port 80 out new ISP

port 80 out new ISP

[Brent Clark]

Hi all

For a few days now I have been struggling to get my HTTP traffic across my new ISP.

I currently have been reading the following doc.

http://linux-ip.net/html/adv-multi-internet.html

and have changed my scripts accordingly.

But for some reason, it still dont work

my setup is as so

firewall:
eth0 196.36.10.114    -> Routes traffic to old ISP
eth1 192.168.111.10    -> Private Lan
eth2 192.168.10.100    -> for ADSL

Adsl modem:
ipaddress: 192.168.10.200 (external ip dynamically assigned)


## Create the table
ip route flush table TELKOM  >>/dev/null
ip route show table main |grep -Ev ^default\
   | while read ROUTE ; do
     ip route add table TELKOM $ROUTE
  done

## Add the ADSL as route to route table 4

ip route add default via 192.168.10.200 dev eth2 table TELKOM >>/dev/null

## Add the route to table TELKOM

ip rule add fwmark 1 table TELKOM >> /dev/null
gate:~#


$IPT -t nat -A PREROUTING -i eth1 -t mangle -p tcp --dport 80 -j MARK --set-mark 1
$IPT -t nat -A PREROUTING -i eth1 -t mangle -p tcp --dport 443 -j MARK --set-mark 1

# SNAT the Private LAN
$IPT -t nat -A POSTROUTING -o eth0 -s 192.168.111.0/24 -j SNAT --to-source 196.36.10.114
#$IPT -t nat -A POSTROUTING -o eth2 -s 192.168.111.0/24 -j SNAT --to-source 192.168.10.200
$IPT -t nat -A POSTROUTING -o eth2 -s 192.168.111.0/24 -j MASQUERADE

Re: port 80 out new ISP

[/dev/rob0]

On Friday 2005-August-19 10:55, Brent Clark wrote:
> I currently have been reading the following doc.
>
> http://linux-ip.net/html/adv-multi-internet.html
>
> and have changed my scripts accordingly.

Not quite.

> my setup is as so
>
> firewall:
> eth0 196.36.10.114    -> Routes traffic to old ISP
> eth1 192.168.111.10    -> Private Lan
> eth2 192.168.10.100    -> for ADSL
>
> Adsl modem:
> ipaddress: 192.168.10.200 (external ip dynamically assigned)

This "modem" is also functioning as a NAT router? So in effect your 
192.168.10.100 IP (eth2) can function as an external interface?

> ## Create the table
> ip route flush table TELKOM  >>/dev/null
> ip route show table main |grep -Ev ^default\

What does this command, without the "\<newline>" and pipe, return?

>    | while read ROUTE ; do
>
>      ip route add table TELKOM $ROUTE
>   done
>
> ## Add the ADSL as route to route table 4
>
> ip route add default via 192.168.10.200 dev eth2 table TELKOM
> >>/dev/null
>
> ## Add the route to table TELKOM
>
> ip rule add fwmark 1 table TELKOM >> /dev/null

And what do your routing rules show at this point?

> $IPT -t nat -A PREROUTING -i eth1 -t mangle -p tcp --dport 80 -j MARK
> --set-mark 1
> $IPT -t nat -A PREROUTING -i eth1 -t mangle -p tcp 
> --dport 443 -j MARK --set-mark 1
>
> # SNAT the Private LAN
> $IPT -t nat -A POSTROUTING -o eth0 -s 192.168.111.0/24 -j SNAT
> --to-source 196.36.10.114
> #$IPT -t nat -A POSTROUTING -o eth2 -s 
> 192.168.111.0/24 -j SNAT --to-source 192.168.10.200

Why is that one commented?

> $IPT -t nat -A POSTROUTING -o eth2 -s 192.168.111.0/24 -j MASQUERADE

MASQUERADE will not work with dual routing.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: port 80 out new ISP

[Brent Clark]

Hi Rob

A big thanks for replying to my email.

