Good day
I have two connections to one ISP with IP addresses in different subnetworks
(eth0 123.123.123.206/255.255.255.240 (gw 123.123.123.200)
and eth3 123.123.123.234/255.255.255.224 (gw 123.123.123.225)).
123.123.123.* - of course not real IPs (I masked them).
And there is one connection to LAN (eth2 10.20.30.4/255.255.255.248)
I want to set up a gateway in which two internet connections would be like one
but wider.
I want to use NTH or RANDOM method of netfilter to split traffic from users
(they use IPs 192.168.32.0/24, 192.168.64.0/24, 192.168.128.0/24,
192.168.250.0/24 through PPTP server 10.20.30.3)
between two internet links.
I have a problem:
I tried to ping 111.111.111.2 (not real IP) from 10.20.30.3 - traffic goes
with no problems via eth0 but it doesn't via eth3.
I sniffed with tcpdump and saw that packets are going out and in via eth3 but
gate doesn't put it on eth2 to send it to 10.20.30.3.
I put some markers to iptables config (-j LOG) and here is what I got
ping came through
[root@host user]# tailf /var/log/syslog |grep 111.111.111.2|grep iptables_
Feb 26 20:36:14 kit kernel: iptables_mangle_prerouting: IN=eth2 OUT=
MAC=00:00:e8:11:18:f2:00:30:48:55:f0:15:08:00 SRC=10.20.30.3 DST=111.111.111.2
LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=11246 PROTO=ICMP TYPE=8 CODE=0 ID=512
SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_nat_prerouting: IN=eth2 OUT=
MAC=00:00:e8:11:18:f2:00:30:48:55:f0:15:08:00 SRC=10.20.30.3 DST=111.111.111.2
LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=11246 PROTO=ICMP TYPE=8 CODE=0 ID=512
SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_mangle_forward: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_mangle_new: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_marked_0: IN=eth2 OUT=eth0 SRC=10.20.30.3
DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246 PROTO=ICMP TYPE=8
CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_after_new: IN=eth2 OUT=eth0 SRC=10.20.30.3
DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246 PROTO=ICMP TYPE=8
CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_after_ROUTE_0: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_after_ROUTE_1: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_filter_forward: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_mangle_postrouting: IN= OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_nat_postrouting: IN= OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=11246
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_mangle_prerouting: IN=eth0 OUT=
MAC=00:e0:91:03:18:59:00:13:20:42:7c:f5:08:00 SRC=111.111.111.2
DST=123.123.123.206 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=17571 PROTO=ICMP TYPE=0
CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_mangle_forward: IN=eth0 OUT=eth2
SRC=111.111.111.2 DST=10.20.30.3 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=17571
PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=30209
Feb 26 20:36:14 kit kernel: iptables_after_new: IN=eth0 OUT=eth2
SRC=111.111.111.2 DST=10.20.30.3 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=17571
PROTO=ICMP TYPE=0 CODE=0 ID=512 SEQ=30209
ping didn't come through
[root@host user]# tailf /var/log/syslog |grep 111.111.111.2|grep iptables_
Feb 26 20:38:26 kit kernel: iptables_mangle_prerouting: IN=eth2 OUT=
MAC=00:00:e8:11:18:f2:00:30:48:55:f0:15:08:00 SRC=10.20.30.3 DST=111.111.111.2
LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=7823 PROTO=ICMP TYPE=8 CODE=0 ID=512
SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_nat_prerouting: IN=eth2 OUT=
MAC=00:00:e8:11:18:f2:00:30:48:55:f0:15:08:00 SRC=10.20.30.3 DST=111.111.111.2
LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=7823 PROTO=ICMP TYPE=8 CODE=0 ID=512
SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_mangle_forward: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_mangle_new: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_marked_0: IN=eth2 OUT=eth0 SRC=10.20.30.3
DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823 PROTO=ICMP TYPE=8
CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_marked_1: IN=eth2 OUT=eth0 SRC=10.20.30.3
DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823 PROTO=ICMP TYPE=8
CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_after_new: IN=eth2 OUT=eth0 SRC=10.20.30.3
DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823 PROTO=ICMP TYPE=8
CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_after_ROUTE_0: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_after_ROUTE_1: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_filter_forward: IN=eth2 OUT=eth0
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_mangle_postrouting: IN= OUT=eth3
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_nat_postrouting: IN= OUT=eth3
SRC=10.20.30.3 DST=111.111.111.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=7823
PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=30465
Feb 26 20:38:26 kit kernel: iptables_mangle_prerouting: IN=eth3 OUT=
MAC=00:c0:26:aa:13:03:00:07:e9:2a:97:73:08:00 SRC=111.111.111.2
DST=123.123.123.234 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=51251 PROTO=ICMP TYPE=0
CODE=0 ID=512 SEQ=30465
As you can see ICMP packets goes via eth0 with no problems. But when it goes
via eth3, it goes out and comes back but it's lost somewhere after
iptables_mangle_prerouting.
What can it be ??? May be some things should be added to routing?
