Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found very good article on load balancing at I could not implement it though as my requirement is slightly different from pure load balancing.

We have two ISP connections. I have connected both these routers to Linux server on eth0 (public ip 121.XXX.XX.XXX) and eth1(192.168.129.XXX) respectively, and our internal network is on eth2 (192.168.1.XXX).

I have decided that that our FTP should use eth1 interface, Squid should use eth0, Sendmail should use eth0 and some users should use eth0 and some other user should use eth1.

Can anybody tell if it is possible, how can I achieve this using iptables and iproute2? Step by step help is highly appreciated. Thanks in advance.

share|improve this question

Configure IPROUTE2

echo "4        sendmail" >> /etc/iproute2/rt_tables
ip route add 121.XXX.XX.XXX/MASK dev eth0 src 121.XXX.XX.XXX table sendmail
ip route add 192.168.1.XXX/24 dev eth2 table sendmail
ip route add default via GATEWAY1 table sendmail
ip ru add from 121.XXX.XX.XXX lookup sendmail
ip ru add fwmark 2 table sendmail
ip route flush cache

Configure IPTABLES

iptables -t mangle -I OUTPUT -p tcp --dport 25 -j MARK --set-mark 0x2
iptables -t mangle -I PREROUTING -i eth2 -p tcp --dport 25 -j MARK --set-mark 0x2

iptables -t nat -I POSTROUTING -s 192.168.1.XXX/24 -o eth0 -j SNAT --to-source 121.XXX.XX.XXX
share|improve this answer
Thank you very much. You have given me exact solution. I will try this on my vmware setup. vmware setup is identical to my server setup. I have CentOS 5.2 with iptables 1.3.5-5XX. I am getting an error "RTNETLINK answers: Invalid argument" for ip route add 121.XXX.XX.XXX/MASK dev eth0 src 121.XXX.XX.XXX table sendmail. I am searching a reason for this error. Thanks – Silkograph Jul 30 '10 at 12:25
MASK needs to be your actual mask, and your actual network. Use ip ro sh to see what it is in the main table. – topdog Jul 30 '10 at 17:03
I am trying this on my virtual server (CentOS5.2). I have two lan cards on this virtual server. I do get internet access from two different sources. One from and other from So my mask would be I am not using public IP for this virtual server. Please let me know if you need to know any other information. Thanks a lot. – Silkograph Aug 2 '10 at 10:53

I did something similar using shorewall.
Everything is based on marking and filtering packets and applying on them some rules. Everything should be explained in the larc howt: The process should be like this (i have to re-read something, i did it few months ago):

  • the packet come from internal net

  • netfilter apply on the traffic some MARK

  • rules based on marks route the packet trough the right device

share|improve this answer
Really thanks for your inputs. I am getting error for "ip route add $P1_NET dev $IF1 src $IP1" from I am giving actual command like this " ip route add dev eth0 src table tata" I have added entry for tata in rt_table. Do you have any idea about this error. I have become mad on this error. – Silkograph Jul 30 '10 at 12:38
Which error do you get exactly? – Pier Jul 30 '10 at 13:57
I am getting "RTNETLINK answers: Invalid argument". – Silkograph Aug 2 '10 at 10:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.