iptables with policy routing

Hi,

Below is my Linux firewall network configuration: -

eth0 - isp 1, IP: 1.1.1.10, Netmask: 255.255.255.252 eth1 - isp 2, IP: 2.2.2.10, Netmask: 255.255.255.252 eth2 - lan, IP: 172.16.0.254, Netmask: 255.255.255.0 eth3 - dmz, 192.168.0.254, Netmask: 255.255.255.0

isp 1 gateway: 1.1.1.9
isp 2 gateway: 2.2.2.9

Below is my iptables rules: -

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -d 1.1.1.10 -j DNAT --to-destination 172.16.0.1 iptables -t nat -A PREROUTING -d 2.2.2.10 -j DNAT --to-destination 192.168.0.1

iptables -t nat -A POSTROUTING -s 172.16.0.1 -j SNAT --to-source 1.1.1.10 iptables -t nat -A POSTROUTING -s 192.168.0.1 -j SNAT --to-source 2.2.2.10

Below is my split access routing for multiple providers: -

# First ISP
ip route add 1.1.1.8/30 dev eth0 src 1.1.1.10 table 1 ip route add default via 1.1.1.9 table 1

# Second ISP
ip route add 2.2.2.8/30 dev eth1 src 2.2.2.10 table 2 ip route add default via 2.2.2.9 table 2

#
ip rule add from 1.1.1.8/30 lookup 1
ip rule add from 2.2.2.8/30 lookup 2

# My default choice of gateway
ip route add default via 1.1.1.9

#
ip route add 2.2.2.8/30 dev eth1 table 1
ip route add 172.16.0.0/24 dev eth2 table 1
ip route add 192.168.0.0/24 dev eth3 table 1
ip route add 127.0.0.0/8 dev lo table 1

#
ip route add 1.1.1.8/30 dev eth0 table 2
ip route add 172.16.0.0/24 dev eth2 table 2
ip route add 192.168.0.0/24 dev eth3 table 2
ip route add 127.0.0.0/8 dev lo table 2

When I perform a traceroute from a workstation with the IP address of 192.168.0.1 and gateway 192.168.0.254, I can see the result of the traceroute going through the 1.1.1.9 gateway, why? It suppose to SNAT to 2.2.2.10 via 2.2.2.9 gateway.

Regards,
ro0ot

Happens because your default gateway is 1.1.1.9. 2.2.2.9 is only chosen when the source IP is 2.2.2.8/30. Problem is, the routing decision is made BEFORE iptables->nat->POSTROUTING changes the source IP. You will have to key your routing rules on the private IPs, like so:

ip rule add from 172.16.0.0/24 lookup 1
ip r a from 192.168.0.0/24 lookup 2

(I've gone through various configurations of a linux gateway router connecting multiple private networks to three T1s: bridge and plain router, load-balanced and source-routed, and with shaping/routing based on fwmarks)

j

Joel,

Can I add the following?

ip rule add nat 1.1.1.10 from 172.16.0.1 table 1
ip rule add nat 2.2.2.10 from 192.168.0.1 table 2

Regards,
ro0ot