Re: Two outbound internet links, using one network interface

[Dashamir Hoxha <dasho@xxxxxxxxxx>]

Dashamir Hoxha wrote:
> Pio Mendez wrote:
> >  
> >
> >     >Pio Mendez wrote:
> >     >>PREROUTING chain is not traversed by local traffic, but OUTPUT
> >     >>chain does.
> >     >
> >     >I think that OUTPUT is traversed after routing decision is 
> > taken, so
> >     >it is still the same problem.
> >
> >
> >     I'm using OUTPUT chain in production environment to balance squid
> >     box traffic between 2 ISP, so I'm sure that you can reroute output
> >     packets using mangle OUTPUT chain.
> >
> >     After traversing mangle and nat OUTPUT chains there is another
> >     routing process. Please check this diagram:
> >
> >     http://www.imagestream.com/~josh/PacketFlow.png
> >     <http://www.imagestream.com/%7Ejosh/PacketFlow.png>
> Pio Mendez is right. I have just tested it and it works.
If I use:
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
instead of:
    iptables -t nat -A POSTROUTING -o eth0 -m mark --mark 0x2 -j SNAT 
--to-source $IP2
    iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP1
it seems not to work. So, maybe I didn't test it properly and actualy
it doesn't work. Anyway, it is not so important.

Dashamir

> Now the script becomes something like this:
>
> -------------8<----------------------------------
> ip link set eth0 up
> ip address flush eth0
> ip address add $IP1 dev eth0
> ip address add $IP2 dev eth0
>
> route add to default via $GATEWAY1
>
> ip route flush table 2
> ip route show table main | grep -Ev ^default \
> | while read ROUTE ; do ip route add table 2 $ROUTE ; done
> ip route add table 2 default via $GATEWAY2
>
> ip rule del fwmark 2 table 2   2>/dev/null
> ip rule add fwmark 2 table 2
>
> iptables -t mangle -N MARK-RULES
> iptables -t mangle -A PREROUTING -j MARK-RULES
> iptables -t mangle -A OUTPUT -j MARK-RULES
>
> PORT_LIST="22 53"
> for PORT in $PORT_LIST
> do
> iptables -t mangle -A MARK-RULES -m tcp -p tcp -dport $PORT -j MARK 
> --set-mark 0x2
> done
>
> iptables -t nat -A POSTROUTING -o eth0 -m mark --mark 0x2 -j SNAT 
> --to-source $IP2
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP1
> ------------8<---------------------------------
> _______________________________________________
> LARTC mailing list
> LARTC@xxxxxxxxxxxxxxx
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc