Folks, Ive got two ISP connections that I am using with: --- ip route add 192.168.200.0/24 dev eth2 src 192.168.200.11 table connection1 ip route add default via 192.168.200.1 table connection1 ip route add x.175.244.0/24 dev eth1 src x.175.244.2 table connection2 ip route add default via x.175.244.1 table connection2 ip rule add from 192.168.200.11 table connection1 ip rule add from x.175.244.2 table connection2 echo "Enabling load balancing between ISP connections..." ip route add default scope global nexthop via 192.168.200.1 dev eth2 weight 1 nexthop via x.175.244.1 dev eth1 weight 1 iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to x.175.244.2 iptables -t nat -A POSTROUTING -o eth2 -j SNAT --to 192.168.200.11 --- The 192.168.200.x (lan) network gets to the internet via another gateway (192.168.200.1). Client machines on the 200.x network work ok except for ssh connections to machines on the internet hanging. It asks for a password and hangs. Any ideas? Thanks Korey
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello there, : The 192.168.200.x (lan) network gets to the internet via another : gateway (192.168.200.1). Client machines on the 200.x network : work ok except for ssh connections to machines on the internet : hanging. It asks for a password and hangs. Any ideas? Thanks Yes. Vincent Jaussaud had a very similar problem (though much larger than yours) several years ago [0]. If you run tcpdump on the client and watch for the ToS to change (just after authentication), it should become very clear what is happening. You must remember that the the tuple on which a route is selected includes the ToS. So, after you have tried to connect to the ssh server in the public Internet from the inside (watching with tcpdump, of course), run "ip route show cache $DEST_IP" and compare the set of results. If that''s at all unclear, maybe this will also help [1]. Good luck, - -Martin [0] http://mailman.ds9a.nl/pipermail/lartc/2002q4/005653.html [1] http://linux-ip.net/html/routing-selection.html#tb-routing-selection-adv - -- Martin A. Brown http://linux-ip.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: pgf-0.72 (http://linux-ip.net/sw/pine-gpg-filter/) iD8DBQFF42TLHEoZD1iZ+YcRAlZqAKCrpGmNKdyCUUwExGW2MWLUQqMzzwCgiKY6 czRMryHmcM9HBGdKkFfWUgg=Pgu8 -----END PGP SIGNATURE-----
From: "Korey O''Dell" <korey@zaneray.com>> > The 192.168.200.x (lan) network gets to the internet via another gateway > (192.168.200.1). > Client machines on the 200.x network work ok except for ssh connections > to machines on the internet hanging. It asks for a password and hangs. > Any ideas? Thanks Korey >SSH is a good test of whether you have set up your multiple uplinks correctly. You need CONNMARK, so that once a session is established with one uplink, it continues to stay with the same uplink. SSH does not like it if you change uplink in the middle of one session. Cheers.
Hello korey, I don''t think your configuration will work well, because there''re balancing using "weight" connection. So, if you have connection-oriented-application that must sure passing their traffic only from one connection (such as ssh and https-please try to test open and login to hotmail.com), it will fail when the default routing switch from one gateway to another (round robin). Dont use this config for connection-oriented application. it''s round robin rule, that will switch from one gateway to another without notice/know about traffic type. "ip route add default scope global nexthop via 192.168.200.1 dev eth2 weight 1 nexthop via x.175.244.1 dev eth1 weight 1" please refer to this documentation howto develop multpile internet connection gateway. http://linux-ip.net/html/adv-multi-internet.html Best Regards, Denny Z On 2/27/07, Korey O''Dell <korey@zaneray.com> wrote:> Folks, > Ive got two ISP connections that I am using with: > --- > ip route add 192.168.200.0/24 dev eth2 src 192.168.200.11 table connection1 > ip route add default via 192.168.200.1 table connection1 > > ip route add x.175.244.0/24 dev eth1 src x.175.244.2 table connection2 > ip route add default via x.175.244.1 table connection2 > > ip rule add from 192.168.200.11 table connection1 > ip rule add from x.175.244.2 table connection2 > > echo "Enabling load balancing between ISP connections..." > ip route add default scope global nexthop via 192.168.200.1 dev eth2 > weight 1 nexthop via x.175.244.1 dev eth1 weight 1 > > iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to x.175.244.2 > iptables -t nat -A POSTROUTING -o eth2 -j SNAT --to 192.168.200.11 >
