That's my server network setup:
/etc/network/interfaces
auto ethLAN
iface ethLAN inet static
address 192.168.10.3
netmask 255.255.255.0
network 192.168.10.0
broadcast 192.168.10.255
auto ethOI
iface ethOI inet static
address 10.1.1.3
netmask 255.255.255.0
network 10.1.1.0
broadcast 10.1.1.255
gateway 10.1.1.1
dns-nameservers 192.168.10.1 8.8.8.8 8.8.4.4
dns-search hsi.local
auto ethGTC
iface ethGTC inet static
address x.y.z.82
netmask 255.255.255.192
network x.y.z.64
broadcast x.y.z.127
gateway x.y.z.65
And that's my route table:
0.0.0.0 10.1.1.1 0.0.0.0 UG 0 0 0 ethOI
10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 ethOI
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 ethLAN
x.y.z.64 0.0.0.0 255.255.255.192 U 0 0 0 ethGTC
The ethOI provides internet connection to lan clients and the ethGTC is used to external VPN, WEB and another services.
I'm using iptables to masquerade and firewall (snapshot here).
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o ethOI -j MASQUERADE
iptables -A INPUT -i ethLAN -j ACCEPT
iptables -A INPUT -i ethGTC -p tcp --dport 80 -j ACCEPT
... other rules
With this setup the lan clients could access the internet with the ethOI interface, but the services doesn't work.
However, if I change the default route to ethGTC all works fine except clients are routed by this interface and not ethOI.
How to configure this scenario?