Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two internet connections from two different ISPs and I need to balance the traffic originating to and from my network between the two ISPs. I am using Debian GNU/Linux.

My set-up is like this -

eth0 ( -- Local network

eth1 ( -- ISP #1

eth2 ( -- ISP #2

My local network is connected to this server via eth0 and the box is the DHCP server cum Gateway for all the machines in the LAN.

The server needs to do load-balancing between the two ISPs and also needs to do NAT-ing.

I have followed the routing instructions on but I still need instructions to do the NAT-ing properly.

Any help will be appreciated.

PS - I know about pFsense but I need to use Linux.

share|improve this question
what kind of instructions do you need? everything is explained on Do you have any problem in particular? – lorenzog Dec 12 '09 at 12:30
up vote 16 down vote accepted

I have done load balancing using both and iptables methods, and I find that the iptables method is easier to understand and implement. The only downside is that you need a fairly recent iptables version to be able to use statistic module

Let's suppose a few things:

LAN: eth0:

ISP1: eth1:, gateway:

ISP2: eth2:, gateway:

So here is how I would do by using iptables method:

Route tables

First edit the /etc/iproute2/rt_tables to add a map between route table numbers and ISP names

10 ISP1
20 ISP2

So table 10 and 20 is for ISP1 and ISP2, respectively. I need to populate these tables with routes from main table with this code snippet (which I have taken from hxxp://

ip route show table main | grep -Ev '^default' \
   | while read ROUTE ; do
     ip route add table ISP1 $ROUTE

And add default gateway to ISP1 through that ISP1's gateway:

ip route add default via table ISP1

Do the same for ISP2

So now I have 2 route tables, 1 for each ISP.


OK now I use iptables to evenly distribute packets to each route tables. More info on how this work can be found here ( and here (

# iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
# iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
# iptables -t mangle -A PREROUTING -j MARK --set-mark 10
# iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.5 -j MARK --set-mark 20
# iptables -t mangle -A PREROUTING -j CONNMARK --save-mark


Well NAT is easy:

# iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
share|improve this answer
Good answer with links. You don't necessarily need a new iptables to do this as before there was the statistics match there were the random and nth matches which server the same role. – SiegeX Dec 22 '09 at 10:23
I have a question regarding the marks on iptables. On the link posted, they are marking only the packets that match the new state. Why are you doing it differently? – Matías Nov 28 '14 at 17:22
Can I use one more network, like ISP3, ISP4, etc? – Vitor Mazuco Dec 7 '15 at 19:12

mefat's answer helped me a lot but rather than a one off copy of all the main table rules into the two ISP tables a better approach may be to use the rule prio to add the default rules after the main table.

Set up /etc/iproute2/rt_tables as normal:

10 ISP1
20 ISP2

Note that

ip rule show

Shows rules 0->local, 32766->main and 32767->default. See man ip for more details.

Crucially the routing process will work from low prio to high prio rules ... but 32767 is not the highest rule#. So if the main routing table has no default route (but may contain all kinds of dynamically changing routes for vpns etc) then if a match is not made, it falls through to default (normally empty) and then looks for higher prio rules.

See the 'throw' section here:

So now setup

ip route add default dev $ISP1_IFACE table ISP1
ip route add default dev $ISP2_IFACE table ISP2

and to make sure they're looked at after the main table:

ip rule add fwmark 20 table ISP1 prio 33000
ip rule add fwmark 10 table ISP2 prio 33000


ip rule show

again to verify that the these rules are higher prio than main

Then use CONNMARK mangling as mefat said:

# iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
# iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
# iptables -t mangle -A PREROUTING -j MARK --set-mark 10
# iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.5 -j MARK --set-mark 20
# iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

Things to note: pppd needs nodefaultroute otherwise it sets up in main; when a device restarts the ISP1/ISP2 tables are cleaned so need to be restored using a script.

I use a script in /etc/ppp/ip-{up,down}.d/dual-routing

# One of my connections is ~2x faster than the other

set_balance() {
    iptables -t mangle -R PREROUTING $RULENUM -m statistic --mode random --probability $0 -j MARK --set-mark 2

# if both up
set_balance $BALANCED
# if ppp1 down:
set_balance $ALL_ISP1
# if ppp0 down:
set_balance $ALL_ISP2

This is connection based load-balancing so I'm going to look at using load to monitor and replace the stats rule: iptables -t mangle -R PREROUTING <n> from userspace. So if there's a long-running download on one connection and the other connection is lightly loaded we should prefer the lightly loaded connection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.