Re: DUAL wan issue, destination-based routing

[Patrick McHardy <kaber@trash.net>]

jeev wrote:
> Hey guys, i was reading on the netfilter site.
> 
> I saw Patrick McHardy wrote about having 2 cable modems... i'm in the
> same situation... my only problem is that I dont want to do load
> balancing, i've just come from using PFSENSE/freebsd to use
> ClarkConnect on CentOS i guess.. i've never used iptables before. i've
> tried things like:
> 
> "iptables -A POSTROUTING -t nat -o eth2 -s 192.168.2.0/24 -d
> 67.17.117.0/24 -j MASQUERADE" and it still doesn't work.
> 
> 192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
> 24.x.x.0/23 dev eth2  proto kernel  scope link  src 24.x.x.23
> 71.x.x.0/23 dev eth3  proto kernel  scope link  src 71.x.x.6
> default via 71.x.x.1 dev eth3
> 
> so right now i have all traffic go out eth3, i'd love to have the ips
> and ipblocks i select and have it go out one of the cable interfaces.
> so for the example above, i want www.speedtest.net (because it shows
> the ip) to go out eth2 but it's still going out eth3.

If you only want to distribute outgoing traffic, thats quite easy:

- set up routing rules and tables for both connections:

ip rule add fwmark 0x1 lookup 100
ip route add default via ... dev <dev1> table 100

ip rule add fwmark 0x2 lookup 200
ip route add default via ... dev <dev2> table 200

- set up distribution, in this case using iptables and equal
shares:

iptables -t mangle -A PREROUTING -m connmark --mark 0x0 \
				 -m statistic --mode nth --every 2 \
				 -j CONNMARK --set-mark 0x1
iptables -t mangle -A PREROUTING -m connmark --mark 0x0 \
				 -j CONNMARK --set-mark 0x2

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

^ duplicate these three rules with OUTPUT instead of PREROUTING
for locally generated traffic.

You can use any criteria you like for distribution, the important
thing is to make sure connections stay on one connection when using
NAT (since many providers don't allow spoofed addresses), which is
done by checking whether the connection has already been routed
using "-m connmark --mark 0x0" before marking. You might also want
to check out the RATEEST target and match, they allow to include
the current load in the decision.

Dealing with incoming connections on both internet connections
is trickier because you need to make sure they go out the same
way they came in, so I'll skip this because I'm short on time
right now :)