Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to configure a NAT and manually split internet traffic between two gateways which are connected to a Linux box.

There was no problem if each gateway has a specific IP address. I can do this by iproute2:

ip route add default via dev eth1
ip route add via dev eth0
ip route add via dev eth0

But my problem is so simple! I have no access to change the gateways addresses, and network ids. I just need to use two internet gateways with the same address from a Linux box, with kernel 3.2.0 and above.

                                                        | Gateway A |
                          +-----------------------+     ||
                          |                   eth0+---->+-----------+
           +--------------+eth2   Linux Box       |
           |              |                   eth1+---->+-----------+
           |              +-----------------------+     | Gateway A |
           |                                            ||
           |                                            +-----------+
  |  Private Network   |--------> Workstation A
  |                    |
  |     |--------> Workstation B

How can I solve this problem using Linux's amazing network tools (mangling, snat or something else)?

share|improve this question
Hmm... could it be possible to use some kind of dirty arp hack to locally assign one of those gateways a different IP? - On second thought, all IP packets would have the locally assigned destination IP in their headers, and the gateway would probably discard those packages. Maybe some kind of iptables could fix those packets just before they leave the interface? – Martin von Wittich Sep 17 '13 at 19:54
interesting trick, may be used alongside snat, to rewrite the outging packet's source address.can you provide me an example as answer? – pylover Sep 17 '13 at 19:57
Related question: serverfault.com/questions/389306/… – Martin von Wittich Sep 17 '13 at 20:00
sorry, no. I'm just wildly guessing here, I've never attempted something like this before. – Martin von Wittich Sep 17 '13 at 20:01
Possibly related: a similar problem where the iptables MARK target is used to force packets to leave the machine on a specific interface. – Martin von Wittich Sep 17 '13 at 20:07
up vote 2 down vote accepted

Finally i got it. after some tries, i found the linux kernel does not have any problem in this situation. it works like charming ! by this iproute2 rules & routes:

eth0: --> Gateway A: dwl2100ap

eth1: --> Gateway B: dwlg132

Configuring interfaces:

ip addr add dev eth0
ip addr add dev eth1

Adding two routing tables:

echo "1       dwl2100ap" >> /etc/iproute2/rt_tables
echo "2       dwlg132" >> /etc/iproute2/rt_tables

Adding routes to tables:

ip route add dev eth0 src table dwl2100ap
ip route add default via dev eth0 table dwl2100ap

ip route add dev eth1 src table dwlg132
ip route add default via dev eth1 table dwlg132

Next, you set up the routing rules. These actually choose what routing table to route with. You want to make sure that you route out a given interface if you already have the corresponding source address:

ip rule add from table dwl2100ap
ip rule add from table dwlg132

Masquerading all outgoing packets:

iptables -tnat -APOSTROUTING -s10.0.0.0/24 -j MASQUERADE

To let kernel to split bandwidth i can issue this route:

ip route add default scope global nexthop via dev eth0 weight 2 nexthop via dev eth1 weight 1

To route manually:

ip route add default via dev eth0
ip route add via dev eth0
ip route add via dev eth1


Additionally i can mark some packets by iptables:

iptables -tmangle -APREROUTING -i eth2 -s -jMARK --set-mark 4

Then route them via routing policy:

ip rule add fwmark 4 table dwl2100ap

I wondering it works with two gateways with the same ip address. in kernel 3.2.0-53.

share|improve this answer
I was absolutely certain that Linux is able to do this, I just didn't know how :). Nicely done! – Martin von Wittich Sep 19 '13 at 19:43
@Martin, Thanks for your friendly advice.Arp hack is a good idea, but no needed here.so the box can resolve each mac-address via separated ethernet. it's good if there was only one ethernet and two node with the same address. – pylover Sep 20 '13 at 7:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.