I have linux box that serves as a router/firewall and has 2 internet providers connected to. I'd like to make load-sharing with failover using it. I did such thing many years ago and it was pretty simple - just add 2 routing tables for 2 connections and then use 2 default routings with the weight required:

 ip route add default scope global nexthop via dev dev100 weight 10

And then linux will randomly add routes to the cache, dividing connections between links.

But now I found that it does not work anymore with linux 3.16, and there's no route cache anymore and all my old scripts are not working and I cannot setup the connection.

My configuration is:

- ip route list table prov1
default via dev eth1 dev eth2  scope link  src dev lo  scope link dev br0  scope link  src dev eth1  scope link  src
- ip route list table prov2
default via dev eth2 dev eth2  scope link  src dev lo  scope link dev br0  scope link  src dev eth1  scope link  src
- ip route list table main
        nexthop via  dev eth1 weight 10
        nexthop via  dev eth2 weight 10 dev eth2  proto kernel  scope link  src dev br0  proto kernel  scope link  src via dev eth1 via dev eth1 via dev eth1 dev eth1  proto kernel  scope link  src dev br0  scope link
- ip route list table default
- ip rule list
0:      from all lookup local
32756:  from all fwmark 0xb iif br0 lookup prov2
32757:  from all fwmark 0xa iif br0 lookup prov1
32758:  from lookup prov2
32760:  from lookup prov1
32766:  from all lookup main
32767:  from all lookup default

 cat /etc/iproute2/rt_tables
# reserved values
255     local
254     main
253     default
0       unspec
# local
#1      inr.ruhep
10       prov1
11       prov2

But with this configuration everything is working fine from the host itself, but does not work for NATed IPs behind this host. To be more specific - that what I see from NATed host:

vik@Pro:~ $ ping
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=59 time=3.737 ms
64 bytes from icmp_seq=1 ttl=59 time=4.198 ms
64 bytes from icmp_seq=2 ttl=59 time=3.934 ms
Request timeout for icmp_seq 3
64 bytes from icmp_seq=4 ttl=60 time=3.650 ms
64 bytes from icmp_seq=5 ttl=60 time=3.616 ms
Request timeout for icmp_seq 6
64 bytes from icmp_seq=7 ttl=60 time=3.509 ms
64 bytes from icmp_seq=8 ttl=60 time=3.417 ms
64 bytes from icmp_seq=9 ttl=60 time=3.635 ms
Request timeout for icmp_seq 10

As you can notice, a lot of packets were just lost. And hosts behind this linux router cannot open webpages etc - connection is just dropped:

$ telnet google.com 80
Connected to google.com.
Escape character is '^]'.
get / http/1.0

Connection closed by foreign host.

I tried to find some manuals and found an advice to CONNMARK packets like that:

iptables -t mangle -A PREROUTING -i eth1 --dst -m state --state NEW,RELATED -j CONNMARK --set-mark 10
iptables -t mangle -A PREROUTING -i eth2 --dst   -m state --state NEW,RELATED -j CONNMARK --set-mark 11

iptables -t mangle -A PREROUTING -i br0 -m state --state ESTABLISHED -j CONNMARK --restore-mark

But it didn't help at all. Please help )

1 Answer 1


It seems that the packet loss occurs as the packets returns different from the source route. IP routing is stateless. I think you could follow the this link to archive the dual-wan.

  • Water is wet, routing is stateless, packets are lost ;) Could you be more specific please? I read this link and found nothing useful there. It's the same what I've done, isn't it? I did some traces and I see that packets are lost somewhere in the NAT - I mean, that I see, for example, 3 incoming packets from the NAted host and just 2 NATed packets sent to the wan host then.
    – BUKTOP
    Commented Sep 2, 2016 at 7:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .