LARTC - Dec 2005 - Routing multiple conntections to the same ISP

Hi,
 
I have established two connections to the same ISP. After that ip route list
showed this:
 
195.14.247.94 dev ppp0  proto kernel  scope link  src 81.173.141.207
195.14.247.94 dev ppp1  proto kernel  scope link  src 81.173.237.84
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
default via 195.14.247.94 dev ppp0

I want 192.168.0.2 to connect to the internet by ppp1 and all other
computers to connect by ppp0. So I entered following commands in the shell:
 
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables --table filter --policy FORWARD ACCEPT
 
iptables --table mangle --append PREROUTING -s 192.168.0.2 --jump MARK
--set-mark 4
ip rule add fwmark 4 table 4
 
Then I modified the main table and table 4, so that they looked like this:
 
Server:~# ip route list
195.14.247.94 dev ppp0  proto kernel  scope link  src 81.173.141.207
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
default via 195.14.247.94 dev ppp0

Server:~# ip route list table 4
195.14.247.94 dev ppp1  proto kernel  scope link  src 81.173.237.84
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
default via 195.14.247.94 dev ppp1
 
an entered ip route flush cache in the shell.
 
But after this, 192.168.0.2 could not connect to the internet anymore.
 
What is wrong with my routing tables?
 
Thanks,
 
Ole


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Oops, I sent it to netfilter instead. :O Well, there you go!

---------- Forwarded message ----------
From: Edmundo Carmona <eantoranz@gmail.com>
Date: Dec 31, 2005 10:48 AM
Subject: Re: [LARTC] Routing multiple conntections to the same ISP
To: netfilter@lists.netfilter.org


I think it''s wrong.

Your original configuration was only migssing one entry: from
192.168.0.2 use table 4

it would be something like:
ip rule add pref 32000 from 192.168.0.2 table 4

and in table 4 you just need to have the default GW through the
desired device and that devices IP as the source.

Hope that''s something you can start working with.

On 12/31/05, Niels Ole Salscheider <niels_ole@salscheider-online.de>
wrote:
>
> Hi,
>
> I have established two connections to the same ISP. After that ip route
list
> showed this:
>
> 195.14.247.94 dev ppp0  proto kernel  scope link  src 81.173.141.207
> 195.14.247.94 dev ppp1  proto kernel  scope link  src 81.173.237.84
> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
> default via 195.14.247.94 dev ppp0
>
> I want 192.168.0.2 to connect to the internet by ppp1 and all other
> computers to connect by ppp0. So I entered following commands in the shell:
>
> echo "1" > /proc/sys/net/ipv4/ip_forward
> iptables --table filter --policy FORWARD ACCEPT
>
> iptables --table mangle --append PREROUTING -s 192.168.0.2 --jump MARK
> --set-mark 4
> ip rule add fwmark 4 table 4
>
> Then I modified the main table and table 4, so that they looked like this:
>
> Server:~# ip route list
> 195.14.247.94 dev ppp0  proto kernel  scope link  src 81.173.141.207
> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
> default via 195.14.247.94 dev ppp0
>
> Server:~# ip route list table 4
> 195.14.247.94 dev ppp1  proto kernel  scope link  src 81.173.237.84
> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
> default via 195.14.247.94 dev ppp1
>
> an entered ip route flush cache in the shell.
>
> But after this, 192.168.0.2 could not connect to the internet anymore.
>
> What is wrong with my routing tables?
>
> Thanks,
>
> Ole
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
>
>

Hello Ole,

 : an entered ip route flush cache in the shell.
 :  
 : But after this, 192.168.0.2 could not connect to the internet anymore.
 :  
 : What is wrong with my routing tables?

At first glance, I see nothing wrong with your routing tables, but 
suggest that you may wish to examine the rp_filter sysctl.  Try your 
experiment again, but make sure you turn off the reverse path 
filtering.  Reverse path filtering, in case you are unaware of it, 
is essentially a kernel-level anti-spoofing mechanism.

-Martin

 [0] http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html (missing?)
     http://madchat.org/sysadm/linux/ipsysctl-tutorial.html#AEN634

-- 
Martin A. Brown --- Wonderfrog Enterprises --- martin@wonderfrog.net