I have a centos 6 VPS configured 1 network interface binding with 4 IPs, for example 172.x.x.11, 172.x.x.12, 172.x.x.13, 172.x.x.14 binding with venet0:0, venet0:1, venet0:2, venet0:3.

I have pptpd service running on the server. Client can connect to the PPTP VPN service with each one of the 4 IPs, but when the package forwarded to destination, the IP always be the main IP of the server, i.e. 172.x.x.11.

For example , a user is request a page of twitter.com by connecting to 172.x.x.13 with PPTP VPN client, but twitter.com see the request is from 172.x.x.11. How should I setup the server (maybe iptables, route) to make the incoming and outgoing IP same?

This is what I set iptables for ip forwading:

This is the route command result:
[root@bla1 ~]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
link-local * U 1002 0 0 venet0
default * U 0 0 0 venet0


Use iptables CONNMARK to mark each packet as it goes out and restore the mark as packet returns from a connection. You also need to set up multiple routing tables, one for each mark so you can route packets based on the marking.

For setting up the routes you can use 'ip route nexthop'. You can also specify weight for each route, so you can sort of balance the traffic as you wish.

Also, i think your example is not accurate. What's happening is packets are going out from different ip addresses, so when they come back, they won't be destined to the ip that's used to establish the connection. That's why you need to make sure that all packets for one connection always use the same route.

I don't have the script anymore to do it but mine was based on the example at http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html (copied below).

#by-pass rules if it is already MARKed
iptables -t mangle -A POSTROUTING -m mark  --mark ! 0 -j ACCEPT 
#1st packets(from a connection) will arrive here 
iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 0x2
iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark

#restore mark before ROUTING decision
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

#route commands
ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
    y.y.y.y dev eth2
ip route add default table provider1 via x.x.x.x dev eth1
ip route add default table provider2 via y.y.y.y dev eth2

# and most important
ip rule add fwmark 0x1 table provider1
ip rule add fwmark 0x2 table provider2

There are other things to consider too:

  1. Some programs like ssh, creates new connection after initial setup. This new connection can have different route than the initial connection and the app won't see packets from this connection. So you have setup special routes for apps like this.
  2. If you have many links, problem with flakey nics will arise. It's better to trunk physical connection to modems with vlan switch.
  3. You also need special route if you want to allow incoming connections from outside.
  • Thanks ieml96, I get the point. But I have limited knowledge of iptables and route which means I have to take much time to learn before I can set them correctly. I'm really appreciated if you can give me a working example commands based on the parameters I described above. – Alex Liao Jun 16 '13 at 14:15
  • added some examples. I don't have linux box anymore so I can't test it. – imel96 Jun 16 '13 at 23:18

What you see is a direct consequence of the postrouting rule you set up.

What you want to do require either bridging (for same network communication) or routing (for intranetwork communication). Masquerading (NATting) has the very effect you are lamenting.

  • Thanks. Can you give a specific example? – Alex Liao Jun 16 '13 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.