I have a linux gateway connected to 2 providers; the Linux is doing NAT (IPv4). The idea is having using one provider (WAN1) for incoming and outgoing traffic and using the second (WAN2) provider for outgoing traffic if the WAN1 doesn't work. I have created some source routing tables and tried to switch the traffic by altering the default route in the 'main' table:
# ip rule ls 0: from all lookup local 32764: from 220.127.116.11 lookup wan1 32765: from 18.104.22.168 lookup wan2 32766: from all lookup main 32767: from all lookup default # ip route list table wan1 default via 22.214.171.124 dev wan1 126.96.36.199 dev wan1 scope link ...
By default I use wan1. When I switch the 'default gw' in the main table, all open connections stop responding. New connections get open on wan2, works correctly. Incoming connections going to wan1 address (188.8.131.52) (e.g. ssh) work correctly.
Incoming connections to WAN1 that are DNATed to another server (MAIL) do not seem to work. After disabling rp_filter on the wan1 interface (??? somehow I don't understand why do I need to disable it), "conntrack -E" will show correct events and DNAT/routing proceeds.
The packet gets correctly routed/DNATted into the MAIL box, which correctly responds, but the packet is routed through the WAN2 interface with "184.108.40.206" source address - as if the rule in the iproute2 table didn't fire.
Is there a way to make DNAT work with source routing?