3

I have a php / bash application on top of a linux machine (centos or debian but assume redhat just in case the reply need different dialect) connecting to port 80.

Actually I'm perfectly able to open a VPN via openvpn on linux command line. I use the "route-nopull" option into the .ovpn config file in order to keep the server reachable, so I have the tuntap device handy in active standby as soon as I decide to route traffic through it.

Good to know that I have both tun and tap providers, but my favorite provider uses tun.

Until today I just had to route traffic:

sudo route add 123.123.123.123 tun0

simple & funky. Now I need to open several independent requests, and the route-nopull enables me to connect multiple VPNs ready to be used: tun0 tun1 tun2... My problem is that my "route solution" forces the app requests only in a serial way through one device and I need to wait before a second connection! In addition it's too much for my skills... I need sharing ideas and some technical help.

I have poor skills with iptables and I though that perhaps reverse proxy could enable me to rotate requests to e.g. localhost:9990 -> tun0, localhost:9991 -> tun1 etc, but I have no experience in reverse proxying and they tipically dont support tuntap devices. I'm quite sure that another solution is iptables with multiple routing tables: 123.123.123.123:9990 -> marked for rt0 -> rewritten as 123.123.123.123:80 -> rt0 routes it through tun0 which is its default gateway etc etc for tun1 ans so on.

But this is really too much for my skills!!! In addition I'm scared about compromising my working setup with a bad assumption and messy tests.

Thank you for reading and helping.

5
  • What are you actually trying to achieve with this "massive parallelism"? Redundancy? Capacity?
    – womble
    Oct 24, 2015 at 4:16
  • Thank you for the interest, the reason goes beyond the scope of my question. However it's just parallelism: make different calls through different connections, not taking care about specific routes.
    – fab
    Oct 24, 2015 at 7:31
  • I still don't understand what you're trying to achieve. You keep using the word "parallelism", but that isn't an outcome, it's an implementation detail.
    – womble
    Oct 25, 2015 at 3:33
  • Updated the question with a possible second solution and edited the misused "parallelism" word
    – fab
    Oct 27, 2015 at 20:55
  • I documented my progresses here unix.stackexchange.com/questions/240091/…
    – fab
    Nov 1, 2015 at 14:05

1 Answer 1

2

Why I needed to achieve this and divagations about how to use the world "parallelism" are just bla bla bla which don't guide to the solution.

I solved and documented it here: http://aftermanict.blogspot.it/2015/11/bash-iptables-iproute2-and-multiple.html

This will make the kernel permanently route packets, enables multiple routes and even for networks not attested on the machine:

nano /etc/sysctl.conf

net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
net.ipv4.ip_forward = 1

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 >| $f ; done

This will initialize iptables and in particular mangle and nat, which are needed for marking the traffic:

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

add the alternative routes editing:

nano /etc/iproute2/rt_tables

Add (names are your references):

1 tunnel0
2 tunnel1

add routes and rules, we use tables IDs instead of names which are more immediate. As you can notice, the gateway is irrelevant, especially for tunnels which can have dynamic gateways:

ip route add 0.0.0.0/0 dev tun0 table 1
ip route add 0.0.0.0/0 dev tun1 table 2

add rules to mark traffic and bind to the corresponding table:

ip rule add from all fwmark 1 table 1
ip rule add from all fwmark 2 table 2
ip route flush cache

check if you like:

ip route show table 1
ip route show table 2
ip rule show

if you miss something, you can delete this way:

ip rule del table 1
ip route flush table 1

NOW THE MISSING PART: THIS WONT WORK:

iptables -A PREROUTING -t mangle -p tcp --dport 80 -j MARK --set-mark 1

THIS WILL:

iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 1
iptables-save

Do you need to select traffic and push it simultaneously in a device / tunnel? No problem, I solved this too:

iptables -A OUTPUT -t mangle -p tcp --dport 10001 -j MARK --set-mark 1
iptables -A OUTPUT -t mangle -p tcp --dport 10002 -j MARK --set-mark 2
iptables -t nat -A OUTPUT -p tcp --dport 10001 -j DNAT --to :80
iptables -t nat -A OUTPUT -p tcp --dport 10002 -j DNAT --to :80

NAT mandatory for reply

iptables -t nat -A POSTROUTING -o $DEV1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o $DEV2 -j MASQUERADE

iptables-save
1
  • What is $DEV1 and $DEV2? It will resolve as nothing the way the answer is written and its not called out anywhere either.
    – LeanMan
    Dec 31, 2020 at 4:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .