I need to configure a firewall server with two internet lines (A on eth1, B on eth0) and an internal network (C on eth2). Additionally to the default routing table (via A / eth1), I have two routing tables with their own default gateways each.
I can reach the server via internet line A and SSH on port 22, as expected. But when I try to reach it via internet line B, the returning tcp/ip packets are sent via internet line A.
Obviously, when I connect to the server via internet line B, I want it to reply via internet line B.
How can I achieve this?
What I have tried so far: I have configured sshd, so that it listens on a second port (122). I have then added a
#!/bin/bash iptables -F iptables -t nat -F iptables -t mangle -F iptables -X ip rule add from all fwmark 1 table 2 ip route flush cache iptables -A OUTPUT -p tcp --sport 122 -j LOG iptables -A OUTPUT -t mangle -p tcp --sport 122 -j MARK --set-mark 1
Now, I can connect to the server via internet line B, but the answers are logged to be returned via internet line A.
What I have also tried so far:
I can control the traffic originating from other computers in internal network C to be sent via either internet line A or B - by just marking their packets in the prerouting table:
$A -t mangle -A PREROUTING -p tcp --dport 80 -s 192.168.0.0/24 -j MARK --set-mark 2
This works very well.