* [LARTC] Default route - Please Help
@ 2003-05-01 15:33 xchris
2003-05-02 9:36 ` Matthieu Turpault
2003-05-02 14:16 ` xchris
0 siblings, 2 replies; 3+ messages in thread
From: xchris @ 2003-05-01 15:33 UTC (permalink / raw)
To: lartc
I've read the howto but i still can't let thinghs go in the right way
My box has 4 nic.
2 internet connection eth0,eth1
1 dmz eth2
1 lan eth3
I would like to nat the internal lan wih one of the 2 ISP.
For my tests i created a script to switch the entire lan from one to the
other (i know it's redundand ....del...add.)
The problem is that NAT is done only if i set the default gateway (in the
main table)
I have set the 2 default gateways in the other 2 tables but it seems not to
consider them.
if i set default gateway to ISP1 and set nat rules to go with ISP2 it
doesn't work!!!
Why???
my future plan are to let some client go with ISP1 and other with ISP2
Please Help!!!
Any hint apreciated!!
Here is my (long) config.
Bye
xchris
eth0 Link encap:Ethernet HWaddr 00:04:76:25:07:D9
inet addr:192.168.1.237 Bcast:192.168.1.255 Mask:255.255.255.0
eth1 Link encap:Ethernet HWaddr 00:04:76:25:07:3D
inet addr:192.168.3.1 Bcast:192.168.3.255 Mask:255.255.255.0
eth2 Link encap:Ethernet HWaddr 00:04:76:25:07:67
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
eth3 Link encap:Ethernet HWaddr 00:04:76:25:07:73
inet addr:192.168.0.238 Bcast:192.168.0.255 Mask:255.255.255.0
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
Here is my script (just basic... to test routing.. there's no firewall at
all)
it's done to act this way
script 1 -->all lan go with ISP 1
script 2 -->all lan go with ISP 2
echo 1 > /proc/sys/net/ipv4/ip_forward
route del default
IF3=eth3
IF1=eth0
IF2=eth1
IP1\x192.168.1.237
IP2\x192.168.3.1
IP3\x192.168.0.238
GW1\x192.168.1.238
GW2\x192.168.3.254
P1_NET\x192.168.1.0/24
P2_NET\x192.168.3.0/24
P3_NET\x192.168.0.0/24
echo "1 - Creating two additional routing tables"
echo
ip route del $P1_NET dev $IF1 src $IP1 table telecom
ip route add $P1_NET dev $IF1 src $IP1 table telecom
echo 1
ip route del default via $GW1 table telecom
ip route add default via $GW1 table telecom
echo 2
ip route del $P2_NET dev $IF2 src $IP2 table fastweb
ip route add $P2_NET dev $IF2 src $IP2 table fastweb
echo 3
ip route del default via $GW2 table fastweb
ip route add default via $GW2 table fastweb
echo "2 - Setting Main routing tables"
echo
ip route del $P1_NET dev $IF1 src $IP1
ip route del $P2_NET dev $IF2 src $IP2
ip route add $P1_NET dev $IF1 src $IP1
ip route add $P2_NET dev $IF2 src $IP2
ip route add default via $GW2
echo "3 - Setting answers from corresponing IPs"
echo
ip rule del from $IP1 table telecom
ip rule del from $IP2 table fastweb
ip rule add from $IP1 table telecom
ip rule add from $IP2 table fastweb
ip route add $P3_NET dev $IF3 table telecom
ip route add $P2_NET dev $IF2 table telecom
ip route add 127.0.0.0/8 dev lo table telecom
ip route add $P3_NET dev $IF3 table fastweb
ip route add $P1_NET dev $IF1 table fastweb
ip route add 127.0.0.0/8 dev lo table fastweb
if test $1 -eq 2
then
iptables -t nat -F
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j
SNAT --to-source $IP2
else
iptables -t nat -F
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j
SNAT --to-source $IP1
fi
my /etc/iproute2/rt_tables#
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
1 telecom
2 fastweb
ip rule
0: from all lookup local
32764: from 192.168.3.1 lookup fastweb
32765: from 192.168.1.237 lookup telecom
32766: from all lookup main
32767: from all lookup default
ip route
192.168.3.0/24 dev eth1 scope link src 192.168.3.1
192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1
192.168.1.0/24 dev eth0 scope link src 192.168.1.237
192.168.0.0/24 dev eth3 proto kernel scope link src 192.168.0.238
default via 192.168.3.254 dev eth1
ip route table telecom
192.168.3.0/24 dev eth1 scope link
192.168.1.0/24 dev eth0 scope link src 192.168.1.237
192.168.0.0/24 dev eth3 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.1.238 dev eth0
ip route table fastweb
192.168.3.0/24 dev eth1 scope link src 192.168.3.1
192.168.1.0/24 dev eth0 scope link
192.168.0.0/24 dev eth3 scope link
127.0.0.0/8 dev lo scope link
default via 192.168.3.254 dev eth1
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [LARTC] Default route - Please Help
2003-05-01 15:33 [LARTC] Default route - Please Help xchris
@ 2003-05-02 9:36 ` Matthieu Turpault
2003-05-02 14:16 ` xchris
1 sibling, 0 replies; 3+ messages in thread
From: Matthieu Turpault @ 2003-05-02 9:36 UTC (permalink / raw)
To: lartc
Hi list,
I have exactly the same problem and I can't manage with doing my network
work.
