Find the answer to your Linux question:
Results 1 to 3 of 3
Okay I have two ISP's coming into my box which dynamically set my NIC's with public IP's. eth1 and eth2. eth0 is my LAN at 192.168.1.1/16 I've set the LAN ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Dec 2008
    Posts
    3

    Routing with two ISP's based on IP scheme/subnet


    Okay I have two ISP's coming into my box which dynamically set my NIC's with public IP's. eth1 and eth2. eth0 is my LAN at 192.168.1.1/16 I've set the LAN interface to /16 because I want it to route both 192.168.1.0/24 traffic and 192.168.2.0/24 traffic. So I sort of guessed that opening it up to /16 would be the only way to allow that? Anyway, the goal here is to route all traffic from 192.168.1.0/24 out eth0 and 192.168.2.0/24 out eth1. I have setup my iptables and it seems like it's at a point where it really wants to work. Issue is depending on which interface (eth1/2) is the default gateway depends on who will work when I'm using their respective IP scheme. It's really frustrating. I've added them both as default gw's but it just chooses to work only on the most recently added one. Here is a look at my iptables configuration:

    #Policies
    iptables -P INPUT DROP
    iptables -P FORWARD DROP
    iptables -P OUTPUT ACCEPT

    #Flush out existing rules
    iptables -F INPUT
    iptables -F FORWARD
    iptables -F OUTPUT
    iptables -F -t nat
    iptables -F -t mangle

    #Basic firewall
    iptables -A FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -j ACCEPT
    iptables -A FORWARD -i eth0 -o eth2 -s 192.168.2.0/24 -j ACCEPT
    iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A FORWARD -i eth2 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

    iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -i eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -i eth0 -j ACCEPT
    iptables -A INPUT -i lo -j ACCEPT

    #Block intercommunication between eth1/eth2
    iptables -A FORWARD -i eth1 -o eth2 -j DROP
    iptables -A FORWARD -i eth2 -o eth1 -j DROP

    #NAT
    iptables -A POSTROUTING -t nat -o eth1 -j MASQUERADE
    iptables -A POSTROUTING -t nat -o eth2 -j MASQUERADE

    #Block WAN from spoofing LAN
    iptables -A INPUT -i eth1 -s 192.168.0.0/16 -j DROP
    iptables -A INPUT -i eth1 -s 127.0.0.0/8 -j DROP
    iptables -A INPUT -i eth2 -s 192.168.0.0/16 -j DROP
    iptables -A INPUT -i eth2 -s 127.0.0.0/8 -j DROP

    Anyone have any suggestions? I'd really really appreciate it. Thanks in advance.

  2. #2
    Just Joined!
    Join Date
    Dec 2008
    Posts
    3
    Okay I figured it out. But now I have another question. I am using two ip routing tables to get this working. Which works nicely. The issue is that the dhcp resolution doesn't dump the gateway info into the specific tables. How could I go about doing that? I'd really rather not have to manually do this everything I restart my router.

  3. #3
    Just Joined!
    Join Date
    Dec 2008
    Posts
    3
    Nevermind, I figured it all out. Thanks for all the help!! Lol. If anyone needs help doing what I just did try and PM me.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •