Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Software
User Name
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.


  Search this Thread
Old 02-27-2006, 11:35 PM   #1
Registered: Oct 2003
Location: Spencer, Iowa
Distribution: Slackware (of course)
Posts: 67

Rep: Reputation: 16
iptables and load balance ethernet

Ok here is my issue. I just setup eth0 on one cable provider and eth2 on another cable provider. I am having good luck surfing between the 2 providers (load balance) but all my nat rules seem to be broken. sometimes they work and sometimes they don't. Has anyone had this issue before when load balancing outbound connections. Attached below are snippets of my rc.local and my rc.iptables in Slackware.

Thanks for any help I can get.


echo 1 > /proc/sys/net/ipv4/tcp_syncookies
route del default
route del default
ip route add default equalize scope global nexthop via dev 
eth0 weight 1 nexthop via dev eth2 weight 1
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter
#                                                 #
#           ETH0 is the main network adapter      #
echo "Starting iptables"

# Default_Policys
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptables -P OUTPUT DROP
$iptables -t nat -P PREROUTING ACCEPT
$iptables -t nat -P OUTPUT ACCEPT
$iptables -t nat -P POSTROUTING ACCEPT

$iptables -t mangle -P PREROUTING ACCEPT
$iptables -t mangle -P INPUT ACCEPT
$iptables -t mangle -P OUTPUT ACCEPT
$iptables -t mangle -P FORWARD ACCEPT
$iptables -t mangle -P POSTROUTING ACCEPT
$iptables -t nat -F
$iptables -t mangle -F

# Flushing_All_Rules"
$iptables -F INPUT 
$iptables -F OUTPUT
$iptables -F FORWARD
$iptables -F -t nat

# Blocking_pings
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Allow_Established_Related_Connections
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $IP0
iptables -t nat -A POSTROUTING -o eth2 -j SNAT --to-source $IP1

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 80 -j DNAT --to-destination
$iptables -A FORWARD -d -p tcp --dport 80 -j ACCEPT

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 3389 -j DNAT --to-destination
$iptables -t filter -A FORWARD -d -p tcp --dport 3389 -j ACCEPT

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 22 -j DNAT --to-destination
$iptables -A FORWARD -d -p tcp --dport 22 -j ACCEPT

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 22 -j DNAT --to-destination
$iptables -A FORWARD -d -p tcp --dport 22 -j ACCEPT

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 25 -j DNAT --to-destination
$iptables -A FORWARD -d -p tcp --dport 25 -j ACCEPT

$iptables -t nat -A PREROUTING -d $IP0 -p tcp --dport 21 -j DNAT--to-destination
$iptables -A FORWARD -d -p tcp --dport 21 -j ACCEPT

$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT

$iptables -A INPUT -p all -s 0/0 -i eth1 -j ACCEPT
$iptables -A OUTPUT -p all -d 0/0 -o eth1 -j ACCEPT

$iptables -A FORWARD -p tcp -i eth1 --dport 80 -j ACCEPT
$iptables -A FORWARD -p tcp -i eth1 --dport 443 -j ACCEPT
$iptables -t nat -A POSTROUTING -j ACCEPT

$iptables -A INPUT -p tcp -j LOG -m limit --log-prefix "FILTER TCP-BAD-IN:"
$iptables -A INPUT -p udp -j LOG -m limit --log-prefix "FILTER UDP-BAD-IN:"
$iptables -A INPUT -j LOG -m limit --log-prefix "FILTER UNKNOWN-BAD-IN:"
$iptables -A FORWARD -p tcp -j LOG -m limit --log-prefix "FILTER TCP-BAD-FWD:"
$iptables -A FORWARD -p udp -j LOG -m limit --log-prefix "FILTER UDP-BAD-FWD:"
$iptables -A FORWARD -j LOG -m limit --log-prefix "FILTER UNKNOWN-BAD-FWD:"
Old 02-28-2006, 06:47 PM   #2
Senior Member
Registered: Mar 2003
Location: Brisbane Queensland Australia
Distribution: Custom Debian Live ISO's
Posts: 1,291

Rep: Reputation: 62
I cannot help you with the load balancing part of the script, but I have noticed a few errors in the script. You are setting the default policies then flushing the rules, this should be the other way around.

By setting the default policy to DROP and then flushing them you are then setting them to ACCEPT, all data packets will then be accepted and passed through without matching any other rules you have specified further down the script.

Plus you have doubled up on some of the rules:

$iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Then further down:

$iptables -A OUTPUT -p all -d 0/0 -o eth1 -j ACCEPT

Since you have already accepted the outgoing packets on all interfaces, the second rule isn't required. In your logging rules you don't have a logging rule for the icmp protocol.
Old 04-28-2006, 08:50 PM   #3
Registered: Oct 2003
Location: Spencer, Iowa
Distribution: Slackware (of course)
Posts: 67

Original Poster
Rep: Reputation: 16
Thumbs up

I have been getting quite a few e-mails about this and if I have it resolved so sorry for bringing it up from the dead. I do have it working and here is a quick little howto on how I did it.

I followed the steps located in this HOWTO: but I did do a few things differently
(I definetly recommend shorewall)

I have 2 cable modems
Mediacom and Spencer Municipal Utilities

Spencer Municipal Utilities -> eth0
Mediacom -> eth1
Lan -> eth2

smu   1       1       main            eth0            smu.gateway.address track,balance    eth2
mediacom    2       2       main            eth1            mediacom.gateway.addresss  track,balance    eth2
net     eth0            detect          tcpflags,norfc1918,routefilter,nosmurfs,logmartians
net     eth1            detect          dhcp,tcpflags,norfc1918,routefilter,nosmurfs,logmartians
loc     eth2            detect          tcpflags,detectnets,nosmurfs
#add this line
net        net            DROP
ETH1_IP=$(find_first_interface_address eth1)
eth0             $ETH1_IP          smu.interface.ip.address
eth1             smu.interface.ip.address          $ETH1_IP
eth0                    eth2            smu.interface.ip.address
eth1                    eth2            $ETH1_IP
#mark ssh packets to go throught SMU
1:P             eth2       tcp     22
#same for RDP
1:P             eth2       tcp     3389
That should be all that needs to be done. I had to also echo "nameserver" > /etc/resolv.conf because mediacom does not have open name servers grrrr

Hope this helps


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
CPU Load Balance - Who knows? davi_cabral Linux - General 3 01-02-2006 04:07 PM
dns load and balance kafnir Linux - Networking 1 10-13-2005 01:41 PM
Connection load balance inaki Linux - Networking 1 08-22-2005 11:50 AM
Load Balance with BSD rpaula *BSD 1 03-22-2004 10:23 PM
Load balance incoming port 80 using PF mylesridgely *BSD 3 10-07-2003 03:17 PM > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 11:49 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration