2

I read this tutorial, however I am considering a method to load balancing for Internet connection by applying iptables rule on 2 interfaces. The following is my iptables rule.

#!/bin/sh

IPT="/sbin/iptables"

LAN='ens38'
WAN='ens33'
OPT='ens37'

LAN_NET="192.168.100.0/24"

$IPT -F
$IPT -X
$IPT -t nat -F

$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP


$IPT -A FORWARD -i $LAN -o $WAN -j ACCEPT
$IPT -A FORWARD -i $LAN -o $OPT -j ACCEPT


$IPT -A FORWARD -i $WAN -o $LAN -j ACCEPT
$IPT -A FORWARD -i $OPT -o $LAN -j ACCEPT

$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE
$IPT -t nat -A POSTROUTING -o $OPT -j MASQUERADE


# Load balancing rules (Split 50/50 between fwmark 1/2)
$IPT -t mangle -N balance1
$IPT -t mangle -A balance1 -m connmark ! --mark 0 -j RETURN
$IPT -t mangle -A balance1 -m state --state ESTABLISHED,RELATED -j RETURN
$IPT -t mangle -A balance1 -m statistic --mode nth --every 2 --packet 0 -j CONNMARK --set-mark 1
$IPT -t mangle -A balance1 -m statistic --mode nth --every 2 --packet 1 -j CONNMARK --set-mark 2

# Check to see if we have already marked a packet
$IPT -t mangle -A PREROUTING  -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
$IPT -t mangle -A OUTPUT      -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark

# Mark incoming connections to return on the interface they came in on
$IPT -t mangle -A PREROUTING          -i $WAN                     -m state --state NEW  -j CONNMARK --set-mark 1
$IPT -t mangle -A PREROUTING          -i $OPT                     -m state --state NEW  -j CONNMARK --set-mark 2

# New outgoing packets
$IPT -t mangle -A PREROUTING  -i $LAN          -p tcp --dport 80 -m state --state NEW  -j balance1
$IPT -t mangle -A PREROUTING  -i $LAN          -p tcp --dport 443 -m state --state NEW  -j balance1
# $IPT -t mangle -A OUTPUT                       -p tcp --dport  80 -m state --state NEW  -j balance1

# Choose our route and save the mark
$IPT -t mangle -A PREROUTING  -m connmark --mark 1 -j MARK --set-mark 1
$IPT -t mangle -A PREROUTING  -m connmark --mark 2 -j MARK --set-mark 2
$IPT -t mangle -A PREROUTING  -m state --state NEW -m connmark ! --mark 0  -j CONNMARK --save-mark


echo 1 > /proc/sys/net/ipv4/ip_forward

I defined 2 table wan and opt in /etc/iproute2/rt_tables like the following:

[root@R1 ~]# cat /etc/iproute2/rt_tables 
#
# reserved values
#
255 local
254 main
253 default
0   unspec
#
# local
#
1   wan
2   opt

This is the script that I add route for iproute:

LAN_DEV='ens38'
WAN_DEV='ens33'
OPT_DEV='ens37'

WAN_GW="192.168.84.2"
OPT_GW="192.168.0.1"

LAN_NET="192.168.100.0/24"


ip rule add fwmark 1 table wan
ip rule add fwmark 2 table opt

# Add default route for table wan and opt
ip route add default via $WAN_GW dev $WAN_DEV table wan
ip route add default via $OPT_GW dev $OPT_DEV table opt

# Add LAN route for table wan and opt

ip route add $LAN_NET dev $LAN_DEV table opt
ip route add $LAN_NET dev $LAN_DEV table wan

As I understood from this guide, restore-mark and save-mark restore and save the packet mark from the connection mark. So the rules apply for every packet in a connection. For example: I have a connection A. iptables rules count every 4 packets in connection A and mark it 1,2,1,2.

How can I mark a connection separately in case I have many connections. For example: I have 3 connections A,B,C and I want to count and mark them like: 1,2,3.

Actually, this rule uses route from WAN (ens33) only. When the packet come in to router. It not route to OPT (ens37) which I can not explain.

  • I found this link but it does not work. :( – K.Lotus May 13 '16 at 4:38
0

You need a rule to accept the connections already known, without re-marking them.

This way, only the new connections will trigger the counter.

iptables -A PREROUTING -t mangle -j CONNMARK --restore-mark
iptables -A PREROUTING -t mangle -m mark ! --mark 0 -j ACCEPT
iptables -A PREROUTING -t mangle -m mark --mark 0 -m nth --counter 1 \
--every 3 --packet 1 -j MARK --set-mark 1
iptables -A PREROUTING -t mangle -m mark --mark 0 -m nth --counter 1 \
--every 3 --packet 2 -j MARK --set-mark 2
iptables -A PREROUTING -t mangle -m mark --mark 0 -m nth --counter 1 \
--every 3 --packet 3 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -j CONNMARK --save-mark
  • Could you edit with a completely rule? – K.Lotus May 18 '16 at 14:02
  • I'm sorry, I don't understand your question. What edition do you need? – Sanael May 18 '16 at 14:26
  • @Sanel I updated iptables and iproute. Please take a look. – K.Lotus May 18 '16 at 15:44
  • Doesn't your last script output 2 errors ? You should execute ip route add $LAN_NET first, ip route add default then. Could you post the result of ip rule list too ? – Sanael May 24 '16 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.