On Tue, Feb 27, 2007 at 08:12:17AM +0700, Denny Zulfikar wrote:> Hello korey, > > I don''t think your configuration will work well, because there''re > balancing using "weight" connection. So, if you have > connection-oriented-application that must sure passing their traffic > only from one connection (such as ssh and https-please try to test > open and login to hotmail.com), it will fail when the default routing > switch from one gateway to another (round robin). > > Dont use this config for connection-oriented application. it''s round > robin rule, that will switch from one gateway to another without > notice/know about traffic type. > "ip route add default scope global nexthop via 192.168.200.1 dev eth2 > weight 1 nexthop via x.175.244.1 dev eth1 weight 1"I have been using default proto static metric 5 nexthop via 138.130.8.1 dev vlan2 weight 1 nexthop via 10.20.20.243 dev ppp0 weight 20 for over 4 years and it has worked fine for me, for ssh and other connection oriented applications. the key thing is to have contrack (or its new incarnation) loaded. the default rule is only used when you don''t have a source address or route cache entry. When you ssh through the machine, the syn packet uses the default route, but it also setups a entry in contrack, all other packets will have a source and dest address. These will match up the ip rul statements. if you followed your link onto julian pages http://www.ssi.bg/~ja/nano.txt, there is a howto on this !> > please refer to this documentation howto develop multpile internet > connection gateway. > http://linux-ip.net/html/adv-multi-internet.html > > Best Regards, > Denny Z > > > On 2/27/07, Korey O''Dell <korey@zaneray.com> wrote: > >Folks, > >Ive got two ISP connections that I am using with: > >--- > >ip route add 192.168.200.0/24 dev eth2 src 192.168.200.11 table connection1 > >ip route add default via 192.168.200.1 table connection1 > > > >ip route add x.175.244.0/24 dev eth1 src x.175.244.2 table connection2 > >ip route add default via x.175.244.1 table connection2 > > > >ip rule add from 192.168.200.11 table connection1 > >ip rule add from x.175.244.2 table connection2 > > > >echo "Enabling load balancing between ISP connections..." > >ip route add default scope global nexthop via 192.168.200.1 dev eth2 > >weight 1 nexthop via x.175.244.1 dev eth1 weight 1 > > > >iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to x.175.244.2 > >iptables -t nat -A POSTROUTING -o eth2 -j SNAT --to 192.168.200.11 > > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc >_______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
On Monday 26 February 2007 18:43, Korey O''Dell wrote:> Folks, > Ive got two ISP connections that I am using with: > --- > ip route add 192.168.200.0/24 dev eth2 src 192.168.200.11 table connection1 > ip route add default via 192.168.200.1 table connection1 > > ip route add x.175.244.0/24 dev eth1 src x.175.244.2 table connection2 > ip route add default via x.175.244.1 table connection2 > > ip rule add from 192.168.200.11 table connection1 > ip rule add from x.175.244.2 table connection2 > > echo "Enabling load balancing between ISP connections..." > ip route add default scope global nexthop via 192.168.200.1 dev eth2 > weight 1 nexthop via x.175.244.1 dev eth1 weight 1 > > iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to x.175.244.2 > iptables -t nat -A POSTROUTING -o eth2 -j SNAT --to 192.168.200.11 > > --- > > > The 192.168.200.x (lan) network gets to the internet via another gateway > (192.168.200.1). > Client machines on the 200.x network work ok except for ssh connections > to machines on the internet hanging. It asks for a password and hangs. > Any ideas? Thanks KoreyYes your hit a big FAQ, read this[1][2] thread (from this same week). There are two alternatives full solutions explained to that problem, both uses netfilter CONNMARK. [1]http://mailman.ds9a.nl/pipermail/lartc/2007q1/020354.html [2]http://mailman.ds9a.nl/pipermail/lartc/2007q1/020360.html -- Luciano