Estou usando um dispositivo roteador baseado em Linux (chamado Zeroshell), mas deve ser uma questão relacionada ao roteamento genérico do Linux.
O computador do roteador tem 4 NICs, chamadas ETH0 a ETH3.
- ETH0 está na LAN real (sub-rede 192.168.241.0/24) IP 192.168.241.254
- ETH1 está em um roteador de conexão WAN (sub-rede 192.168.1.0/24) IP 192.168.1.1, GW 192.168.1.254
- ETH2 está em outro roteador de conexão WAN (sub-rede 192.168.2.0/24) IP 192.168.2.1, GW 192.168.2.254
- ETH3 está em outra LAN dedicada para convidados (sub-rede 192.168.230.0/24) IP 192.168.230.254
O gateway padrão no roteador é definido como 192.168.2.254, portanto, todo o tráfego de saída usa a segunda conexão WAN (fibra ótica) e o NAT é ativado tanto na ETH1 quanto na ETH2.
No primeiro roteador WAN, 192.168.1.1 é definido como DMZ.
No segundo roteador WAN, 192.168.2.1 é definido como DMZ.
Eu configurei o encaminhamento de porta na porta 80 em ETH1 e ETH2 para um computador na sub-rede ETH0.
Ao conectar-se ao segundo IP público da WAN com um navegador, recebo o site hospedado no computador interno.
Ao conectar-se ao primeiro IP público da WAN com um navegador, a conexão permanece bloqueada.
Tenho certeza de que isso tem que lidar com o gateway padrão definido para o segundo roteador da WAN, fazendo com que todo o tráfego chegue até ele, mesmo que tenha se originado do primeiro roteador da WAN.
Então, minha pergunta é: COMO devo configurar as tabelas de roteamento em meu roteador para que ele possa manipular conexões de entrada de ambas as WANs, encaminhá-las para o computador da LAN relevante e rotear as respostas para a WAN adequada?
EDITAR:
Adicionando tabelas de roteamento do servidor Web:
root@webserver:/# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:15:5d:f1:03:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.241.23/24 brd 192.168.241.255 scope global eth0
valid_lft forever preferred_lft forever
root@webserver:/# ip route show
default via 192.168.241.254 dev eth0
10.8.0.0/24 via 192.168.241.21 dev eth0
192.168.240.0/24 via 192.168.241.21 dev eth0
192.168.241.0/24 dev eth0 proto kernel scope link src 192.168.241.23
Adicionando tabelas de roteamento do roteador:
root@rtr ~> ip addr show
1: lo: <LOOPBACK,UP,10000> mtu 65536 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: sit0@NONE: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
3: ETH00: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc mq qlen 1000
link/ether 00:15:5d:f1:05:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.230.254/24 brd 192.168.230.255 scope global ETH00:00
valid_lft forever preferred_lft forever
inet6 fe80::215:5dff:fef1:508/64 scope link
valid_lft forever preferred_lft forever
4: ETH01: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc mq qlen 1000
link/ether 00:15:5d:f1:05:09 brd ff:ff:ff:ff:ff:ff
inet 192.168.2.1/24 brd 192.168.2.255 scope global ETH01:00
valid_lft forever preferred_lft forever
inet6 2a01:e35:2e74:9560:215:5dff:fef1:509/64 scope global dynamic
valid_lft 86156sec preferred_lft 86156sec
inet6 fe80::215:5dff:fef1:509/64 scope link
valid_lft forever preferred_lft forever
5: ETH02: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc mq qlen 1000
link/ether 00:15:5d:f1:05:0b brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global ETH02:00
valid_lft forever preferred_lft forever
inet6 fe80::215:5dff:fef1:50b/64 scope link
valid_lft forever preferred_lft forever
6: ETH03: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc mq qlen 1000
link/ether 00:15:5d:f1:05:0c brd ff:ff:ff:ff:ff:ff
inet 192.168.241.254/24 brd 192.168.241.255 scope global ETH03:00
valid_lft forever preferred_lft forever
inet6 fe80::215:5dff:fef1:50c/64 scope link
valid_lft forever preferred_lft forever
7: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noqueue
link/ether 9e:3d:6a:0e:65:39 brd ff:ff:ff:ff:ff:ff
inet 192.168.141.142/24 brd 192.168.141.255 scope global dummy0
valid_lft forever preferred_lft forever
8: dummy1: <BROADCAST,NOARP,UP,10000> mtu 1500 qdisc noqueue
link/ether ee:6e:6f:33:32:34 brd ff:ff:ff:ff:ff:ff
inet 192.168.142.142/32 brd 192.168.142.255 scope global dummy1
valid_lft forever preferred_lft forever
inet6 fe80::ec6e:6fff:fe33:3234/64 scope link
valid_lft forever preferred_lft forever
9: DEFAULTBR: <BROADCAST,MULTICAST> mtu 1500 qdisc noop
link/ether 0a:61:ef:f2:09:80 brd ff:ff:ff:ff:ff:ff
10: VPN99: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 10 0
link/ether 1a:e8:0e:ee:78:aa brd ff:ff:ff:ff:ff:ff
inet 192.168.250.254/24 brd 192.168.250.255 scope global VPN99:00
valid_lft forever preferred_lft forever
11: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 8e:65:6c:3d:76:e5 brd ff:ff:ff:ff:ff:ff
12: bond1: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 1e:34:34:54:8d:48 brd ff:ff:ff:ff:ff:ff
13: bond2: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 5a:bc:4c:86:83:dc brd ff:ff:ff:ff:ff:ff
14: bond3: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 6e:81:53:3e:0a:ff brd ff:ff:ff:ff:ff:ff
15: bond4: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 6a:35:c8:45:d1:ff brd ff:ff:ff:ff:ff:ff
16: bond5: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether ca:5d:10:21:02:30 brd ff:ff:ff:ff:ff:ff
17: bond6: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 82:60:85:97:d4:90 brd ff:ff:ff:ff:ff:ff
18: bond7: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether b6:fc:c9:a5:06:73 brd ff:ff:ff:ff:ff:ff
19: bond8: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether ce:75:5d:e5:7d:69 brd ff:ff:ff:ff:ff:ff
20: bond9: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop
link/ether 2e:ef:1e:89:26:1b brd ff:ff:ff:ff:ff:ff
root@rtr ~> ip route show
default via 192.168.1.254 dev ETH02
192.168.1.0/24 dev ETH02 proto kernel scope link src 192.168.1.1
192.168.2.0/24 dev ETH01 proto kernel scope link src 192.168.2.1
192.168.230.0/24 dev ETH00 proto kernel scope link src 192.168.230.254
192.168.240.0/24 via 192.168.241.21 dev ETH03
192.168.241.0/24 dev ETH03 proto kernel scope link src 192.168.241.254
192.168.250.0/24 dev VPN99 proto kernel scope link src 192.168.250.254