0

I need to configure a firewall server with two internet lines (A on eth1, B on eth0) and an internal network (C on eth2). Additionally to the default routing table (via A / eth1), I have two routing tables with their own default gateways each.

I can reach the server via internet line A and SSH on port 22, as expected. But when I try to reach it via internet line B, the returning tcp/ip packets are sent via internet line A.

Firewall with two internet connections

Obviously, when I connect to the server via internet line B, I want it to reply via internet line B.

How can I achieve this?


What I have tried so far: I have configured sshd, so that it listens on a second port (122). I have then added a

#!/bin/bash

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
ip rule add from all fwmark 1 table 2

ip route flush cache
iptables -A OUTPUT -p tcp --sport 122 -j LOG
iptables -A OUTPUT -t mangle -p tcp --sport 122 -j MARK --set-mark 1

Now, I can connect to the server via internet line B, but the answers are logged to be returned via internet line A.


What I have also tried so far:

I can control the traffic originating from other computers in internal network C to be sent via either internet line A or B - by just marking their packets in the prerouting table:

$A -t mangle -A PREROUTING -p tcp --dport 80 -s 192.168.0.0/24 -j MARK --set-mark 2

This works very well.

0

Your setup requires usage of PBR (Policy Based Routing). You're using it, but not complete. You can solve you issue by two ways:

  • Simple way: just add two rules for every uplink like ip rule add from <srv-IP-A> table <tbl-A> pref 1001 and ip rule add from <src-IP-B> table <tbl-B> pref 1002, where A and B are corresponded links. It works only for traffic from server itself, because it always reply from same ip address, on which the initial connection request receives.

  • Hard way: use the CONNMARK target. It will works for all cases. Logic: the conntrack entry is associated with connection, and may contain an additional value inside itself. You can clone this value into/from the firewall mark and use the match in the iptables rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.