In fact, the NAT postrouting is done *after* the routing.
Consequently, tables fastweb and telecom are never looked.
I am very interesed by a solution.
My problem is described at this URL (still no answer):
http://marc.theaimsgroup.com/?l=lartc&m\x105049828901812&w=2
> -----Message d'origine-----
> De : lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl]De
> la part de xchris
> Envoyé : jeudi 1 mai 2003 17:33
> À : lartc@mailman.ds9a.nl
> Objet : [LARTC] Default route - Please Help
>
>
> I've read the howto but i still can't let thinghs go in the right way
>
> My box has 4 nic.
> 2 internet connection eth0,eth1
> 1 dmz eth2
> 1 lan eth3
>
>
> I would like to nat the internal lan wih one of the 2 ISP.
> For my tests i created a script to switch the entire lan from one to the
> other (i know it's redundand ....del...add.)
>
> The problem is that NAT is done only if i set the default gateway (in the
> main table)
> I have set the 2 default gateways in the other 2 tables but it
> seems not to
> consider them.
>
> if i set default gateway to ISP1 and set nat rules to go with ISP2 it
> doesn't work!!!
> Why???
>
> my future plan are to let some client go with ISP1 and other with ISP2
>
> Please Help!!!
> Any hint apreciated!!
> Here is my (long) config.
> Bye
>
> xchris
>
>
>
>
> eth0 Link encap:Ethernet HWaddr 00:04:76:25:07:D9
> inet addr:192.168.1.237 Bcast:192.168.1.255 Mask:255.255.255.0
>
> eth1 Link encap:Ethernet HWaddr 00:04:76:25:07:3D
> inet addr:192.168.3.1 Bcast:192.168.3.255 Mask:255.255.255.0
>
> eth2 Link encap:Ethernet HWaddr 00:04:76:25:07:67
> inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
>
> eth3 Link encap:Ethernet HWaddr 00:04:76:25:07:73
> inet addr:192.168.0.238 Bcast:192.168.0.255 Mask:255.255.255.0
>
> lo Link encap:Local Loopback
> inet addr:127.0.0.1 Mask:255.0.0.0
>
>
> Here is my script (just basic... to test routing.. there's no firewall at
> all)
> it's done to act this way
>
> script 1 -->all lan go with ISP 1
> script 2 -->all lan go with ISP 2
>
>
> echo 1 > /proc/sys/net/ipv4/ip_forward
> route del default
> IF3=eth3
> IF1=eth0
> IF2=eth1
> IP1\x192.168.1.237
> IP2\x192.168.3.1
> IP3\x192.168.0.238
> GW1\x192.168.1.238
> GW2\x192.168.3.254
> P1_NET\x192.168.1.0/24
> P2_NET\x192.168.3.0/24
> P3_NET\x192.168.0.0/24
>
> echo "1 - Creating two additional routing tables"
> echo
> ip route del $P1_NET dev $IF1 src $IP1 table telecom
> ip route add $P1_NET dev $IF1 src $IP1 table telecom
> echo 1
> ip route del default via $GW1 table telecom
> ip route add default via $GW1 table telecom
> echo 2
> ip route del $P2_NET dev $IF2 src $IP2 table fastweb
> ip route add $P2_NET dev $IF2 src $IP2 table fastweb
> echo 3
> ip route del default via $GW2 table fastweb
> ip route add default via $GW2 table fastweb
>
> echo "2 - Setting Main routing tables"
> echo
> ip route del $P1_NET dev $IF1 src $IP1
