On Tuesday 30 May 2006 11:32, Vinod Chandran wrote: > Hi, > > I have a linux box which balances load between two interfaces ( say WAN1 > and WAN2). I have masquerading on for any request coming from LAN to the > outside world. If WAN ips are static, you can use iptables -t nat ... -o WAN1 -j SNAT --to x.x.x.x iptables -t nat ... -o WAN2 -j SNAT --to x.x.x.x AFAICR using MASQUERADE with multipath is not recommended (but maybe this is outdated, plz correct me if I'm wrong) > The setup is in such a way that WAN1 drops packets with source ip > belonging to WAN2's network and viceversa. > For some strange reason, I find that packet coming out from the WAN > interface has source address of WAN2 and thereby getting dropped. > > When I check the route cache , I find that for the same source and > destination, I have two route cache entries TOS is also computed to make a route cache entry, so it is possible and natural to 2 entries with same src and dst. Be aware that some ssh clients change the packet TOS after negotiation has been done, this could cause you get routed over a different link in the middle of your session, making impossible to do a simple ssh. > 192.168.52.66 192.168.26.73 192.168.19.76 0 0 0 > eth1 192.168.52.66 192.168.26.73 192.168.20.25 i 0 0 > 23 eth2 > > Here 192.168.19.76 is the WAN1 gateway and 192.168.20.25 is WAN2 > gateway, as we see the packets are going out through WAN2 , but the > masquerading has happened to the WAN1 IP address. > > It seems to me that the root of the problem is the creation of the two > cache entries. Any idea why this happens, and how it can be avoided. i think the root of the problem is that you are using MASQUERADE and not SNAT. And somehow MASQUERADE has not an accurate method to guess the right ip address to do the NAT. Besides that, you need to solve the problems that multipath will arise, like TOS situation described above or route cache expiration, that could made long term conns to be routed over a new iface. The solutions i know are CONNMARK(kernel>=2.6.12) and julian's patches[1]. Personally i prefer CONNMARK. [1] http://www.ssi.bg/~ja/ -- Luciano _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
