Hi all, I have 2 ISPs on a Linux router and a local network with one Linux server and many windows. The local network is masqueraded. I want to give access to port 25 and 80 of my server from any incoming request (i.e. from my 2 ISP). I have made a DNAT translation, witch work but the outgoing answers are not routed correctly. Of course, the de-SNAT process is done before the routing process. So all packet follow the default route. I look for solutions on the LARTC mailing-list archive, on the LARTC documentation, on Google, and anywhere I know, but all the solutions I found won't work. Based on the LARTC 2 ISP sample (Chapter 4.2), I try to mark my package to be correctly routed (via a FWMARK), without success. But everything I read tell me this should work. Here are my rules (from iptables-save): *mangle :PREROUTING ACCEPT [529944:316988323] :INPUT ACCEPT [374208:35129218] :FORWARD ACCEPT [4225914:2972153716] :OUTPUT ACCEPT [147094:14149367] :POSTROUTING ACCEPT [4855993:3030201798] -A PREROUTING -m conntrack --ctorigdst IP_OF_PPP0 -j MARK --set-mark 0x1 -A PREROUTING -m conntrack --ctorigdst IP_OF_PPP1 -j MARK --set-mark 0x2 -A PREROUTING -m connmark --mark 0x1 -j LOG --log-prefix "FWMARK1" COMMIT # Completed on Mon Nov 28 09:53:06 2005 # Generated by iptables-save v1.2.11 on Mon Nov 28 09:53:06 2005 *nat :PREROUTING ACCEPT [7696:835113] :POSTROUTING ACCEPT [29406:2303772] :OUTPUT ACCEPT [24589:1956035] -A PREROUTING -i ppp1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:80 -A PREROUTING -i ppp0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.4:80 -A PREROUTING -i ppp1 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.1.4:25 -A PREROUTING -i ppp0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.1.4:25 -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o ppp1 -j MASQUERADE -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o ppp0 -j MASQUERADE COMMIT I also have routing table but the line -A PREROUTING -m connmark --mark 0x1 -j LOG --log-prefix "FWMARK1" don't give me any result!!!! Nothing is logged! My packets are not marked. Why? I am on a DEBIAN Stable with a KERNEL 2.6.14.2 (hand made with make-kpkg) and the default iptables (v1.2.11) and iproute2 (iproute2-ss041019) Does any one have an idea? (or more ;-) )
