. 세팅(테스트)장비의 IP는 어떻게 되시는지요.
3. Routing Table과 default route의 메트릭 값은 어떻게 되어 있는지요
4. 로드 밸런싱도 한다고 하셨는데 관련 세팅을 하셨는지, 아니면 하지 않은 것인지요

닥터D 2018-11

1. WAN2는 우선 WAN1 설정이 끝나면 그후에 하려고 하는중입니다.
2. 테스트장비IP는 DHCP로부터 임대받아서 192.168.10.2 입니다.
3. er-x에서 표시되는 routing table을 말씀하시는건지 아니면 세팅PC에서 route print햇을때 보여지는걸 말씀하시는건가요?
4. 로드 밸런싱 역시 WAN1->WAN2->로드밸런싱 순으로 셋팅을 하려고 아직 유예중입니다.

송주환 2018-11

혹시나 했는데 ARP 문제가 맞군요..
인터페이스에서 Proxy ARP를 활성화해주면 동작하겠지만, ARP Entry 문제가 생길 가능성이 있어 보입니다.
Next-hop-address를 사용하거나 더 나은 방법을 찾아봐야 할 것 같습니다.

닥터D 2018-11

아... 결국은 그렇다면 ER-X 상위에 트래픽 패스쓰루용 공유기를 각각 하나씩물려주고 next-hop-address로 라우팅을 잡아줘야되려나보네요 ㅠㅠ