Send traffic down WAN link depending on Client IP Address Range

praemus · 04-15-2011, 11:12 PM

Hi,
I am running Debian Squeeze with the following basic services running:

DNS
DHCP
Samba
Squid

The server is setup with three NICs: eth0 (WAN1), eth1 (WAN2), and eth2 (LAN).

The server addresses clients with an IP range of 10.0.30.1 - 10.0.30.254. Some clients will be set with reservations so they fall into the 10.0.40.1 - 254 range.

What I want to do is have any outgoing external traffic coming from the first range (10.0.30.0) to use WAN link 1, and any outgoing external traffic coming from the second range (10.0.40.0) to use WAN link 2.

I have sort of got something working. I have created a bare minimum transparent squid3 setup on port 3128, and set the iptables as follows:

Code:

iptables -t nat -A PREROUTING -i eth2 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

I can get internet access, however obviously it only goes through one WAN link. It also seems slower than it should be. I experimented with tcp_outgoing_address, but seemed to not be my friend.

Can anyone explain how I should set this up?

I would be greatly appreciative.

-praemus

praemus · 04-16-2011, 12:51 AM

OK, so I had a think about it, and want someone to see if they agree with me.

If I forget about squid and just use iptables would something like this work?:

Code:

iptables -t mangle -A FORWARD -p tcp --sports 80 443 143 -s 10.0.30.0/8 -o eth1  #for all port 80, 443, 143 traffic coming from 10.0.30.0, forward it to device eth1
iptables -t mangle -A FORWARD -p tcp --sports 80 443 143 -s 10.0.40.0/8 -o eth0  #for all port 80, 443, 143 traffic coming from 10.0.40.0, forward it to device eth0

Thanks,
-praemus

praemus · 04-16-2011, 01:03 AM

My bad, that iptables rule should have

Code:

-sport 80

instead of

Code:

-sports 80 443 143

I will have to run a separate command for each port.

Either the linux man page is wrong or I don't have the latest version of iptables (that's why I get an error when I use the option --sports)

Thanks,
-praemus

praemus · 04-16-2011, 02:02 AM

OK, that didn't work. Anyone got any other ideas?

Thanks,
-praemus

praemus · 04-17-2011, 07:11 AM

Anyone got any ideas? From my research load balancing seems to be easy to do, just not splitting traffic.