Firewall functions: IPTABLES
U
SER
G
UIDE
190
You can set up to 4 different links, distinguishing them by different group numbers. These ones will
not be active at the same time but will enable when the default one is not available. In fact, the
keyword
default
states that it must be the first interface to be used.
If you then want to remove the previous command use:
set stfl-nat no-multicast Default group 3781 mcast-address 225.0.0.50 interface eth1 source 10.1.1.1
and if you were using UDP, the command will be
set stfl-nat no-peer 192.168.0.2 udp port 3780 interface eth1.100 source 192.168.0.1
Other useful commands are:
set stfl-nat commit
this one copies the connection tracks to the kernel
set stfl-nat resync
force the re-synchronization of the connection tracks
set stfl-nat primary
and
set stfl-nat backup
must be associated to some triggers on the up and down event of the VRRP module.
See the below example, that clarifies better how to use the commands:
VRRP Master Router:
set loopback 0 ipaddr 10.11.4.39
set loopback on
set eth0 ipaddr 10.11.4.117 netmask 255.255.255.0 broadcast 10.11.4.255
set eth0 on
set eth1 ipaddr 10.1.1.1 netmask 255.255.255.0 broadcast 10.255.255.255
set eth1 on
set vrrp 11 vmac
set vrrp 11 interface eth1
set vrrp 11 priority 150
set vrrp 11 delay 1
set vrrp 11 vipaddr 10.1.1.254
set trigger vrrp 11 up logger vrrp 11 up
set trigger vrrp 11 up set stfl-nat primary
set trigger vrrp 11 down logger vrrp 11 down
set trigger vrrp 11 down set stfl-nat backup
set vrrp 11 on
set iptables -A POSTROUTING -t nat -o eth0 -j SNAT --to-source 10.11.4.39
set stfl-nat mode multicast
set stfl-nat multicast Default group 3781 mcast-address 225.0.0.50 interface
eth1 source 10.1.1.1
set stfl-nat on
VRRP Backup Router
