NAT with two Internet links

NAT with two Internet links

[Simon Garner]

Hi,

I have a small network with several Windows client PCs, a Linux
firewall/server, and two links to the Internet. What I want to do is
have certain traffic (based on source and/or destination ports) routed
through one link while everything else goes through the other.

The first link is a 256k wireless/radio connection with a static IP. The
second is a 128k ADSL connection via an external ADSL modem/router with
a dynamic IP.

The Linux (2.4) firewall machine has two network interfaces, eth0
[192.168.1.2] connects it to the LAN, and eth1 [1.2.3.4] which plugs
straight into the wall (the wireless link).

The ADSL modem has a LAN IP [192.168.1.1] and itself acts as a NAT
device.

All the client PCs are set to use the Linux firewall as their gateway,
and I have it set up to do NAT. The Linux firewall has two default
gateway addresses, one for eth0 (the ADSL router, 192.168.1.1) and one
for eth1 (the wireless gateway, 1.2.3.3). Currently eth1 is set as the
lower metric so that all data is going out through the wireless link,
and the ADSL is not being used. If I swap this around, vice versa works
also.

How can I set it up to route some data out through eth1 and some through
the ADSL (based on sport/dport)? I've tried adding a rules like:

/sbin/iptables -t nat -A POSTROUTING -p tcp --dport 80 -o eth0 -j
MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

But this doesn't seem to do anything, http is still routed through the
wireless.

Help!

-Simon

Re: NAT with two Internet links

[Simon Garner]

On Thursday, October 16, 2003 7:37 PM [GMT+1200=NZT],
Simon Garner <sgarner@expio.co.nz> wrote:

> Hi,
>
> I have a small network with several Windows client PCs, a Linux
> firewall/server, and two links to the Internet. What I want to do is
> have certain traffic (based on source and/or destination ports) routed
> through one link while everything else goes through the other.
>

Nevermind, after a bit more googling I found the answer myself. The
solution is to mark the wanted packets with iptables and then route them
with iproute2, as per:
http://www.lartc.org/howto/lartc.netfilter.html

-Simon

RE: NAT with two Internet links

[Gaby Schilders]

Alternatively, if you want to be on the bleeding edge... (who doesn't ;-)

If you include the 'ROUTE' target (from a recent p-o-m) and get a recent iptables snapshot and compile it against your shiney new kernel source you can do without the Mark target and iproute2 altogether:

use the target -j ROUTE --gw GWx (add --oif OIFx if you're paranoid like me) --continue

Where in GWx and OIFx x is the number of the uplink you want to use for this particular connection (I have two uplinks so I have rules for GW1 and GW2 but this can be extended ad inifinitum)

Don't forget the --continue or your packets go out without being SNATted or UnDNATted...

I only figured this one out today though ;)

I'll expand on this solution somewhere on Monday when it's all fixed up.

Gaby Schilders
IBFD network admin

-----Original Message-----
From: Simon Garner [mailto:sgarner@expio.co.nz]
Sent: donderdag 16 oktober 2003 9:46
To: netfilter@lists.netfilter.org
Subject: Re: NAT with two Internet links


On Thursday, October 16, 2003 7:37 PM [GMT+1200=NZT],
Simon Garner <sgarner@expio.co.nz> wrote:

> Hi,
>
> I have a small network with several Windows client PCs, a Linux
> firewall/server, and two links to the Internet. What I want to do is
> have certain traffic (based on source and/or destination ports) routed
> through one link while everything else goes through the other.
>

Nevermind, after a bit more googling I found the answer myself. The
solution is to mark the wanted packets with iptables and then route them
with iproute2, as per:
http://www.lartc.org/howto/lartc.netfilter.html

-Simon