Using set mark to split traffic against 2 IF

Using set mark to split traffic against 2 IF

[Daniel huhardeaux]

Hello,

I'm running a Debian Squeeze with iptables 1.4.8. The server has 3 
physical interfaces, local one (eth2) being bridged as br0. Both other 
interfaces are connected too 2 providers in ADSL (eth0) and SDSL (eth1).

Default route is going out through eth1. Two computers are going out 
using eth1, ip rule make this setup working.

What I want now, is to mark packets 0x1 for eth0 0x2 (or nothing) for 
eth1, so I will be able to use the links by services for instane (like 
ssh and http connections going out using eth0, doesn't matter which 
computer) rest of traffic using the default route.

My mangle table (Relevant part):

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:CONNMARK1 - [0:0]
:CONNMARK2 - [0:0]
:RESTOREMARK - [0:0]
-A PREROUTING -j RESTOREMARK
-A PREROUTING -s 192.168.10.6/32 -m mark --mark 0x0 -j CONNMARK1
-A PREROUTING -p tcp -m mark --mark 0x0 -m tcp --sport 55555 -j CONNMARK1
-A POSTROUTING -p tcp -m mark --mark 0x0 -m tcp --dport 55555 -j CONNMARK1
-A POSTROUTING -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 
0xffffffff
-A CONNMARK1 -j LOG --log-prefix "MARK=1" --log-level 5
-A CONNMARK1 -j CONNMARK --set-xmark 0x1/0xffffffff
-A CONNMARK2 -j LOG --log-prefix "MARK=2" --log-level 5
-A CONNMARK2 -j CONNMARK --set-xmark 0x2/0xffffffff
-A RESTOREMARK -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 
0xffffffff
COMMIT

Nat Table

-A POSTROUTING -m mark --mark 0x1 -j SNAT --to-source xxx.xxx.xxx.xxx
-A POSTROUTING -j SNAT --to-source yyy.yyy.yyy.yyy

xxx.xxx.xxx.xxx being public IP address of eth0/Provider 1
yyy.yyy.yyy.yyy being public IP address of eth1/Provider 2

Now I run nc -kl 55555 on an outside server as well as tshark - i eth0 
port 55555. From the office router or from a worksattion from the 
intranet I run nc -vvv <ip of far server> 55555 as well as tshark -i 
eth0 dst <ip of far server> What I see is that the trafic is still going 
out using default route insteed of eth0/IP xxx.xxx.xxx.xxx

What is wrong with my setup?

Thanks for any hint.

-- 
Daniel

Re: Using set mark to split traffic against 2 IF

[Daniel huhardeaux]

Le 25/02/2013 15:28, Daniel huhardeaux a écrit :
> Hello,
>
> I'm running a Debian Squeeze with iptables 1.4.8. The server has 3 
> physical interfaces, local one (eth2) being bridged as br0. Both other 
> interfaces are connected too 2 providers in ADSL (eth0) and SDSL (eth1).
>
> Default route is going out through eth1. Two computers are going out 
> using eth1, ip rule make this setup working.
>
> What I want now, is to mark packets 0x1 for eth0 0x2 (or nothing) for 
> eth1, so I will be able to use the links by services for instane (like 
> ssh and http connections going out using eth0, doesn't matter which 
> computer) rest of traffic using the default route.

I got it, for archives. Two problems:

. -J CONNMARK doesn't do the job as -j MARK does
. have to deativate reverse path filtering which protect from IP 
spoofing ( /etc/sysctl.conf net.ipv4.conf.all.rp_filter =0)

More info here 
http://www.sysresccd.org/Sysresccd-Networking-EN-Iptables-and-netfilter-load-balancing-using-connmark

Regards

-- 
TOOTAi