Omar,
It looks like you want to set a different default route for the
10.0.0.0/24 network. This can be done as follows:
# ip route add default via 192.168.1.1 table 1
# ip rule add from 10.0.0.0/24 table 1
Your iptables line should work just dandily.....
I think what you are getting confused about is why your existing route
doesn''t work. I''d suggest thinking about the name of the
chain in the nat
table: POSTROUTING!!
Unless routing table 1 contains something else, there''s no explicit
instruction for the outbound packets from 10.0.0.0/24. Add a default
route to that table, and you should have a better solution.
Check out "Multiple Connections to the Internet" in Chapter 7 in my
guide (which is still in the process of being written):
http://plorf.net/linux-ip/
Good luck,
-Martin
: I have the next network:
:
:
: Users LAN Servers LAN
: (10.0.0.0/24 (mail and web [200.30.57.32/24]
: web surf main activity) homologated ip''s)
: | |
: | |
: | |
: | |
: |________________________________|
: |
: eth1:1 10.0.0.138 | eth1 200.30.57.33
: |
: {Linux Firewall. kernel 2.4.18}
: |
: eth2 | eth0 200.30.53.22/30
: 192.168.1.2/30|
: |
: _______________/ \______________
: | |
: | |
: {adsl router} {Cisco router} 200.30.53.21/30
: |192.168.1.1 |
: |(phone line) |(DS0)
: | |
: | |
: { -------- Internet ------- }
:
:
:
:
: A network with two links to internet: a DS0 and an adsl.
:
: I want that servers with homologated ip''s go via the DS0, and end
users,
: with 10.0.0.0 addresses go via adsl. Both links through the same
: firewall.
:
: Also, end users must have Nat, and servers dont. For this i use:
: iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth2 -j MASQUERADE
:
: The default gateway in the firewall is the cisco router, my question is:
: How can I make to force packets from 10.0.0.0 go via eth2(192.168.1.2) ?
:
:
: I imagine something like:
:
: ip route add 192.168.1.1/30 via 192.168.1.2 table 1
: ip rule add from 10.0.0.0/24 table 1
:
:
: But doesn''t work. What''d be the correct way to do it?
:
:
: Omar
:
:
:
:
:
:
:
: _______________________________________________
: LARTC mailing list / LARTC@mailman.ds9a.nl
: http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
:
--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
I have the next network:
Users LAN Servers LAN
(10.0.0.0/24 (mail and web [200.30.57.32/24]
web surf main activity) homologated ip''s)
| |
| |
| |
| |
|________________________________|
|
eth1:1 10.0.0.138 | eth1 200.30.57.33
|
{Linux Firewall. kernel 2.4.18}
|
eth2 | eth0 200.30.53.22/30
192.168.1.2/30|
|
_______________/ \______________
| |
| |
{adsl router} {Cisco router} 200.30.53.21/30
|192.168.1.1 |
|(phone line) |(DS0)
| |
| |
{ -------- Internet ------- }
A network with two links to internet: a DS0 and an adsl.
I want that servers with homologated ip''s go via the DS0, and end
users,
with 10.0.0.0 addresses go via adsl. Both links through the same
firewall.
Also, end users must have Nat, and servers dont. For this i use:
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth2 -j MASQUERADE
The default gateway in the firewall is the cisco router, my question is:
How can I make to force packets from 10.0.0.0 go via eth2(192.168.1.2) ?
I imagine something like:
ip route add 192.168.1.1/30 via 192.168.1.2 table 1
ip rule add from 10.0.0.0/24 table 1
But doesn''t work. What''d be the correct way to do it?
Omar
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> # ip route add default via 192.168.1.1 table 1 > # ip rule add from 10.0.0.0/24 table 1 > > > : I have the next network: > : > : > : Users LAN Servers LAN > : (10.0.0.0/24 (mail and web [200.30.57.32/24] > : web surf main activity) homologated ip''s) > : | | > : | | > : | | > : | | > : |________________________________| > : | > : eth1:1 10.0.0.138 | eth1 200.30.57.33 > : | > : {Linux Firewall. kernel 2.4.18} > : | > : eth2 | eth0 200.30.53.22/30 > : 192.168.1.2/30| > : | > : _______________/ \______________ > : | | > : | | > : {adsl router} {Cisco router} 200.30.53.21/30 > : |192.168.1.1 | > : |(phone line) |(DS0) > : | | > : | | > : { -------- Internet ------- } > : > : > :Thanks, Martin. It worked(since last week) perfect. Now I have the above network working. Users from class 10.0.0.0/24 go out through the adsl router, and the servers via the DS0. NowI want to put a transparent proxy with squid, but if I configure it with just: iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 http requests are processed via the DS0(this is because of the default gw , I suppose), and I want them to go out via the adsl My question is, how can I make that http requests go via the adsl with a transparent proxy with this network configuration? I''ve thought it must be the OUTPUT chain. But with what rule? Hope you can orient me. Thanks, Omar _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
On 14 Oct 2002, Omar Armas wrote:> Now I have the above network working. Users from class 10.0.0.0/24 go > out through the adsl router, and the servers via the DS0. > > NowI want to put a transparent proxy with squid, but if I configure it > with just: > > iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j > REDIRECT --to-ports 3128 > > http requests are processed via the DS0(this is because of the default > gw , I suppose), and I want them to go out via the adsl > > My question is, how can I make that http requests go via the adsl with a > transparent proxy with this network configuration? > > I''ve thought it must be the OUTPUT chain. But with what rule?None. :-) Do not think of it as packet mangling, but as a squid configuration. To be exact, there are two config values which should be especially interesting for you: tcp_outgoing_address 192.168.4.55 udp_outgoing_address 192.168.4.55 ...where 192.168.4.55 is the IP of your ADSL connection interface. :-) HTH, HAND, QNeX _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/