Gentoo router -> two dhcp processes possible?

[turtles]

I am setting up a Gentoo firewall/router for two WAN's and two LAN's.
One of the LAN's lan0 will just be for a server that gets dedicated bandwith.
The other LAN eth0 will go to a few AP's and hub's and provide dhcp for the subnet.
wan0 is a slower static ip backup connection that may be changed to a wireless link.
wan1 is a cable modem that gets its ip from dhcp on the modem so its needs dhclient to listen for a ip address.
I would prefer to keep this ip address as static as possible and not have the dhcp client restart if the dhcpd server on eht0 restarts.
Is this possible?

I got part of it working a while back but could use some advice on getting dhcp be a client on wan1 and a server on eth0.
Also I would like /etc/init.d/dhcpd restart to not take down wan1 if possible

I tried copying /etc/innit.d.d/dhcpcd to /etc/init.d/dhcpd.eth0
and I added a line
[ ${SVCNAME} = "dhcpd.eth0" ]

I get

[szatox]

So, you want to run dhcpd as a relay? Maybe better simply bridge eth0 and wan1 so clients on eth0 can simply ask that ISP's dhcp directly?

If not, there is a solution with NATed network and dhcpd providing IP from it's own arbitrary pool rather than ISP's I have employed. Obviously you can have iptables redirect incoming traffic to your server.
My solution was to split NICs into 2 services. Some of those provide net, and some provide lan instead. My setup goes like this:
eth0 that provides net (by default)
some bridges for local network that privide lan (And do NOT provide net) - those setting must be put in /etc/conf.d/net
dhcpd needs lan (and does not need net)

So, I can:
restart eth0 to re-negotiate IP from provider
take down interfaces bridged to lan
and it will not take down dhcpd. Only taking down a bridge providing lan will.
Only taking down the bridge itself will take dhcpd down, but bridge does not "need" interfaces it enslaves.

Deppending on stuff you keep around it might be easier to have local network provide net and replace (or remove) service provided by wan interfaces. Perhaps it would be fine if you simply added wan interfaces to boot runlevel to ensure they come up before launching default. I tried the "cleaner" or "more consistent" solution - adding lan service - and i'm not sure it was worth the effort.

[turtles]

I like your bridging idea, I am trying to load balance two network access points to two lans.
Here i drew a sketch of the network:
http://pastebin.com/SVShzB3f

There are 2 Wan gateways from two different ISP's
The Gentoo router will firewall and load balance the two lan's to the two wan gateways
and will provide normal router stuff on the lan eth0. I would like dhcpd to only run on eth0 assign ip's to eth0.
However wan1 is a standard residential cable modem and it is handed a dhcp address by the cable providers dhcp server.
So some type of dhclient is necessary there.
I dont want that reset if the eth0 network is restarted or dhcp is restarted
                                              

/etc/conf.d/net

[szatox]

One more thing came to my mind... How many IPs you can get from your ISP's dhcp? With this setup you need as many as servers in eth1 network +1 for router itself.


Ok, so here's a part of example config you could use. The less "consistent" but easier to manage.
/etc/conf.d/net, assuming your server network is on eth1:

[turtles]

[szatox]

You have a policy "acceptl" almost everywhere, so rules with accept do nothing. You might want to change it to drop for a little bit of extra protection.
Also, you do have ip forwarding enabled, don't you?

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

-A FORWARD -i lan1 -o lan1 -j ACCEPT # If packet is coming from lan1 and is going to lan1, forward it. You likely want to skip -o part

Forwarding with nat goes liek this:
iptables -A FORWARD -j ACCEPT -d 10.0.0.0/24 -m state --state ESTABLISHED,RELATED # Yup, damn old script. state has been replaced by conntrac, it doesn't change much.
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE

You might also be interested in redirecting traffic incoming to your router to another machine:
iptables -t nat -A PREROUTING -d XX.XX.XX.XX -p udp --dport 8767 -j DNAT --to-destination 10.0.0.3:8767
You might still need some extra rule to let that incoming traffic pierce your firewall (first packet is not related to anything your firewall knows and will likely be dropped unless you accept all)