I have severs behind two different public IPs and doing DNAT to send the traffic to different internal servers depending on the port.
------------------------- -----------------------
| server a (port 80/tcp)| | router A |
| (eth0) 192.168.1.123|..................|192.168.1.1 (eth1) |
------------------------- : | (eth0) 1.2.3.4|............
: ----------------------- :
: :
: ----------------------- :.... INTERNET
------------------------- : | router B | :
| server a (port 25/tcp)| : | (eth0) 2.3.4.5|...........:
| (eth0) 192.168.1.234|..................|192.168.1.2 (eth1) |
------------------------- -----------------------
On router A and B I enabled the forwarding and the following iptables:
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -d ${externalIP} -i eth0 -p tcp --dport 25 -j DNAT --to 192.168.1.234
iptables -t nat -A PREROUTING -d ${externalIP} -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.1.123
Actually I have the following route added on the servers A and B:
route add default gw 192.168.1.1
So all the internal traffic to internet goes through router A and all the traffic to port 25 and 80 are correctly sent to server A and B, but the connections only works if the traffic came through router A. Indeed, the traffic through router B arrive to servers but it is returned through router A instead B, so the connections does not work.
I added a new route on the servers:
route add default fw 192.168.1.2
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 192.168.1.2 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
But the connections are still not working.
How can I manage that?
It is not important to balance the traffic Internal -> External, but I want that all the incoming connections from internet against the external IPs are correctly established.
NOTE: I also tried to do the DNAT on one of the routers against the external IP of the other router, but they are on different networks and it don't worked:
iptables -t nat -I PREROUTING -p tcp --dport 25 -d ${ExternalIPA} -i eth0 -j DNAT --to ${ExternalIPB}