[root@host user]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.20.30.0 * 255.255.255.248 U 10 0 0 eth2
123.123.123.192 * 255.255.255.240 U 10 0 0 eth0
123.123.123.224 * 255.255.255.224 U 35 0 0 eth3
default 123.123.123.200 0.0.0.0 UG 10 0 0 eth0
Forwarding is enabled as you can see
[root@host user]# cat /proc/sys/net/ipv4/ip_forward
1
Here is what iptables-save tells
# Generated by iptables-save v1.3.7 on Sun Feb 18 04:53:06 2007
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -p icmp -j LOG --log-prefix "iptables_nat_postrouting: "
-A POSTROUTING -s 123.123.123.192/255.255.255.240 -j ACCEPT
-A POSTROUTING -o eth0 -j SNAT --to-source 123.123.123.206
-A POSTROUTING -o eth3 -j SNAT --to-source 123.123.123.234
-A PREROUTING -p icmp -j LOG --log-prefix "iptables_nat_prerouting: "
-A OUTPUT -p icmp -j LOG --log-prefix "iptables_nat_ouput: "
-A POSTROUTING -p icmp -j LOG --log-prefix "iptables_after_nat: "
COMMIT
# Completed on Sun Feb 18 04:53:06 2007
# Generated by iptables-save v1.3.7 on Sun Feb 18 04:53:06 2007
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:NEW_OUT_CONN - [0:0]
-A PREROUTING -p icmp -j LOG --log-prefix "iptables_mangle_prerouting: "
-A INPUT -p icmp -j LOG --log-prefix "iptables_mangle_input: "
-A FORWARD -p icmp -j LOG --log-prefix "iptables_mangle_forward: "
-A OUTPUT -p icmp -j LOG --log-prefix "iptables_mangle_ouput: "
-A POSTROUTING -p icmp -j LOG --log-prefix "iptables_mangle_postrouting: "
-A FORWARD -d 123.123.123.192/255.255.255.240 -j ACCEPT
-A FORWARD -d 123.123.123.224/255.255.255.224 -j ACCEPT
-A FORWARD -m state --state NEW -j NEW_OUT_CONN
-A NEW_OUT_CONN -p icmp -j LOG --log-prefix "iptables_mangle_new: "
-A NEW_OUT_CONN -j CONNMARK --set-mark 0
-A NEW_OUT_CONN -p icmp -j LOG --log-prefix "iptables_marked_0: "
-A NEW_OUT_CONN -m statistic -j RETURN --mode nth --every 2 --packet 0
-A NEW_OUT_CONN -j CONNMARK --set-mark 1
-A NEW_OUT_CONN -p icmp -j LOG --log-prefix "iptables_marked_1: "
-A NEW_OUT_CONN -m statistic -j RETURN --mode nth --every 2 --packet 1
-A FORWARD -p icmp -j LOG --log-prefix "iptables_after_new: "
-A FORWARD -m connmark -i eth2 -j ROUTE --mark 0 --gw 123.123.123.200
--continue
-A FORWARD -p icmp -j LOG --log-prefix "iptables_after_ROUTE_0: "
-A FORWARD -m connmark -i eth2 -j ROUTE --mark 1 --gw 123.123.123.225
--continue
-A FORWARD -p icmp -j LOG --log-prefix "iptables_after_ROUTE_1: "
COMMIT
# Completed on Sun Feb 18 04:53:06 2007
# Generated by iptables-save v1.3.7 on Sun Feb 18 04:53:06 2007
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p icmp -j LOG --log-prefix "iptables_filter_input: "
-A INPUT -i lo -j ACCEPT
-A FORWARD -p icmp -j LOG --log-prefix "iptables_filter_forward: "
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -s 10.20.30.0/255.255.255.248 -i eth2 -j ACCEPT
-A FORWARD -d 10.20.30.0/255.255.255.248 -o eth2 -j ACCEPT
-A FORWARD -s 192.168.32.0/255.255.255.0 -i eth2 -j ACCEPT
-A FORWARD -s 192.168.64.0/255.255.255.0 -i eth2 -j ACCEPT
-A FORWARD -s 192.168.128.0/255.255.255.0 -i eth2 -j ACCEPT
-A FORWARD -s 192.168.250.0/255.255.255.0 -i eth2 -j ACCEPT
-A FORWARD -s 123.123.123.192/255.255.255.240 -i eth2 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -s 10.20.30.0/255.255.255.248 -i eth2 -j ACCEPT
# Don't pay attention to next one - it's for future use
-A INPUT -p tcp -m tcp -m multiport -d 123.123.123.201 -j ACCEPT --dports
21,25,53,80
-A OUTPUT -p icmp -j LOG --log-prefix "iptables_filter_ouput: "
# It's for disabling traceroute through the gate (I think it should work and
shouldn't stop icmp ping requests/replies)
-A OUTPUT -p icmp -m icmp -s 10.20.30.0/255.255.255.248 --icmp-type
ttl-zero-during-transit -j DROP
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
COMMIT
# Completed on Sun Feb 18 04:53:06 2007
By the way I have Mandriva 2007 installed, kernel 2.6.20 and iptables 1.3.7
pached with patch-o-matic-ng-20070217 (ROUTE enabled)
___________________________________________________
Узнай о ВИЧ/СПИД больше!
www.helpme.com.ua ICQ 271 324 528
|