Sorry, that was a mistake, the actual scenario is the following :
______
<hub1> <-------> |Switch| ______
| | | | eth2
<hub2> <-------> | | |Linux | <---------->
Router ADSL1
. | | eth3 | |192.168.3.5 192.168.3.6
. | | <-----> | Box |
. | |192.169.1.1| | eth0
. | | | | <----------> Router ADSL2
<hub24> <------> |______| |______|192.168.4.2
192.168.4.1
-----BEGIN PGP SIGNED MESSAGE----->Hash: SHA1
>
>On Sunday 06 April 2003 17:56, GoMi . scrawled:
> > Hi there, since i failed to shape traffic due to p2p programs, i am
> > thinking about splitting my internet connection. Here is the scenario
>once
> > again for those who haven''t red any of my emails :)
> >
> > ______
> > <hub1> <-------> |Switch| ______
> >
> > | | | | eth0
> >
> > <hub2> <-------> | | |Linux |
<----------> Router ADSL1
> > . | | eth3 | |192.168.3.5 192.168.3.6
> > . | | <-----> | Box |
> > . | |192.169.1.1| | eth2
> > . | | | | <----------> Router
ADSL2
> > <hub24> <------> |______| |______|192.168.4.2
192.168.4.1
> >
> > I wanto to have one ADSL only for web/mail/ssh/etc.. and the other one
>only
> > for massive downloads.
> >
> > The problem comes with connection tracking, it looks like its not
>working,
> > probably i am doing something wrong. Where is connection_tracking
being
> > done, in the POSTROUTING or in the PREROUTING chain? i do my SNAT
>depending
> > on the --destination-port option, and i am using a stateful firewall,
> > anyone having the same troble, anyone can light me up? :)
> >
> > PD: Sorry for my poor english :)
> >
> > ##################################################
> > ## SNAT
> > ##
> >
> > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/16 -p tcp
--dport
> > 0:1024 -j SNAT --to 192.168.3.5
> > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/16 -p udp
--dport
> > 0:1024 -j SNAT --to 192.168.3.5
> >
> > iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/16 -p tcp
--dport
> > 1024: -j SNAT --to 192.168.4.2
> > iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/16 -p udp
--dport
> > 1024: -j SNAT --to 192.168.4.2
> >
> > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/16 -j SNAT --to
> > 192.168.3.5
> >
> >
> > ####################################################
> > ## Stateful Firewall
> > ##
> >
> > iptables -t filter -N keep_state
> > iptables -t filter -A keep_state -m state --state
> > RELATED,ESTABLISHED -j ACCEPT
> > iptables -t filter -A keep_state -j RETURN
> >
> > iptables -t nat -N keep_state
> > iptables -t nat -A keep_state -m state --state
>RELATED,ESTABLISHED
> > -j ACCEPT
> > iptables -t nat -A keep_state -j RETURN
> >
> > iptables -t nat -A PREROUTING -j keep_state
> > iptables -t nat -A POSTROUTING -j keep_state
> > iptables -t nat -A OUTPUT -j keep_state
> >
> > iptables -t filter -A INPUT -j keep_state
> > iptables -t filter -A OUTPUT -j keep_state
> > iptables -t filter -A FORWARD -j keep_state
> >
> >
> > _________________________________________________________________
> > Charla con tus amigos en línea mediante MSN Messenger:
> > http://messenger.yupimsn.com/
> >
> > _______________________________________________
> > LARTC mailing list / LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>hi,
> you are SNATting outgoing traffic on eth0 with the IP address of eth2
>(192.168.4.2) and vice versa.
>
> > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/16 -p tcp
--dport
> > 0:1024 -j SNAT --to 192.168.3.5
>
> typo or this was the error??
>
>thanks,
>ashok
>
>- --
>-
>-----------------------------------------------------------------------------
>My public key:
> gpg --recv-keys --keyserver blackhole.pca.dfn.de DCB44F2E
>-
>-----------------------------------------------------------------------------
>"...there is nothing so unnatural as the commonplace."
>Sir Arthur Conan Doyle in "Adventures of Sherlock Holmes: A Case of
>Identity"
>-
>-----------------------------------------------------------------------------
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.0.7 (GNU/Linux)
>
>iD8DBQE+kPAZRhXpVty0Ty4RAiHmAKDeh/43Uao6fTdYmj2+7EiXpyzzlACeNo7E
>zLCuLmTsRKUVcbI1wca7mp0>=XA1n
>-----END PGP SIGNATURE-----
>
>_______________________________________________
>LARTC mailing list / LARTC@mailman.ds9a.nl
>http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
_________________________________________________________________
Charla con tus amigos en línea mediante MSN Messenger:
http://messenger.yupimsn.com/
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/