Bonding two broadband connections to serve LAN as a gateway

Question

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so.

1. PC with 3 NICs 1 for LAN and 2 for routers
2. 2 broadband connections with dynamic IPs connected to two routers. (one with 192.168.1.1 and one with 192.168.0.1)
3. CentOs 6.4

I need My Eth0 to serve my LAN users as below:

Eth0 Ip: 192.168.100.250 and this should be their gateway and DNS to the Internet (Correct me if this wrong)

I use each router's Lan IPs as gateways and DNSs as; Eth1 IP: 192.168.0.250, Gateway 192.168.0.1, DNS 192.168.0.1 Eth2 Ip: 192.168.1.250, Gateway 192.168.1.1, DNS 192.168.1.1

But how do I configure Bonding? Do I need to assign IP settings before the configuration of bonding? should I change LAN ip addresses of routers to one/same segmant/subnet as 192.168.1.1 and 192.168.1.2? If I config the bonding, what should be my Eth0 configuration? Leave it as it is? What is the most suitable bonding mode for a LAN more than 50 users?

Answer 1

Ethernet bonding is not the solution here. Bonding is a Layer-2 feature, and you are running Layer-3 (IP) on your routers.

I assume that your routers are connected to different ISP endpoints.

What I would do:

1. Remove the two routers from the configuration, and configure ISP networks directly on your PC with 3 NICs. That is:

   • NIC 1: 192.168.100.250
   • NIC 2: ISP #1 public IP
   • NIC 3: ISP #2 public IP

2. Make NAT rules so that traffic from source ports 1-32767 are NATed to first outgoing connection public IP, and from source ports 32768-65535 are NATed to second outgoing connection public IP. With this configuration you will get a basic load-balancing configuration.

EDIT: You might also need to apply some policy routing here, because NAT is done after routing decision, therefore the packet would still be routed to the wrong interface.

multigateway routing for specific src port has clear instructions on how to apply policy routing based on source port.

Answer 2

I would do it as Tero suggested in part 1 (configuring with public IP may not be necessary but I configured the NICs with the public addresses.) With regard to part 2 I think there must be a better way of doing this but not sure how. What I want to add is regards policy routing since the link given is not specifically for this situation, and also regarding masquerading which I don't think has been mentioned. Add the lines

1   isp1
2   isp2

to /etc/iproute2/rt_tables.

Then:

ip addr add 192.168.100.250 dev eth0
ip addr add 192.168.0.250 dev eth1
ip addr add 192.168.1.250 dev eth2

(if these aren't already configured) then

iptables-save > IptablesSaveFile

then edit this file so it looks something like

*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING ! -d 192.168.100.0/24 -o eth1 -j SNAT --to-source 192.168.0.250
-A POSTROUTING ! -d 192.168.100.0/24 -o eth2 -j SNAT --to-source 192.168.1.250
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o eth2 -j MASQUERADE
COMMIT
*filter
... your iptables filtering rules here ...
-A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth0 -o eth2 -j ACCEPT
COMMIT

then

iptables-restore < IptablesSaveFile

to activate the firewall (masquerading) rules. Then

ip route add 192.168.100.0/24 dev eth0 table isp1
ip route add 192.168.100.0/24 dev eth0 table isp2
ip route add 192.168.0.0/24 dev eth1 table isp1
ip route add default via 192.168.0.1 dev eth1 table isp1
ip route add 192.168.1.0/24 dev eth2 table isp2
ip route add default via 192.168.1.1 dev eth2 table isp2
ip rule add from 192.168.0.250 table isp1
ip rule add from 192.168.1.250 table isp2

The above is so that connections coming in on one interface are returned on the same interface. I had a DNS server running on the machine this was set up on so users could just connect to 192.168.100.250 - if you don't I'm not sure of the best way of doing this - you could possible set up a stub resolver which switches between the 2 DNS address to forward requests or set up half the users machines to use one DNS address and the other half the other.