Hello,
I have following problem with multiple gateways.
Question is: why e-mail traffic goes throught eth2? I want to pass all
e-mail traffic throught eth0 (10.48.32.1) without multiple connections
to the same destination through ONLY ONE gateway. Is it possible to
switch off load balancing(??) between gateways? I want it to be static.
Is there any way to save and restore settings from ip tool like iptables
does? (iptables-save, restore)
Here We go (addresses changed because of security):
# ip addr
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:04:ac:d9:7f:7c brd ff:ff:ff:ff:ff:ff
inet 10.48.32.10/16 brd 10.48.255.255 scope global eth0
inet 10.48.32.3/24 brd 10.48.32.255 scope global eth0:1
inet x.x.156.102/29 brd x.x.156.103 scope global eth0:2
4: eth2: <BROADCAST,UP> mtu 1500 qdisc pfifo_fast qlen 150
link/ether 00:c0:f0:4d:e2:13 brd ff:ff:ff:ff:ff:ff
inet x.x.153.158/30 brd x.x.153.159 scope global eth2
# ip rule show
0: from all lookup local
32761: from x.x.153.158 lookup formus2
32762: from 192.168.100.0/24 lookup formus2
32763: from 10.48.32.10 fwmark 4 lookup formus2
32764: from 0.0.0.0 fwmark 2 lookup rose
32765: from 10.48.64.2 lookup formus2
32766: from all lookup main
32767: from all lookup default
# iptables -L -n -v -x -t mangle
Chain PREROUTING (policy ACCEPT 3738441 packets, 2204536651 bytes)
pkts bytes target prot opt in out source
destination
93282 68889253 MARK all -- * * 0.0.0.0/0
x.x.153.158 MARK set 0x5
141 6309 MARK tcp -- * * ! x.x.153.158
x.x.153.158 tcp dpt:2000 MARK set 0x3
21289 5294990 MARK tcp -- eth0 * 0.0.0.0/0
10.48.32.10 tcp dpt:8080 MARK set 0x4
8239 1870997 TOS tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp spt:22 TOS set 0x10
101040 7491165 TOS tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:22 TOS set 0x10
Chain OUTPUT (policy ACCEPT 981349 packets, 622327299 bytes)
pkts bytes target prot opt in outq
source destination
13918 1479670 MARK tcp -- * * 10.48.32.10
!10.0.0.0/8 tcp dpt:80 MARK set 0x4
12612 15769675 MARK tcp -- * * 10.48.32.10
!10.0.0.0/8 tcp dpt:25 MARK set 0x2
18605 3526169 MARK all -- * * 10.48.64.2
!10.0.0.0/8 MARK set 0x4
12584 1208166 TOS tcp -- * *
10.48.32.10 0.0.0.0/0 tcp dpt:80 TOS set 0x08
# ip route list tab formus2
10.0.0.0/8 via 10.48.32.1 dev eth0 proto kernel
default via x.x.153.157 dev eth2
# ip route list tab rose
default via 10.48.32.1 dev eth0
# ip route list tab main
10.48.32.6 dev ppp0 proto kernel scope link src 10.48.32.10
10.48.32.1 via 10.48.32.10 dev eth0
x.x.153.156/30 dev eth2 proto kernel scope link src x.x.153.158
x.x.156.96/29 dev eth0 proto kernel scope link src x.x.156.102
192.168.100.0/24 dev eth1 proto kernel scope link src 192.168.100.1
10.48.32.0/24 dev eth0 proto kernel scope link src 10.48.32.3
10.48.0.0/16 dev eth0 proto kernel scope link src 10.48.32.10
10.0.0.0/8 via 10.48.32.1 dev eth0
127.0.0.0/8 dev lo scope link
default
nexthop via 10.48.32.1 dev eth0 weight 1
nexthop via x.x.153.157 dev eth2 weight 2
# mailq -vs
smtp/nnn.com.pl:
R/96581-30410: (2 tries, expires in 4d23h) smtp; 500 (connect to
www.nnn.com.pl [x.x.150.125|25|10.48.32.10|35339]:
Connection timed out)
# route -Cn|grep x.x.150.125
10.48.32.10 x.x.150.125 10.48.32.1 0 0 0 eth0
10.48.32.10 x.x.150.125 x.x.153.157 0 0 5 eth2
10.48.32.10 x.x.150.125 x.x.153.157 0 0 0 eth2
(one destination routed throught two interfaces?)
# iptables -L -n -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT all -- !10.48.0.0/24 10.48.32.3 to:192.168.100.1
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 MARK match
0x4 to:62.32.153.158
SNAT all -- 10.48.64.2 !10.0.0.0/8 to:
x.x.153.158
SNAT all -- 192.168.100.0/24 !192.168.100.0/24 to:x.x.153.158
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
My networks:
10/8 - intranet
10.48.64.2/32 - me (I want to be routed through eth2 except e-mail
traffic)
others - routed normally through eth0 except squid connections.
I wrote the following startup script:
#!/bin/bash
IP=''/sbin/ip''
SRCHOST=''10.48.64.2''
D1L=''x.x.153.158''
D1R=''x.x.153.157''
D2L=''10.48.32.10'' # local out if
D2R=''10.48.32.1'' # remote out if
HIT=''192.168.100.1'' # Hitachi
echo "0" >/proc/sys/net/ipv4/conf/all/rp_filter
$IP link set eth2 dynamic on multicast off txqueuelen 150
$IP route del default via 10.48.32.1 dev eth0
$IP route add default via $D1R dev eth2 table formus2 proto kernel
$IP route add default via $D2R dev eth0 table rose proto kernel
$IP route add to 10/8 via $D2R dev eth0
#$IP route add to $D2R/32 dev eth0 via $D2L
$IP rule add from $SRCHOST table formus2
$IP rule add from all table rose fwmark 02 # use
rose if mark is 2
$IP rule add from $D2L table formus2 fwmark 04 # Squid from
10.48.32.10 out by eth2
$IP rule add from 192.168.100.0/24 table formus2
$IP rule add from $D1L table formus2
$IP rule add from $D2L table rose
$IP route add proto kernel default nexthop via 10.48.32.1 weight 1 dev
eth0 nexthop via x.x.153.157 weight 2 dev eth2
$IP route add table formus2 from 10.48.64.0/24 to 10/8 via 10.48.32.1
dev eth0 proto kernel
$IP route flush cache
# ip -V
ip utility, iproute2-ss010824
Further thanks,
Wojtek Sobola
Unix System Engineer
S&T Poland