balance traffic between virtual interfaces on the same network

balance traffic between virtual interfaces on the same network

[Tommaso Calosi]

Hi all,

This is my setup:

eth0:1 192.168.1.10/24
eth0:2 192.168.1.20/24
eth0:3 192.168.1.30/24

gateway 192.168.1.1

I know it's a strange question but it's crucial to do this in my setup.
I need to balance traffic between these virtual interfaces so that the
gateway sees the traffic originating from 1.10, 1.20,  and 1.30. Is it
possible?

Re: balance traffic between virtual interfaces on the same network

[Jan Engelhardt]

On Tuesday 2010-11-09 14:38, Tommaso Calosi wrote:

>Hi all,
>
>This is my setup:
>
>eth0:1 192.168.1.10/24
>eth0:2 192.168.1.20/24
>eth0:3 192.168.1.30/24
>
>gateway 192.168.1.1
>
>I know it's a strange question but it's crucial to do this in my setup.
>I need to balance traffic between these virtual interfaces

Those are not interfaces. Stop using ifconfig, it deludes the mind - use 
iproute2 instead.

Re: balance traffic between virtual interfaces on the same network

[Tommaso Calosi]

That's why i wrote "virtual interfaces". If t's not possibile, then
it'd have the same effect to masquerade outgoing connection with a nat
pool made by 192.168.1.10, 192.168.1.20 and 192.168.1.30 but since
they're originating from the firewall itself, again I don't know how.

On Tue, Nov 9, 2010 at 2:53 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
> On Tuesday 2010-11-09 14:38, Tommaso Calosi wrote:
>
>>Hi all,
>>
>>This is my setup:
>>
>>eth0:1 192.168.1.10/24
>>eth0:2 192.168.1.20/24
>>eth0:3 192.168.1.30/24
>>
>>gateway 192.168.1.1
>>
>>I know it's a strange question but it's crucial to do this in my setup.
>>I need to balance traffic between these virtual interfaces
>
> Those are not interfaces. Stop using ifconfig, it deludes the mind - use
> iproute2 instead.
>

Re: balance traffic between virtual interfaces on the same network

[Pascal Hambourg]

Tommaso Calosi a écrit :
> That's why i wrote "virtual interfaces".

eth0:* are not virtual interfaces, not interfaces at all. They are just
IPv4 aliases. Virtual interfaces are a different thing : they are "real"
interfaces (from the network stack point of view) which are just not
related to real hardware.

> If t's not possibile, then
> it'd have the same effect to masquerade outgoing connection with a nat
> pool made by 192.168.1.10, 192.168.1.20 and 192.168.1.30 but since
> they're originating from the firewall itself, again I don't know how.

You can use SNAT. It does not matter that the traffic originates from
the box. However your addresses are not contiguous and the support for
multiple --to-source options was removed long ago, so you'll have to do
the balance by other means, for example with the statistic match.

Note that it won't balance the source address on a packet basis but on a
connection basis. So if you have one very active connection and one
mostly inactive connection, most of the packets will have the same
source address.

Re: balance traffic between virtual interfaces on the same network

[Tommaso Calosi]

Thanks SNAT is what I was looking for!

On Tue, Nov 9, 2010 at 4:41 PM, Pascal Hambourg
<pascal.mail@plouf.fr.eu.org> wrote:
> Tommaso Calosi a écrit :
>> That's why i wrote "virtual interfaces".
>
> eth0:* are not virtual interfaces, not interfaces at all. They are just
> IPv4 aliases. Virtual interfaces are a different thing : they are "real"
> interfaces (from the network stack point of view) which are just not
> related to real hardware.
>
>> If t's not possibile, then
>> it'd have the same effect to masquerade outgoing connection with a nat
>> pool made by 192.168.1.10, 192.168.1.20 and 192.168.1.30 but since
>> they're originating from the firewall itself, again I don't know how.
>
> You can use SNAT. It does not matter that the traffic originates from
> the box. However your addresses are not contiguous and the support for
> multiple --to-source options was removed long ago, so you'll have to do
> the balance by other means, for example with the statistic match.
>
> Note that it won't balance the source address on a packet basis but on a
> connection basis. So if you have one very active connection and one
> mostly inactive connection, most of the packets will have the same
> source address.
>