1

That's my server network setup:

/etc/network/interfaces

auto ethLAN
iface ethLAN inet static
address 192.168.10.3
netmask 255.255.255.0
network 192.168.10.0
broadcast 192.168.10.255

auto ethOI
iface ethOI inet static
address 10.1.1.3
netmask 255.255.255.0
network 10.1.1.0
broadcast 10.1.1.255
gateway 10.1.1.1
dns-nameservers 192.168.10.1 8.8.8.8 8.8.4.4
dns-search hsi.local

auto ethGTC
iface ethGTC inet static
address x.y.z.82
netmask 255.255.255.192
network x.y.z.64
broadcast x.y.z.127
gateway x.y.z.65

And that's my route table:

0.0.0.0         10.1.1.1        0.0.0.0         UG    0      0        0 ethOI
10.1.1.0        0.0.0.0         255.255.255.0   U     0      0        0 ethOI
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 ethLAN
x.y.z.64        0.0.0.0         255.255.255.192 U     0      0        0 ethGTC

The ethOI provides internet connection to lan clients and the ethGTC is used to external VPN, WEB and another services.

I'm using iptables to masquerade and firewall (snapshot here).

iptables -A INPUT -i lo -j ACCEPT    
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT    
iptables -t nat -A POSTROUTING -o ethOI -j MASQUERADE    
iptables -A INPUT -i ethLAN -j ACCEPT    
iptables -A INPUT -i ethGTC -p tcp --dport 80 -j ACCEPT
... other rules

With this setup the lan clients could access the internet with the ethOI interface, but the services doesn't work.

However, if I change the default route to ethGTC all works fine except clients are routed by this interface and not ethOI.

How to configure this scenario?

7
  • It's impossible to say without the complete iptables script. Anyway the solution could be to set up some OUTPUT rules to redirect the traffic to the correct interface. The problem is probably you have two default gateway and the routing can use only one with your settings.
    – Pyrophorus
    Sep 3, 2014 at 11:35
  • I make some test without the iptables config (except masquerade) and updated the main post. Sep 3, 2014 at 11:36
  • Yeah, I already read it. And my reply is the same. I think traffic to the LAN could be redirected through eth0I with OUTPUT rules.
    – Pyrophorus
    Sep 3, 2014 at 11:39
  • If I add the ethGTC as default route and redirect lan connections to ethOI the internet connections breaks. I just can't figure out why a connection to service from a specific interface (ethGTC) was routed by Linux to the default route and not replied to the same interface without routing. Sep 3, 2014 at 11:44
  • It's not only a Linux problem. It's impossible to specify more than one default gateway in any IP configuration. You've to setup this explicitly, for instance with iptables rules (maybe there is anotehr mean I know not).
    – Pyrophorus
    Sep 3, 2014 at 11:49

2 Answers 2

1

The solution for this problem is to add a custom route like:

up ip route add 10.1.1.0/24 dev ethOI src 10.1.1.3 table adsl1
up ip route add default via 10.1.1.1 table adsl1
up ip route add x.y.z.64/26 dev ethGTC src x.y.z.82 table adsl2
up ip route add default via x.y.z.65 table adsl2
up ip route add 10.1.1.0/24 dev ethOI src 10.1.1.3
up ip route add x.y.z.64/26 dev ethGTC src x.y.z.82
up ip rule add from 10.1.1.3 table adsl1
up ip rule add from x.y.z.82 table adsl2
-1

Please try: For all machines in the net of "GTC" excluding x.y.z.82, adding routing entry as: route add -net 192.168.10.0/24 gw x.y.z.82

2
  • The GTC net is a ISP and the x.y.z.82 is the IP of my organization. I don't have access to the GTC machines as it's outside my organization. Sep 3, 2014 at 11:57
  • 1
    OK, I am wrong, if so, actually the Lan can only have a single outlet for network access traffic. To use the 2 outlets, you can get some of your pc go out over one outlet and the other PCs go out over the other outlet, route2 can do this work, see the link of prosauce.org/blog/2010/12/22/…. (This is one taffic distribution policy, you may think of other several ones)
    – Bill Zhao
    Sep 3, 2014 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .