Hi,

I'm trying to deploy the following scenario:

A linux(gentoo, kernel 3.10.7) router with 3 NICs (lan, wan1, wan2), with wan1 being the default route, and a bunch of port redirection to allow remote desktop (Windows RDP, 3389) connections coming through the Internet on wan2.

Theoretically, the traffic has to come in through wan2 AND come out through the same NIC, am I right? This is why we generally follows a LARTC-like tutorial, as I did.
Problem is that these port forwarding is not working.

I'm searching hard for relations, configurations, etc, between kernel config, iproute2 and NAT, but can't solve yet this problem.

The routing treatment for the router itself is OK, I mean, I can ssh to the router box through both wans. I can also use fwmarks to route tcp/udp traffic generated by the lan hosts to specific routes/NICs.

I've tried to turn off rp_filter, turn on accept_redirects and accept_source_route but none of these helped.

From my last researches, I'm starting to suspect that this scenario isn't really possible because of a double NAT situation (both wan1 and wan2 had private IPs, both have routers in front of if, before the ISP modems). A confirmation about this, although negative, should help too.

Any tips would be appreciated.

Thanks in advance

Why do you want to use two different WANs, wan1 and wan2, balance traffic?

In the future, yes, load balance. For now, I use two wans in a failover approach.

It seems I managed to put my scenario to work, finally.

After diggin' a bit more on netfilter, I discovered the conntrack match (-m conntrack) which allowed me to use a criteria that hits the port forwarding reply packets. Then, the set of commands/rules became:

1) to mark the redirected traffic:
# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 3

2) to mark the related port forwarding packets (it doesn't matter what port forwarding was made):
# iptables -t mangle -A PREROUTING -m conntrack --ctstate DNAT -j MARK --set-mark 3

OBS: yes, I choose to use the same mark, as I want to redirect to the same link

3) to treat the traffic:
# ip ru add fwmark 3 table internetA


Now, I cannot say whether the --ctstate rule is the optimal setup for this, nor can I foresee any problem it could cause to other connections. But happily it works now.

Thanks.