Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following topology:

  • LAN Users:192.168.1.2 - 254 (192.168.1.0/24)
  • gateway1: 192.168.2.2/24 used for all outgoing connections of LAN users (default gateway)
  • gateway2: 192.168.3.2/24 used for incoming services (destination NAT, ports 80,443 are forwarded to 192.168.2.1)
  • linux router-server R
    • eth0 192.168.1.1/24: LAN
    • eth1 192.168.2.1/24: WWAN1
    • eth2 192.168.3.1/24: WWAN2

I want to:

  • route all outgoing traffic coming from LAN and R via 192.168.2.2
  • route the responses to incoming connections via 192.168.3.2

My config:

ifconfig eth0 up 192.168.1.1 netmask 255.255.255.0
ifconfig eth1 up 192.168.2.1 netmask 255.255.255.0
ifconfig eth2 up 192.168.3.1 netmask 255.255.255.0
echo 0 >/proc/sys/net/ipv4/ip_forward
route add default gw 192.168.2.2
iptables -t nat -A POSTROUTING -d !192.168.0.0/16 -j MASQUERADE

I want to add iptables rule to mark incoming traffic from WWAN2 and send back the responses to WWAN2, while keeping default gateway on WWAN1

share|improve this question

2 Answers 2

is this a solution?

ifconfig eth0 up 192.168.1.1 netmask 255.255.255.0
ifconfig eth1 up 192.168.2.1 netmask 255.255.255.0
ifconfig eth2 up 192.168.3.1 netmask 255.255.255.0
echo 0 >/proc/sys/net/ipv4/ip_forward
route add default gw 192.168.2.2

iptables -t nat -A POSTROUTING -d !192.168.0.0/16 -j MASQUERADE

iptables -A PREROUTING -t mangle -j CONNMARK --restore-mark
iptables -A PREROUTING -t mangle --match mark --mark 2 -j ACCEPT
iptables -A PREROUTING -t mangle -i eth2 -j MARK --set-mark 2
iptables -A PREROUTING -t mangle -j CONNMARK --save-mark

ip route add 192.168.3.0/24 dev eth2 table 100
ip route add default via 192.168.3.2 dev eth2 table 100

ip rule add fwmark 2 table 100 prio 1024 # before main table
share|improve this answer

This can be done without iptables:

echo "12 wwan2" >> /etc/iproute2/rt_tables
ip route add default via 192.168.3.2 table wwan2
ip rule add from 192.168.3.0/24 table wwan2

The normal default gateway should point to 192.168.2.2. This will route outgoing connections explicitly from 192.168.3.1 (i.e. applications which you've configured to use this source IP) over WWAN2, but this is usually what you want anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.