>>ip route flush table TELKOM  >>/dev/null
>>ip route show table main |grep -Ev ^default\
> 
> 
> What does this command, without the "\<newline>" and pipe, return?
> 

gate:~# ip route show table main | grep -Ev ^default
196.36.10.112/29 dev eth0  proto kernel  scope link  src 196.36.10.114
192.168.111.0/24 dev eth1  proto kernel  scope link  src 192.168.111.10
192.168.10.0/24 dev eth2  proto kernel  scope link  src 192.168.10.100
gate:~#

>>ip rule add fwmark 1 table TELKOM >> /dev/null
> 
> 
> And what do your routing rules show at this point?

gate:~# ip rule show
0:      from all lookup local
32765:  from all fwmark 0x1 lookup TELKOM
32766:  from all lookup main
32767:  from all lookup default
gate:~#

gate:~# ip route show table main
196.36.10.112/29 dev eth0  proto kernel  scope link  src 196.36.10.114
192.168.111.0/24 dev eth1  proto kernel  scope link  src 192.168.111.10
192.168.10.0/24 dev eth2  proto kernel  scope link  src 192.168.10.100
default via 196.36.10.113 dev eth0
gate:~#

gate:~# ip route show table TELKOM
196.36.10.112/29 dev eth0  proto kernel  scope link  src 196.36.10.114
192.168.111.0/24 dev eth1  proto kernel  scope link  src 192.168.111.10
192.168.10.0/24 dev eth2  proto kernel  scope link  src 192.168.10.100
default via 192.168.10.200 dev eth2
gate:~#


>># SNAT the Private LAN
>>$IPT -t nat -A POSTROUTING -o eth0 -s 192.168.111.0/24 -j SNAT
>>--to-source 196.36.10.114
>>#$IPT -t nat -A POSTROUTING -o eth2 -s 
>>192.168.111.0/24 -j SNAT --to-source 192.168.10.200
> 
> 
> Why is that one commented?

Im commented it out, hoping the MASQUERADE would work.
> 
> 
>>$IPT -t nat -A POSTROUTING -o eth2 -s 192.168.111.0/24 -j MASQUERADE
> 
> 
> MASQUERADE will not work with dual routing.

Thanks

Re: port 80 out new ISP

[Brent Clark]

Hi Rob

Im not sure is this a good way of debugging

but I tried this:

iptables -t nat -A PREROUTING --dport 80 -j LOG
Aug 19 18:40:32 gate kernel: IN=eth1 OUT= MAC=00:00:f4:af:80:b8:00:60:67:77:aa:92:08:00 SRC=192.168.111.213 DST=66.36.247.82 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=2925 DF PROTO=TCP SPT=4032 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0

Notice that "OUT=" does not show eth2

Brent

Re: port 80 out new ISP

[Robert Nichols]

Brent Clark wrote:

> iptables -t nat -A PREROUTING --dport 80 -j LOG
> Aug 19 18:40:32 gate kernel: IN=eth1 OUT= 
> MAC=00:00:f4:af:80:b8:00:60:67:77:aa:92:08:00 SRC=192.168.111.213 
> DST=66.36.247.82 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=2925 DF PROTO=TCP 
> SPT=4032 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
> 
> Notice that "OUT=" does not show eth2

Of course not.  In the PREROUTING stage no decision about where to send
the packet has yet been made.

-- 
Bob Nichols         Yes, "NOSPAM" is really part of my email address.

Re: port 80 out new ISP

[Brent Clark]

Robert Nichols wrote:
> Brent Clark wrote:
> 
>> iptables -t nat -A PREROUTING --dport 80 -j LOG
>> Aug 19 18:40:32 gate kernel: IN=eth1 OUT= 
>> MAC=00:00:f4:af:80:b8:00:60:67:77:aa:92:08:00 SRC=192.168.111.213 
>> DST=66.36.247.82 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=2925 DF 
>> PROTO=TCP SPT=4032 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
>>
>> Notice that "OUT=" does not show eth2
> 
> 
> Of course not.  In the PREROUTING stage no decision about where to send
> the packet has yet been made.
> 

Hi Robert

Makes sense, thanks for the feedback.

Kind Regards
Brent Clark

Re: port 80 out new ISP

[Jan Engelhardt]

>> $IPT -t nat -A POSTROUTING -o eth2 -s 192.168.111.0/24 -j MASQUERADE
>
>MASQUERADE will not work with dual routing.

Does it really? AFAICS it asks the routing code to "route this for me and tell 
me what interface it would hypothetically go out" and takes the ip of the 
outgoing iface.

Jan Engelhardt
--