[LARTC] Routing with two gateways and e-mail traffic

Linux Advanced Routing and Traffic Control

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I have following problem with multiple gateways.
Question is: why e-mail traffic goes throught eth2? I want to pass all
e-mail traffic throught eth0 (10.48.32.1) without multiple connections
to the same destination through ONLY ONE gateway. Is it possible to
switch off load balancing(??) between gateways? I want it to be static.
Is there any way to save and restore settings from ip tool like iptables
does? (iptables-save, restore)

Here We go (addresses changed because of security):

# ip addr
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:04:ac:d9:7f:7c brd ff:ff:ff:ff:ff:ff
    inet 10.48.32.10/16 brd 10.48.255.255 scope global eth0
    inet 10.48.32.3/24 brd 10.48.32.255 scope global eth0:1
    inet x.x.156.102/29 brd x.x.156.103 scope global eth0:2
4: eth2: <BROADCAST,UP> mtu 1500 qdisc pfifo_fast qlen 150
    link/ether 00:c0:f0:4d:e2:13 brd ff:ff:ff:ff:ff:ff
    inet x.x.153.158/30 brd x.x.153.159 scope global eth2

# ip rule show
0:      from all lookup local
32761:  from x.x.153.158 lookup formus2
32762:  from 192.168.100.0/24 lookup formus2
32763:  from 10.48.32.10 fwmark        4 lookup formus2
32764:  from 0.0.0.0 fwmark        2 lookup rose
32765:  from 10.48.64.2 lookup formus2
32766:  from all lookup main
32767:  from all lookup default

# iptables -L -n -v -x -t mangle
Chain PREROUTING (policy ACCEPT 3738441 packets, 2204536651 bytes)
    pkts      bytes target     prot opt in     out  source
destination
93282 68889253 MARK       all  --  *      * 0.0.0.0/0
x.x.153.158      MARK set 0x5
141     6309 MARK       tcp  --  *      * ! x.x.153.158
x.x.153.158      tcp dpt:2000 MARK set 0x3
21289  5294990 MARK       tcp  --  eth0   * 0.0.0.0/0
10.48.32.10        tcp dpt:8080 MARK set 0x4
8239  1870997 TOS        tcp  --  *      * 0.0.0.0/0
0.0.0.0/0          tcp spt:22 TOS set 0x10
101040  7491165 TOS        tcp  --  *      * 0.0.0.0/0
0.0.0.0/0          tcp dpt:22 TOS set 0x10

Chain OUTPUT (policy ACCEPT 981349 packets, 622327299 bytes)
    pkts      bytes target     prot opt in     outq
source               destination
   13918  1479670 MARK       tcp  --  *      *       10.48.32.10
!10.0.0.0/8         tcp dpt:80 MARK set 0x4
   12612 15769675 MARK       tcp  --  *      *       10.48.32.10
!10.0.0.0/8         tcp dpt:25 MARK set 0x2
   18605  3526169 MARK       all  --  *      *       10.48.64.2
!10.0.0.0/8         MARK set 0x4
   12584  1208166 TOS        tcp  --  *      *
10.48.32.10          0.0.0.0/0          tcp dpt:80 TOS set 0x08

# ip route list tab formus2
10.0.0.0/8 via 10.48.32.1 dev eth0  proto kernel
default via x.x.153.157 dev eth2

# ip route list tab rose
default via 10.48.32.1 dev eth0

# ip route list tab main
10.48.32.6 dev ppp0  proto kernel  scope link  src 10.48.32.10
10.48.32.1 via 10.48.32.10 dev eth0
x.x.153.156/30 dev eth2  proto kernel  scope link  src x.x.153.158
x.x.156.96/29 dev eth0  proto kernel  scope link  src x.x.156.102
192.168.100.0/24 dev eth1  proto kernel  scope link  src 192.168.100.1
10.48.32.0/24 dev eth0  proto kernel  scope link  src 10.48.32.3
10.48.0.0/16 dev eth0  proto kernel  scope link  src 10.48.32.10
10.0.0.0/8 via 10.48.32.1 dev eth0
127.0.0.0/8 dev lo  scope link
default
        nexthop via 10.48.32.1  dev eth0 weight 1
        nexthop via x.x.153.157  dev eth2 weight 2

# mailq -vs
smtp/nnn.com.pl:
        R/96581-30410: (2 tries, expires in 4d23h) smtp; 500 (connect to

www.nnn.com.pl [x.x.150.125|25|10.48.32.10|35339]:
Connection timed out)

# route -Cn|grep x.x.150.125

10.48.32.10     x.x.150.125 10.48.32.1            0      0        0 eth0

10.48.32.10     x.x.150.125 x.x.153.157         0      0        5 eth2
10.48.32.10     x.x.150.125 x.x.153.157         0      0        0 eth2

(one destination routed throught two interfaces?)

# iptables -L -n -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       all  -- !10.48.0.0/24         10.48.32.3 to:192.168.100.1

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  0.0.0.0/0            0.0.0.0/0          MARK match
0x4 to:62.32.153.158
SNAT       all  --  10.48.64.2          !10.0.0.0/8         to:
x.x.153.158
SNAT       all  --  192.168.100.0/24    !192.168.100.0/24 to:x.x.153.158

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


My networks:

10/8    - intranet
10.48.64.2/32    - me (I want to be routed through eth2 except e-mail
traffic)
others - routed normally through eth0 except squid connections.

I wrote the following startup script:
#!/bin/bash
IP='/sbin/ip'
SRCHOST='10.48.64.2'
D1L='x.x.153.158'
D1R='x.x.153.157'
D2L='10.48.32.10'       # local out if
D2R='10.48.32.1'        # remote out if
HIT='192.168.100.1'     # Hitachi

echo "0" >/proc/sys/net/ipv4/conf/all/rp_filter

$IP link set eth2 dynamic on multicast off txqueuelen 150
$IP route del default via 10.48.32.1 dev eth0
$IP route add default via $D1R dev eth2 table formus2 proto kernel
$IP route add default via $D2R dev eth0 table rose proto kernel
$IP route add to 10/8 via $D2R dev eth0
#$IP route add to $D2R/32 dev eth0 via $D2L
$IP rule add from $SRCHOST table formus2
$IP rule add from all table rose fwmark 02                      # use
rose if mark is 2
$IP rule add from $D2L table formus2 fwmark 04              # Squid from

10.48.32.10 out by eth2
$IP rule add from 192.168.100.0/24 table formus2
$IP rule add from $D1L table formus2
$IP rule add from $D2L table rose
$IP route add proto kernel default nexthop via 10.48.32.1 weight 1 dev
eth0 nexthop via x.x.153.157 weight 2 dev eth2
$IP route add table formus2 from 10.48.64.0/24 to 10/8 via 10.48.32.1
dev eth0 proto kernel
$IP route flush cache

# ip -V
ip utility, iproute2-ss010824

Further thanks,

Wojtek Sobola
Unix System Engineer
S&T Poland






[Index of Archives]     [LARTC Home Page]     [Netfilter]     [Netfilter Development]     [Network Development]     [Bugtraq]     [GCC Help]     [Yosemite News]     [Linux Kernel]     [Fedora Users]
  Powered by Linux