On Thu, Jun 18, 2015 at 12:45 PM, Marius Petrescu <marius(a)yo2loj.ro> wrote:
I see it this way:
- 44 hosts should communicate only with other 44 hosts via tunnels
Okay. I'm have to assume that you're speaking about your specific case and
not in general. If you want to treat your assigned 44net public IPs as
private IPs instead, that's totally up to you and I don't think anyone
would/should give you grief about that. I had the impression that we were
originally talking about how to configure a gateway in a general sense for
most users.
- to communicate with the internet as originating
hosts, they shall use
ISP_GW's public IP using masquerade. It makes no sense to add load to
ampr-gw unless you really need to land in the internet with a 44 address
instead of your GW_IP. Why does this bother you? Google and Facebook
doesn't
care.
It doesn't bother me at all. It's perfectly reasonable to decide you want
to NAT your [Assigned44LAN -> InternetHosts] traffic out your ISP address.
I just had no idea that you were trying to use your network that way.
You still need your 'to 44.0.0.0/8 use table 44' for
44 targets to be dispatched by table 44.
No, even with your configuration, you still don't need that rule. Your
gateway host will never be an intermediate routing hop between various 44
nets. Therefore, the 'from <Your Assigned 44 net> use table 44' will still
make that use-case work just fine.
What you don't need is the default route in table
44 directing all unknown
44 traffic to the ampr-gw, which is the cause of this behavior. Not the
rule, the route in table 44.
I have to disagree with you there. The alternate 0/0 default route has a
perfectly valid use-case for those who don't want to make their assigned IP
space private-only.
And for your access from the internet you need a way
to get 'from
Assigned44LAN to ! 44.0.0.0/8' via the ampr-gw tunnel.
One solution would be the one described 2 days earlier, a second custom
routing table (for which I use the 'default' table).
Another possibility would be to drop the usage of table 44 and put all
routes to table 'main'.
Then the rules are not needed for 44/44 traffic.
Only the part relating to the reply to incoming non-44 connections via
ampr-gw, which need 2 rules to work.
Wait... I thought you were using NAT/PAT/Masquerade for your [Assigned44LAN
-> InternetHosts] traffic??? Why would you then talk about sending those
packets to ampr-gw? What exactly are you trying to accomplish with all
this added complexity?