1

I have linux box that serves as a router/firewall and has 2 internet providers connected to. I'd like to make load-sharing with failover using it. I did such thing many years ago and it was pretty simple - just add 2 routing tables for 2 connections and then use 2 default routings with the weight required:

 ip route add default scope global nexthop via 1.2.3.4 dev dev100 weight 10

And then linux will randomly add routes to the cache, dividing connections between links.

But now I found that it does not work anymore with linux 3.16, and there's no route cache anymore and all my old scripts are not working and I cannot setup the connection.

My configuration is:

-------------
- ip route list table prov1
default via 217.147.175.129 dev eth1
46.164.150.48/29 dev eth2  scope link  src 46.164.150.51
127.0.0.0/8 dev lo  scope link
172.16.0.0/16 dev br0  scope link  src 172.16.1.1
217.147.175.128/25 dev eth1  scope link  src 217.147.175.165
-------------
- ip route list table prov2
default via 46.164.150.49 dev eth2
46.164.150.48/29 dev eth2  scope link  src 46.164.150.51
127.0.0.0/8 dev lo  scope link
172.16.0.0/16 dev br0  scope link  src 172.16.1.1
217.147.175.128/25 dev eth1  scope link  src 217.147.175.165
-------------
- ip route list table main
default
        nexthop via 217.147.175.129  dev eth1 weight 10
        nexthop via 46.164.150.49  dev eth2 weight 10
46.164.150.48/29 dev eth2  proto kernel  scope link  src 46.164.150.51
172.16.0.0/16 dev br0  proto kernel  scope link  src 172.16.1.1
176.37.229.77 via 217.147.175.129 dev eth1
195.12.244.0/22 via 217.147.175.129 dev eth1
213.248.127.0/24 via 217.147.175.129 dev eth1
217.147.175.128/25 dev eth1  proto kernel  scope link  src 217.147.175.165
239.0.0.0/8 dev br0  scope link
--------------
- ip route list table default
--------------------
- ip rule list
0:      from all lookup local
32756:  from all fwmark 0xb iif br0 lookup prov2
32757:  from all fwmark 0xa iif br0 lookup prov1
32758:  from 46.164.150.51 lookup prov2
32760:  from 217.147.175.165 lookup prov1
32766:  from all lookup main
32767:  from all lookup default

 cat /etc/iproute2/rt_tables
#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
10       prov1
11       prov2

But with this configuration everything is working fine from the host itself, but does not work for NATed IPs behind this host. To be more specific - that what I see from NATed host:

vik@Pro:~ $ ping 193.193.193.100
PING 193.193.193.100 (193.193.193.100): 56 data bytes
64 bytes from 193.193.193.100: icmp_seq=0 ttl=59 time=3.737 ms
64 bytes from 193.193.193.100: icmp_seq=1 ttl=59 time=4.198 ms
64 bytes from 193.193.193.100: icmp_seq=2 ttl=59 time=3.934 ms
Request timeout for icmp_seq 3
64 bytes from 193.193.193.100: icmp_seq=4 ttl=60 time=3.650 ms
64 bytes from 193.193.193.100: icmp_seq=5 ttl=60 time=3.616 ms
Request timeout for icmp_seq 6
64 bytes from 193.193.193.100: icmp_seq=7 ttl=60 time=3.509 ms
64 bytes from 193.193.193.100: icmp_seq=8 ttl=60 time=3.417 ms
64 bytes from 193.193.193.100: icmp_seq=9 ttl=60 time=3.635 ms
Request timeout for icmp_seq 10

As you can notice, a lot of packets were just lost. And hosts behind this linux router cannot open webpages etc - connection is just dropped:

$ telnet google.com 80
Trying 173.194.113.201...
Connected to google.com.
Escape character is '^]'.
get / http/1.0

Connection closed by foreign host.

I tried to find some manuals and found an advice to CONNMARK packets like that:

iptables -t mangle -A PREROUTING -i eth1 --dst 217.147.175.165 -m state --state NEW,RELATED -j CONNMARK --set-mark 10
iptables -t mangle -A PREROUTING -i eth2 --dst 46.164.150.51   -m state --state NEW,RELATED -j CONNMARK --set-mark 11

iptables -t mangle -A PREROUTING -i br0 -m state --state ESTABLISHED -j CONNMARK --restore-mark

But it didn't help at all. Please help )

0

It seems that the packet loss occurs as the packets returns different from the source route. IP routing is stateless. I think you could follow the this link to archive the dual-wan.

1
  • Water is wet, routing is stateless, packets are lost ;) Could you be more specific please? I read this link and found nothing useful there. It's the same what I've done, isn't it? I did some traces and I see that packets are lost somewhere in the NAT - I mean, that I see, for example, 3 incoming packets from the NAted host and just 2 NATed packets sent to the wan host then. – BbIKTOP Sep 2 '16 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.