Results 1 to 3 of 3
Okay I have two ISP's coming into my box which dynamically set my NIC's with public IP's. eth1 and eth2. eth0 is my LAN at 192.168.1.1/16 I've set the LAN ...
- 12-04-2008 #1Just Joined!
- Join Date
- Dec 2008
- Posts
- 3
Routing with two ISP's based on IP scheme/subnet
Okay I have two ISP's coming into my box which dynamically set my NIC's with public IP's. eth1 and eth2. eth0 is my LAN at 192.168.1.1/16 I've set the LAN interface to /16 because I want it to route both 192.168.1.0/24 traffic and 192.168.2.0/24 traffic. So I sort of guessed that opening it up to /16 would be the only way to allow that? Anyway, the goal here is to route all traffic from 192.168.1.0/24 out eth0 and 192.168.2.0/24 out eth1. I have setup my iptables and it seems like it's at a point where it really wants to work. Issue is depending on which interface (eth1/2) is the default gateway depends on who will work when I'm using their respective IP scheme. It's really frustrating. I've added them both as default gw's but it just chooses to work only on the most recently added one. Here is a look at my iptables configuration:
#Policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#Flush out existing rules
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -F -t nat
iptables -F -t mangle
#Basic firewall
iptables -A FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth2 -s 192.168.2.0/24 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth2 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
#Block intercommunication between eth1/eth2
iptables -A FORWARD -i eth1 -o eth2 -j DROP
iptables -A FORWARD -i eth2 -o eth1 -j DROP
#NAT
iptables -A POSTROUTING -t nat -o eth1 -j MASQUERADE
iptables -A POSTROUTING -t nat -o eth2 -j MASQUERADE
#Block WAN from spoofing LAN
iptables -A INPUT -i eth1 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth1 -s 127.0.0.0/8 -j DROP
iptables -A INPUT -i eth2 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth2 -s 127.0.0.0/8 -j DROP
Anyone have any suggestions? I'd really really appreciate it. Thanks in advance.
- 12-04-2008 #2Just Joined!
- Join Date
- Dec 2008
- Posts
- 3
Okay I figured it out. But now I have another question. I am using two ip routing tables to get this working. Which works nicely. The issue is that the dhcp resolution doesn't dump the gateway info into the specific tables. How could I go about doing that? I'd really rather not have to manually do this everything I restart my router.
- 12-04-2008 #3Just Joined!
- Join Date
- Dec 2008
- Posts
- 3
Nevermind, I figured it all out. Thanks for all the help!! Lol. If anyone needs help doing what I just did try and PM me.


Reply With Quote