Re: Two outbound internet links, using one network interface

Linux Advanced Routing and Traffic Control

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dashamir Hoxha wrote:
Pio Mendez wrote:

    >Pio Mendez wrote:
    >>PREROUTING chain is not traversed by local traffic, but OUTPUT
    >>chain does.
    >
>I think that OUTPUT is traversed after routing decision is taken, so
    >it is still the same problem.


    I'm using OUTPUT chain in production environment to balance squid
    box traffic between 2 ISP, so I'm sure that you can reroute output
    packets using mangle OUTPUT chain.

    After traversing mangle and nat OUTPUT chains there is another
    routing process. Please check this diagram:

    http://www.imagestream.com/~josh/PacketFlow.png
    <http://www.imagestream.com/%7Ejosh/PacketFlow.png>

Pio Mendez is right. I have just tested it and it works.
If I use:
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
instead of:
iptables -t nat -A POSTROUTING -o eth0 -m mark --mark 0x2 -j SNAT --to-source $IP2
    iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP1
it seems not to work. So, maybe I didn't test it properly and actualy
it doesn't work. Anyway, it is not so important.

Dashamir

Now the script becomes something like this:

-------------8<----------------------------------
ip link set eth0 up
ip address flush eth0
ip address add $IP1 dev eth0
ip address add $IP2 dev eth0

route add to default via $GATEWAY1

ip route flush table 2
ip route show table main | grep -Ev ^default \
| while read ROUTE ; do ip route add table 2 $ROUTE ; done
ip route add table 2 default via $GATEWAY2

ip rule del fwmark 2 table 2   2>/dev/null
ip rule add fwmark 2 table 2

iptables -t mangle -N MARK-RULES
iptables -t mangle -A PREROUTING -j MARK-RULES
iptables -t mangle -A OUTPUT -j MARK-RULES

PORT_LIST="22 53"
for PORT in $PORT_LIST
do
iptables -t mangle -A MARK-RULES -m tcp -p tcp -dport $PORT -j MARK --set-mark 0x2
done

iptables -t nat -A POSTROUTING -o eth0 -m mark --mark 0x2 -j SNAT --to-source $IP2
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP1
------------8<---------------------------------
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc



_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

[Index of Archives]     [LARTC Home Page]     [Netfilter]     [Netfilter Development]     [Network Development]     [Bugtraq]     [GCC Help]     [Yosemite News]     [Linux Kernel]     [Fedora Users]
  Powered by Linux