Pio Mendez wrote:
PREROUTING chain is not traversed by local traffic, but OUTPUT chain
does.
I think that OUTPUT is traversed after routing decision is taken, so it
is still the same problem.
Alexandru Dragoi wrote:
You need a switch with 802.1q vlan support (cisco for example). The
network card need to be pluged in a switch port in "trunk" mode, and
the providers each in its access switch port in specified vlan (like 2).
Since I don't have a switch like that, then I guess I should go back to
the first solution,
adding two IP-s to the same network interface. The problem of localhost
traffic not being
categorized, still exists, but this is not so important, since the box
is going to serve like
a router.
So, the solution, up to now looks like this:
-------------8<----------------------------------
ip link set eth0 up
ip address flush eth0
ip address add $IP1 dev eth0
ip address add $IP2 dev eth0
route add to default via $GATEWAY1
ip route flush table 2
ip route show table main | grep -Ev ^default \
| while read ROUTE ; do ip route add table 2 $ROUTE ; done
ip route add table 2 default via $GATEWAY2
ip rule del fwmark 2 table 2 2>/dev/null
ip rule add fwmark 2 table 2
PORT_LIST="22 53"
for PORT in $PORT_LIST
do
iptables -t mangle -A PREROUTING -m tcp -p tcp -dport $PORT -j MARK
--set-mark 0x2
done
iptables -t nat -A POSTROUTING -o eth0 -m mark --mark 0x2 -j SNAT
--to-source $IP2
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP1
------------8<---------------------------------
Thanks to Radu Oprisan for the SNAT rules suggestion, because in general
they are better than -j MASQUERADE.
What remains to be done now is:
1 - What are the (security) problems related to this solution (two IPs
in one interface)
and how to avoid them.
2 - How to do backup connection, i.e. when one of the lines goes down,
the other one
is used automaticly. One way may be to use ping, in order to
discover when
a gateway is down, and then to switch to the other.
Has anybody any idea on these topics?
Thanks.
Dashamir
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