> ip route del $P2_NET dev $IF2 src $IP2
> ip route add $P1_NET dev $IF1 src $IP1
> ip route add $P2_NET dev $IF2 src $IP2
> ip route add default via $GW2
>
>
> echo "3 - Setting answers from corresponing IPs"
> echo
> ip rule del from $IP1 table telecom
> ip rule del from $IP2 table fastweb
> ip rule add from $IP1 table telecom
> ip rule add from $IP2 table fastweb
>
> ip route add $P3_NET dev $IF3 table telecom
> ip route add $P2_NET dev $IF2 table telecom
> ip route add 127.0.0.0/8 dev lo table telecom
>
> ip route add $P3_NET dev $IF3 table fastweb
> ip route add $P1_NET dev $IF1 table fastweb
> ip route add 127.0.0.0/8 dev lo table fastweb
>
> if test $1 -eq 2
> then
> iptables -t nat -F
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j
> SNAT --to-source $IP2
> else
> iptables -t nat -F
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j
> SNAT --to-source $IP1
> fi
>
>
>
>
> my /etc/iproute2/rt_tables#
> # reserved values
> #
> 255 local
> 254 main
> 253 default
> 0 unspec
> #
> # local
> #
> #1 inr.ruhep
> 1 telecom
> 2 fastweb
>
>
> ip rule
>
> 0: from all lookup local
> 32764: from 192.168.3.1 lookup fastweb
> 32765: from 192.168.1.237 lookup telecom
> 32766: from all lookup main
> 32767: from all lookup default
>
>
> ip route
>
> 192.168.3.0/24 dev eth1 scope link src 192.168.3.1
> 192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1
> 192.168.1.0/24 dev eth0 scope link src 192.168.1.237
> 192.168.0.0/24 dev eth3 proto kernel scope link src 192.168.0.238
> default via 192.168.3.254 dev eth1
>
>
> ip route table telecom
>
> 192.168.3.0/24 dev eth1 scope link
> 192.168.1.0/24 dev eth0 scope link src 192.168.1.237
> 192.168.0.0/24 dev eth3 scope link
> 127.0.0.0/8 dev lo scope link
> default via 192.168.1.238 dev eth0
>
>
> ip route table fastweb
>
> 192.168.3.0/24 dev eth1 scope link src 192.168.3.1
> 192.168.1.0/24 dev eth0 scope link
> 192.168.0.0/24 dev eth3 scope link
> 127.0.0.0/8 dev lo scope link
> default via 192.168.3.254 dev eth1
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [LARTC] Default route - Please Help
2003-05-01 15:33 [LARTC] Default route - Please Help xchris
2003-05-02 9:36 ` Matthieu Turpault
@ 2003-05-02 14:16 ` xchris
1 sibling, 0 replies; 3+ messages in thread
From: xchris @ 2003-05-02 14:16 UTC (permalink / raw)
To: lartc
On Friday 02 May 2003 11:36, Matthieu Turpault wrote:
> Hi list,
>
> I have exactly the same problem and I can't manage with doing my network
> work.
>
> In fact, the NAT postrouting is done *after* the routing.
> Consequently, tables fastweb and telecom are never looked.
>
> I am very interesed by a solution.
>
> My problem is described at this URL (still no answer):
> http://marc.theaimsgroup.com/?l=lartc&m\x105049828901812&w=2
>
Here is my working solution (sorry for italian..)
I separeted routing and nat files.
In few words you have to
1)ip rule with fmark!!
