0

I have 3 NICs. NIC1 and NIC2 are used for internet connections an LAN is used for intranet connection.

I want to balance the load to ISPs using ip tables. As I am a noob, my crude attempt is given in the following code, obviously without success. This code was assembled by looking at many websites on the topic.

we would like to optimally use the incoming internet in LAN using Round-Robin method

or

Is it possible to split the two isps, i.e, for systems 1 to 5 (ISP1) and 5 to 10 (ISP2) using routing tables?

Hope someone out there will help me, which is very much appreciated.

set -x
IPT="/sbin/iptables"
NIC1="enp4s5f0"
NIC2="enp4s5f1"
LAN="ens2"
ISP1="192.168.9.33"
ISP2="192.168.10.33"

#***************
# reset iptables
#_______________
## reset the default policies in the filter table.
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

## reset the default policies in the nat table.
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

## reset the default policies in the mangle table.
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

## flush all the rules in the filter and nat tables.
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

## erase all chains that's not default in filter and nat table.
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X


#*********************
# enable IP forwarding
#_____________________
echo 1 > /proc/sys/net/ipv4/ip_forward


#****************
# rules 
#________________
$IPT -A INPUT -m state --state INVALID -j DROP 
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -A INPUT -p icmp -j ACCEPT 
$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 

$IPT -A FORWARD -m state --state INVALID -j DROP 
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -A FORWARD -p icmp -j ACCEPT 

$IPT -t nat -A PREROUTING -i NIC1 -p tcp --dport 80\ 
            -m state --state NEW -m statistic --mode\ 
            random --probability .33 -j  DNAT --to-destination 10.1.1.1:1

$IPT -t nat -A PREROUTING -i NIC2 -p tcp --dport 80\ 
            -m state --state NEW -m statistic --mode\ 
            random --probability .33 -j  DNAT --to-destination 10.1.1.1:2

$IPT -A FORWARD -i $NIC1 -o $LAN -j ACCEPT
$IPT -A FORWARD -i $NIC2 -o $LAN -j ACCEPT


# ifconfig -a


#********************************
# allow certain hosts full access
#________________________________

allowHost() {
    $IPT -A FORWARD -i $LAN -s $1 -j ACCEPT 
}

allowHost 192.168.2.10
allowHost 192.168.2.11
allowHost 192.168.2.12
allowHost 192.168.2.13
allowHost 192.168.2.14
allowHost 192.168.2.15

####Extra
$IPT -A FORWARD -d 8.8.8.8 -p tcp -m multiport --dports 53 -j ACCEPT

#********************
# block anything else
#____________________
$IPT -A FORWARD -j LOG -m limit --limit 10/minute --limit-burst 1 --log-prefix "Blocked:"
$IPT -A FORWARD -j DROP

/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_nat

Network Topography

  • Let me clarify a point here, are we talking of balancing the load to each of connected computers, i.e. sharing the in-bound data packets from the two ISPs? – George Udosen Jun 1 '19 at 10:32
  • @GeorgeUdosen, No we would like to optimally use the incoming internet in LAN using Round-Robin method. – Purushothaman Jun 1 '19 at 10:36
  • This should have been stated in your question! – George Udosen Jun 1 '19 at 10:44
  • Please can you add an image of your network connection or a sketch. Look at this example: webair.com/community/… – George Udosen Jun 1 '19 at 10:51
  • @GeorgeUdosen, I have seen this website, but I am unable to understand the code. Is it possible to split the two isps, i.e, for systems 1 to 5 (ISP1) and 5 to 10 (ISP2) using routing tables. – Purushothaman Jun 1 '19 at 11:06
1

WARNING: READ THROUGH FIRST BEFORE EXECUTING

DISCLAIMER: Untested

Prerequisites:

  1. Install the iptables persistent package

    sudo apt-get install iptables-persistent
    
  2. Backup your existing iptables rules:

    sudo iptables-save > ~/iptables-export
    
    • Restore:

      sudo iptables-restore < ~/iptables-export
      
  3. Flush the former iptables rules:

    sudo iptables -F && sudo iptables -t nat -F && sudo iptables -t mangle -F && sudo iptables -X && sudo iptables -t nat -X && sudo iptables -t mangle -X
    

Steps:

  1. Add a new "route table" using this command from your terminal to handle the packets from one of the NIC's:

    sudo bash -c 'echo "1 rt2" >> /etc/iproute2/rt_tables'
    
  2. Enable ipv4 forwarding

    sudo sysctl net.ipv4.ip_forward=1
    sudo sysctl -p
    
  3. Add filter that allows "masquwerading"

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.90
    sudo iptables -t nat -A PREROUTING -i enp4s5f0 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.90
    
    
    sudo iptables -t nat -A POSTROUTING -o ens2 -j MASQUERADE
    sudo netfilter-persistent save
    sudo netfilter-persistent reload
    
  4. Edit the /etc/network/interfaces file and add the configuration for the second NIC, but ofcourse make a copy of the old one,

    sudo cp /etc/network/interfaces /etc/network/interfaces.bkup:

    iface enp4s5f1 inet static
        address <YOUR_NIC_ADD>/24
        netmask 255.255.255.0
        post-up ip route add 192.168.10.0/24 dev enp4s5f1 src 192.168.10.33 table rt2
        post-up ip route add default via 192.168.10.1 dev enp4s5f1 table rt2
        post-up ip rule add from 192.168.10.33/32 table rt2
        post-up ip rule add to 192.168.10.33/32 table rt2
    
    • Restart network manager:

      sudo  systemctl restart NetworkManager.service
      
  5. Add iptable rules:

    sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
     --every 5 --packet 0 -j DNAT --to-destination 192.168.2.26
    
    sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
     --every 4 --packet 0 -j DNAT --to-destination 192.168.2.27
    
    sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
     --every 3 --packet 0 -j DNAT --to-destination 192.168.2.28
    
    sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
     --every 2 --packet 0 -j DNAT --to-destination 192.168.2.29
    
    sudo iptables -t nat -A PREROUTING -i enp4s5f0 --to-destination 192.168.2.30
    

=====================================

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 5 --packet 0 -j DNAT --to-destination 192.168.2.21

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 4 --packet 0 -j DNAT --to-destination 192.168.2.22

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 3 --packet 0 -j DNAT --to-destination 192.168.2.23

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 2 --packet 0 -j DNAT --to-destination 192.168.2.24

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -j DNAT --to-destination 192.168.2.25

    sudo netfilter-persistent save
    sudo netfilter-persistent reload

Source:

https://scalingo.com/articles/2018/04/20/iptables.html

https://www.webair.com/community/simple-stateful-load-balancer-with-iptables-and-nat/

http://ipset.netfilter.org/iptables-extensions.man.html

https://www.linuxquestions.org/linux/answers/Networking/Spanning_Multiple_DSLs

How to save rules of the iptables?

https://linuxconfig.org/how-to-restart-network-on-ubuntu-16-04-xenial-xerus-linux

  • sudo iptables -t nat -A PREROUTING -i enp4s5f0 --to-destination 192.168.2.30 needed to be changed to sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth --every 1 --packet 0 -j DNAT --to-destination 192.168.2.30 – Purushothaman Jun 6 '19 at 6:46
  • So did it work? – George Udosen Jun 6 '19 at 6:48
  • I am able to ping 8.8.8.8 from 192.168.2.21 but ping www.google.com does not work. – Purushothaman Jun 6 '19 at 6:49
  • I think connection POSTROUTING is not working. – Purushothaman Jun 6 '19 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.