3

I'm trying to set up two different IPs for SMTP that each get routed to two different sets of IPs, with no IPs shared between the two sets. I'm trying this, but it mixes the two sets of IPs so that connections to xxx.xxx.xxx.100 and xxx.xxx.xxx.101 just cycle through all six .20x destination IPs.

iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.100 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.201
iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.100 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.202
iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.100 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.203

iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.101 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.204
iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.101 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.205
iptables -t nat -A POSTROUTING -p tcp -s xxx.xxx.xxx.101 --dport 25 -m statistic --mode nth --every 3 --packet 0 -j SNAT --to xxx.xxx.xxx.206

This works fine if I'm only using one IP to connect to my server with, but how can I use two IPs and keep their redirections separate?

1

First, you need to modify your distribution rules to match the following. Have a look at this post.

--mode nth --every 3 --packet 0
--mode nth --every 2 --packet 0
--mode nth --every 1 --packet 0

As stated, the counters are not globals. So, you need to change your rules to match the remaining packets.

Second, you need to make sure you are really using a different IP in the second case. You can use iptables -t nat -L -n -v to see hit counters to confirm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.