multi-isp connection NAT not working

multi-isp connection NAT not working

[Daniel Wittenberg]

I think this is a simple problem, but nothing I've read so far seems to
help, maybe I'm missing something.

ISP-1 (eth0) --  
                \
                 --- FIREWALL --- server
                /
ISP-2 (eth1) --

I'm just trying to get an IP on both ISP's that will allow me to connect
to server.  Right now I can connect to firewall from either ISP ok, it
is just getting through the firewall's NAT to the server, but only from
one connection.  I've put debug statements in iptables the packets seem
to go as far as NAT then not sure where they are going.  I've tried:

route add default via {ISP-1-gateway} table T1 dev eth0
rule add from {ISP-1-ip} table T1
rule add fwmark 1 table T1
iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 1

route add default via {ISP-2-gateway} table T2 dev eth1
rule add from {ISP-2-ip} table T1
rule add fwmark 2 table T1
iptables -t mangle -A PREROUTING -i eth1 -j MARK --set-mark 2

Any ideas?

Thanks,
Dan

Re: multi-isp connection NAT not working

[/dev/rob0]

On Wednesday 2005-September-28 11:51, Daniel Wittenberg wrote:
> I think this is a simple problem, but nothing I've read so far seems
> to help, maybe I'm missing something.

A serious typo?

> route add default via {ISP-1-gateway} table T1 dev eth0
> rule add from {ISP-1-ip} table T1
> rule add fwmark 1 table T1

Prepend "ip " to those.

> iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 1

ok

> route add default via {ISP-2-gateway} table T2 dev eth1
> rule add from {ISP-2-ip} table T1
> rule add fwmark 2 table T1

Again prepend "ip " and s/T1/T2/

> iptables -t mangle -A PREROUTING -i eth1 -j MARK --set-mark 2
>
> Any ideas?

I use and recommend Julian Anastasov's routes patch. Usage is explained 
in http://www.ssi.bg/~ja/nano.txt , the patches are linked from the 
parent directory. IWFM at 3 sites.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: multi-isp connection NAT not working

[Daniel Wittenberg]

Actually I've abstracted it in a script and the function name adds "ip",
just wasn't watching when I copy/pasted :(

I'll take a look, thanks.
Dan


On Wed, 2005-09-28 at 13:24 -0500, /dev/rob0 wrote:
> On Wednesday 2005-September-28 11:51, Daniel Wittenberg wrote:
> > I think this is a simple problem, but nothing I've read so far seems
> > to help, maybe I'm missing something.
> 
> A serious typo?
> 
> > route add default via {ISP-1-gateway} table T1 dev eth0
> > rule add from {ISP-1-ip} table T1
> > rule add fwmark 1 table T1
> 
> Prepend "ip " to those.
> 
> > iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 1
> 
> ok
> 
> > route add default via {ISP-2-gateway} table T2 dev eth1
> > rule add from {ISP-2-ip} table T1
> > rule add fwmark 2 table T1
> 
> Again prepend "ip " and s/T1/T2/
> 
> > iptables -t mangle -A PREROUTING -i eth1 -j MARK --set-mark 2
> >
> > Any ideas?
> 
> I use and recommend Julian Anastasov's routes patch. Usage is explained 
> in http://www.ssi.bg/~ja/nano.txt , the patches are linked from the 
> parent directory. IWFM at 3 sites.