2)mark packets with iptables -t mangle
3)SNAT
Hope this help.
routing:
TELECOM_IF=eth0
FASTWEB_IF=eth1
DMZ_IP=eth2
LAN_IF=eth3
TELECOM_IP\x192.168.1.237
FASTWEB_IP\x192.168.3.1
DMZ_IP\x192.168.2.1
LAN_IP\x192.168.0.238
TELECOM_NET\x192.168.1.0/24
FASTWEB_NET\x192.168.3.0/24
DMZ_NET\x192.168.2.0/24
LAN_NET\x192.168.0.0/24
GW_TELECOM\x192.168.1.238
GW_FASTWEB\x192.168.3.254
TELECOM_MARK=1
FASTWEB_MARK=2
echo "1 - Creating two additional routing tables"
echo
ip route del $TELECOM_NET dev $TELECOM_IF src $TELECOM_IP table telecom
ip route add $TELECOM_NET dev $TELECOM_IF src $TELECOM_IP table telecom
ip route del default via $GW_TELECOM table telecom
ip route add default via $GW_TELECOM table telecom
ip route del $FASTWEB_NET dev $FASTWEB_IF src $FASTWEB_IP table fastweb
ip route add $FASTWEB_NET dev $FASTWEB_IF src $FASTWEB_IP table fastweb
ip route del default via $GW_FASTWEB table fastweb
ip route add default via $GW_FASTWEB table fastweb
echo "2 - Setting Main routing tables"
echo
ip route del $TELECOM_NET dev $TELECOM_IF src $TELECOM_IP
ip route del $FASTWEB_NET dev $FASTWEB_IF src $FASTWEB_IP
ip route add $TELECOM_NET dev $TELECOM_IF src $TELECOM_IP
ip route add $FASTWEB_NET dev $FASTWEB_IF src $FASTWEB_IP
ip route add default via $GW_TELECOM
echo "3 - Setting answers from corresponing IPs"
echo
ip rule del from $TELECOM_IP table telecom
ip rule del from $FASTWEB_IP table fastweb
ip rule add from $TELECOM_IP table telecom
ip rule add from $FASTWEB_IP table fastweb
ip route add $LAN_NET dev $LAN_IF table telecom
ip route add $FASTWEB_NET dev $FASTWEB_IF table telecom
ip route add 127.0.0.0/8 dev lo table telecom
ip route add $LAN_NET dev $LAN_IF table fastweb
ip route add $TELECOM_NET dev $TELECOM_IF table fastweb
ip route add 127.0.0.0/8 dev lo table fastweb
ip rule del fwmark 2 table 2
ip rule del fwmark 1 table 1
ip rule add fwmark 2 table 2
ip rule add fwmark 1 table 1
ip route flush cache
here is nat file
TELECOM_IF=eth0
FASTWEB_IF=eth1
DMZ_IP=eth2
LAN_IF=eth3
TELECOM_IP\x192.168.1.237
FASTWEB_IP\x192.168.3.1
DMZ_IP\x192.168.2.1
LAN_IP\x192.168.0.238
TELECOM_NET\x192.168.1.0/24
FASTWEB_NET\x192.168.3.0/24
DMZ_NET\x192.168.2.0/24
LAN_NET\x192.168.0.0/24
GW_TELECOM\x192.168.1.238
GW_FASTWEB\x192.168.3.254
TELECOM_MARK=1
FASTWEB_MARK=2
###############################################################################
## Funzione ausiliaria che marka e imposta nat
imposta_nat()
{
if test $2 = $TELECOM_IP
then
local MARK=$TELECOM_MARK
else
local MARK=$FASTWEB_MARK
fi
iptables -t mangle -A PREROUTING -s $3$1 -j MARK --set-mark $MARK
iptables -t nat -A POSTROUTING -s $3$1 -j SNAT --to-source $2
}
################################################################################
################### Facciamo Pulizia ########################################
### Lascio il DNAT di Shorewall
#############################################################################
iptables -t nat -F POSTROUTING
iptables -t mangle -F
##############################################################################
### Maschero la Dmz con Fastweb altrimenti non risputa i pacchetti
### Potrebbe sputarli verso telecom
imposta_nat $DMZ_NET $FASTWEB_IP
###############################################################################
### Maschero la lan con Telecom
imposta_nat $LAN_NET $TELECOM_IP
###############################################################################
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2003-05-02 14:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-05-01 15:33 [LARTC] Default route - Please Help xchris
2003-05-02 9:36 ` Matthieu Turpault
2003-05-02 14:16 ` xchris
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.