Re: Changing default route causes packet drop

["Gáspár Lajos" <swifty@freemail.hu>]

Hi John,

1. Set up multiple routing tables.

a.) I have the following in my /etc/iproute2/rt_tables: [cat 
/etc/iproute/rt_tables]

#
# reserved values
#
255    local
254    main
253    default
0    unspec
#
# local
#
#1    inr.ruhep
201    PPP2
200    PPP1


b.) I have a route setup script: [cat /etc/network/routes]

#!/bin/bash

WAN1_IF='ppp1'
WAN1_TB='PPP1'
WAN1_MARK='1'
WAN1_IP=`ip addr show dev $WAN1_IF | grep 'inet ' | awk '{print $2}' | 
awk 'BEGIN{FS="/"}{print $1}'`
WAN1_GW=`ip addr show dev $WAN1_IF | grep 'inet ' | awk '{print $4}' | 
awk 'BEGIN{FS="/"}{print $1}'`

WAN2_IF='ppp2'
WAN2_TB='PPP2'
WAN2_MARK='2'
WAN2_IP=`ip addr show dev $WAN2_IF | grep 'inet ' | awk '{print $2}' | 
awk 'BEGIN{FS="/"}{print $1}'`
WAN2_GW=`ip addr show dev $WAN2_IF | grep 'inet ' | awk '{print $4}' | 
awk 'BEGIN{FS="/"}{print $1}'`

ip route flush table $WAN1_TB
ip route flush table $WAN2_TB

test ! "$WAN1_IP" == "" && ip route add table $WAN1_TB dev $WAN1_IF 
default via $WAN1_GW src $WAN1_IP
test ! "$WAN2_IP" == "" && ip route add table $WAN2_TB dev $WAN2_IF 
default via $WAN2_GW src $WAN2_IP

for prio in `ip rule show | grep $WAN1_TB | awk 'BEGIN{FS=":"}{print $1}'`
  do
  ip rule del prio $prio
  done
for prio in `ip rule show | grep $WAN2_TB | awk 'BEGIN{FS=":"}{print $1}'`
  do
  ip rule del prio $prio
  done

test ! "$WAN2_IP" == "" && ip rule add fwmark $WAN1_MARK table $WAN1_TB
test ! "$WAN2_IP" == "" && ip rule add fwmark $WAN2_MARK table $WAN2_TB

test ! "$WAN1_IP" == "" && ip rule add from $WAN1_IP table $WAN1_TB
test ! "$WAN2_IP" == "" && ip rule add from $WAN2_IP table $WAN2_TB

test -e /proc/sys/net/ipv4/conf/$WAN1_IF/rp_filter && echo '0' 
 >/proc/sys/net/ipv4/conf/$WAN1_IF/rp_filter
test -e /proc/sys/net/ipv4/conf/$WAN2_IF/rp_filter && echo '0' 
 >/proc/sys/net/ipv4/conf/$WAN2_IF/rp_filter

ip route del default
ip route add default dev $WAN1_IF scope link

ip route flush cache

exit 0

c.) Call this script whenever a WAN interface is coming up.

In my /etc/interfaces:

auto adsl1
iface adsl1 inet ppp
    provider PPP1
    up /bin/sleep 10
    up /etc/network/routes

auto adsl2
iface adsl2 inet ppp
    provider PPP2
    up /bin/sleep 10
    up /etc/network/routes

2. Do the Netfilter/Iptables part:

Mark the outgoing packets in the mangle table's POSTROUTING chain with 
WAN1_MARK or WAN2_MARK:
iptables -t mangle -A POSTROUTING -j MARK --set-mark 1 .... (your 
matching criteria for WAN1....)
iptables -t mangle -A POSTROUTING -j MARK --set-mark 2 .... (your 
matching criteria for WAN2....)


Hope I could help:

  Swifty

2010-07-05 11:03 keltezéssel, John Meissen írta:
> I'm not sure if this is the right place to ask, or if it's even the right
> question. Hopefully someone can point me in the right direction.
>
> I had a traditional setup with two ethernet interfaces on my Linux box
> (WAN=eth0/LAN=eth1), and NATing the traffic that was forwarded between them.
>
> I added another interface (eth2), and simply want to change the default
> routing to go through it. I'm leaving various services listening on all
> interfaces.
>
> If I change the default route to use eth2, I can route from the internal
> network to the outside just fine, and I can connect from the internal net
> to services on the system fine. But incoming connections on the original
> WAN (eth0) don't complete. They hang at SYN_RECV, as if I had a DROP rule.
>
> I.e., what used to be
>
>    internal<->  (eth1) gateway forward (eth0)<->  WAN
>    internal<->  (eth1) gateway local service
>                  gateway local service (eth0)<->  WAN
> is now
>
>    internal<->  (eth1) gateway forward (eth2)<->  WAN
>    internal<->  (eth1) gateway local service
>
> but
>                  gateway local service (eth0)<->  WAN
>
> now drops connection attempts.
>
> I don't see what difference there should be between eth0 and eth1, except
> that eth0 isn't forwarded. That shouldn't affect connections to processes
> listening on that interface.
>
> I've tried to keep the iptables config simple for this. The only change I'm
> making is changing the default route with the 'route' command.
>
> # iptables -L -v -n
> Chain INPUT (policy ACCEPT 63555 packets, 73M bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
>     11  3626 ACCEPT     udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          udp spt:68 dpt:67
>      0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          tcp spt:68 dpt:67
>      0     0 ACCEPT     udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          udp spt:67 dpt:68
>      0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          tcp spt:67 dpt:68
>   1937  127K ACCEPT     udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          udp dpt:53
>      0     0 ACCEPT     tcp  --  eth1   *       0.0.0.0/0            0.0.0.0/0
>          tcp dpt:53
>
> Chain FORWARD (policy ACCEPT 39362 packets, 42M bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
> 31533 2844K ACCEPT     all  --  *      *       192.168.10.0/24      0.0.0.0/0
>
>
> Chain OUTPUT (policy ACCEPT 42150 packets, 5745K bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
>
> and
>
> # iptables -t nat -L -v -n
> Chain PREROUTING (policy ACCEPT 859K packets, 57M bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
>
> Chain POSTROUTING (policy ACCEPT 584K packets, 46M bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
>   755K   72M MASQUERADE  all  --  *      *       192.168.10.0/24      0.0.0.0/0
>
>
> Chain OUTPUT (policy ACCEPT 1015K packets, 100M bytes)
>   pkts bytes target     prot opt in     out     source               destination
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>