You are not logged in.
Chain PREROUTING (policy ACCEPT 111 packets, 12435 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  371 29929 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK restore
  260 17494 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* this stream is already marked; escape early */ mark match ! 0x0
    2   121 MARK-gw1   all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            /* prevent asynchronous routing */ ctstate NEW
    0     0 MARK-gw2   all  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            /* prevent asynchronous routing */ ctstate NEW
Chain INPUT (policy ACCEPT 369 packets, 29857 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain OUTPUT (policy ACCEPT 535 packets, 515K bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain POSTROUTING (policy ACCEPT 535 packets, 515K bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain DEF_POL (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CONNMARK   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    0     0 CONNMARK   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    0     0 MARK-gw1   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 MARK-gw1   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
Chain MARK-gw1 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    2   121 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* send via 192.168.178.1 */ MARK set 0x65
    2   121 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK save
    2   121 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain MARK-gw2 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* send via 192.168.1.1 */ MARK set 0x66
    0     0 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK save
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0 Why everything is zero?? O.o
Last edited by ttouch (2012-11-18 22:28:07)
GitHub | Git Server | Blog
Offline
That appears to be correct, but you're missing the jump to DEF_POL though! (my mistake too for not picking up on that earlier!)
iptables -t mangle -A PREROUTING -j DEF_POLAre you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
done.
the only change in the table is:
  475  661K DEF_POL    all  --  *      *       0.0.0.0/0            0.0.0.0/0
when I `ip route del default via 192.168.178.1` to test that bonding is ok, I have no internet connection.
I think that the iptables are ok. ip might be the problem.
PS: Man, I owe you a beer. I really appreciate your help and your patience. Thank you!
GitHub | Git Server | Blog
Offline
So what is the output of `iptables -t mangle -nvL DEF_POL` now?
How are you testing by the way?
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
Chain DEF_POL (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1903 2114K CONNMARK   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    6   831 CONNMARK   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    0     0 MARK-gw1   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 MARK-gw1   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ mark match 0x0 ctstate NEW statistic mode nth every 2 packet 1I `ip route del default via 192.168.178.1` and refresh a page in ff.
I have static google DNS servers in resolv.conf
GitHub | Git Server | Blog
Offline
Strange. I don't understand now.
Perhaps the match 0x0 in the DEF_POL chain isn't matching. Let's try taking them out:
#!/bin/bash
/usr/sbin/ip route flush table ISP1 2>/dev/null
/usr/sbin/ip rule del fwmark 101 table ISP1 2>/dev/null
/usr/sbin/ip route add table ISP1 192.168.178.0/24 dev eth0 proto kernel  scope link  src 192.168.178.31  metric 202 2>/dev/null
/usr/sbin/ip route add table ISP1 default via 192.168.178.1 dev eth0
/usr/sbin/ip rule add fwmark 101 table ISP1
/usr/sbin/ip route flush table ISP2 2>/dev/null
/usr/sbin/ip rule del fwmark 102 table ISP2 2>/dev/null
/usr/sbin/ip route add table ISP2 192.168.178.0/24 dev eth0 proto kernel  scope link  src 192.168.178.31  metric 202 2>/dev/null
/usr/sbin/ip route add table ISP2 default via 192.168.1.1 dev wlan0
/usr/sbin/ip rule add fwmark 102 table ISP2
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -t mangle -X
/usr/sbin/iptables -t mangle -N MARK-gw1
/usr/sbin/iptables -t mangle -A MARK-gw1 -m comment --comment 'send via 192.168.178.1' -j MARK --set-mark 101
/usr/sbin/iptables -t mangle -A MARK-gw1 -j CONNMARK --save-mark
/usr/sbin/iptables -t mangle -A MARK-gw1 -j RETURN
/usr/sbin/iptables -t mangle -N MARK-gw2
/usr/sbin/iptables -t mangle -A MARK-gw2 -m comment --comment 'send via 192.168.1.1' -j MARK --set-mark 102
/usr/sbin/iptables -t mangle -A MARK-gw2 -j CONNMARK --save-mark
/usr/sbin/iptables -t mangle -A MARK-gw2 -j RETURN
/usr/sbin/iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment "this stream is already marked; escape early" -m mark ! --mark 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i eth0 -m conntrack --ctstate NEW -j MARK-gw1
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i wlan0 -m conntrack --ctstate NEW -j MARK-gw2
/usr/sbin/iptables -t mangle -N DEF_POL
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p udp -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
/usr/sbin/iptables -t mangle -A PREROUTING -j DEF_POL
/usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound eth0' -o eth0 -s 192.168.0.0/16 -m mark --mark 101 -j SNAT --to-source 192.168.178.95
/usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound wlan0' -o wlan0 -s 192.168.0.0/16 -m mark --mark 102 -j SNAT --to-source 192.168.1.95
/usr/sbin/ip route flush cacheAre you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
I will test the new script tomorrow.
