[SOLVED] linux nat router - 2 internal interfaces out on 2 external ones

psycroptic · 10-19-2013, 02:16 AM

so i am getting 5 static ips in the near future. What i have now is 2 different internal LANs (on different interfaces) masqueraded out on 1 external interface with the default gateway of the router being my ISPs. What I would like to do is have all internet traffic from these 2 internal LANs go out on 2 external interfaces, such that traffic from 1 LAN will appear to have 1 static IP, and traffic from the 2nd will appear to have the 2nd. Is this kind of thing possible at all? I should add that all 5 of the statics have the same gateway address to the isp.

I have tried this with no results:

Code:

ip route add default via ISPGATEWAY dev 1-external table 100
ip rule add from 172.16.0.0/24 dev 1-internal table 100

ip route add default via ISPGATEWAY dev 2-external table 200
ip rule add from 192.168.192.0/24 dev 2-internal table 200

and then adding relevant iptables masquerading:

Code:

-A POSTROUTING -s 172.16.0.0/16 -o 1-external -j MASQUERADE
-A POSTROUTING -s 192.168.192.0/24 -o 2-external -j MASQUERADE

pings from all internal subnets out to externals result in destination net unreachable, and tcpdump shows traffic input from the internal, nothing out on any other interfaces. i feel like it's a gateway-related issue...

psycroptic · 10-20-2013, 01:28 PM

actually, it was on the right track. i found that including the entire /16 and /24 subnets killed the routing on the gateway, presumably because the gateway's own internal addresses are in both of them. doing this:

Code:

ip route add default via ISPGATEWAY dev 2-external src STATIC2 table 110
for i in {2..254..1}; do ip rule add from 192.168.192.$i table 110; done
ip route add default via ISPGATEWAY dev 1-external src STATIC1

iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o 1-external -j MASQUERADE
iptables -t nat -A POSTROUTING -m iprange --src-range 192.168.192.2-192.168.192.254 -o 2-external -j MASQUERADE

produces expected results; the /16 appears on the net as the first static and /24 on the second.

still feels a bit kludgy