I just realised that my 'tests' was useless. I turned off the KDE's feature to restore the sessions. I rebooted and:
i. the ethernet wire was in the wrong interface than that configured in netcfg (?!?!?!?!?!)
ii. the iptables service was not started
iii. the script threw error (something about DEF_POL, but i fixed it)
iv. even with route add, I have no internet connection.
I'm sorry for wasting your time...
the script:
#!/bin/bash
/usr/sbin/ip route flush table ISP1 2>/dev/null
/usr/sbin/ip rule del fwmark 101 table ISP1 2>/dev/null
/usr/sbin/ip route add table ISP1 192.168.178.0/24 dev eth0 proto kernel  scope link  src 192.168.178.31  metric 202 2>/dev/null
/usr/sbin/ip route add table ISP1 default via 192.168.178.1 dev eth0
/usr/sbin/ip rule add fwmark 101 table ISP1
/usr/sbin/ip route flush table ISP2 2>/dev/null
/usr/sbin/ip rule del fwmark 102 table ISP2 2>/dev/null
/usr/sbin/ip route add table ISP2 192.168.178.0/24 dev eth0 proto kernel  scope link  src 192.168.178.31  metric 202 2>/dev/null
/usr/sbin/ip route add table ISP2 default via 192.168.1.1 dev wlan0
/usr/sbin/ip rule add fwmark 102 table ISP2
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -t mangle -X
/usr/sbin/iptables -t mangle -N MARK-gw1
/usr/sbin/iptables -t mangle -A MARK-gw1 -m comment --comment 'send via 192.168.178.1' -j MARK --set-mark 101
/usr/sbin/iptables -t mangle -A MARK-gw1 -j CONNMARK --save-mark
/usr/sbin/iptables -t mangle -A MARK-gw1 -j RETURN
/usr/sbin/iptables -t mangle -N MARK-gw2
/usr/sbin/iptables -t mangle -A MARK-gw2 -m comment --comment 'send via 192.168.1.1' -j MARK --set-mark 102
/usr/sbin/iptables -t mangle -A MARK-gw2 -j CONNMARK --save-mark
/usr/sbin/iptables -t mangle -A MARK-gw2 -j RETURN
/usr/sbin/iptables -t mangle -N DEF_POL
/usr/sbin/iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment "this stream is already marked; escape early" -m mark ! --mark 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i eth0 -m conntrack --ctstate NEW -j MARK-gw1
/usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i wlan0 -m conntrack --ctstate NEW -j MARK-gw2
/usr/sbin/iptables -t mangle -A PREROUTING -j DEF_POL
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p udp -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -m mark --mark 0 -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -m mark --mark 0 -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -m mark --mark 0 -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -m mark --mark 0 -p tcp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -m mark --mark 0 -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -m mark --mark 0 -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -m mark --mark 0 -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
/usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -m mark --mark 0 -p udp -m conntrack --ctstate NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
/usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound eth0' -o eth0 -s 192.168.0.0/16 -m mark --mark 101 -j SNAT --to-source 192.168.178.95
/usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound wlan0' -o wlan0 -s 192.168.0.0/16 -m mark --mark 102 -j SNAT --to-source 192.168.1.95
/usr/sbin/ip route flush cacheLast edited by ttouch (2012-11-22 07:37:49)
GitHub | Git Server | Blog
Offline
iptables -t mangle -nvL:
Chain PREROUTING (policy ACCEPT 1 packets, 55 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    55 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK restore
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* this stream is already marked; escape early */ mark match ! 0x0
    0     0 MARK-gw1   all  --  eth0   *       0.0.0.0/0            0.0.0.0/0            /* prevent asynchronous routing */ ctstate NEW
    0     0 MARK-gw2   all  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            /* prevent asynchronous routing */ ctstate NEW
    1    55 DEF_POL    all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain INPUT (policy ACCEPT 1 packets, 55 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
Chain DEF_POL (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    1    55 CONNMARK   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    0     0 CONNMARK   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default balancing */ ctstate RELATED,ESTABLISHED CONNMARK restore
    0     0 MARK-gw1   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 tcp */ ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 tcp */ ctstate NEW statistic mode nth every 2 packet 1
    0     0 MARK-gw1   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ ctstate NEW statistic mode nth every 2
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw1 udp */ ctstate NEW statistic mode nth every 2
    0     0 MARK-gw2   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ ctstate NEW statistic mode nth every 2 packet 1
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* balance gw2 udp */ ctstate NEW statistic mode nth every 2 packet 1
Chain MARK-gw1 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* send via 192.168.178.1 */ MARK set 0x65
    0     0 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK save
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
Chain MARK-gw2 (3 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* send via 192.168.1.1 */ MARK set 0x66
    0     0 CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK save
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0I can't figure out what's wrong...
How can I actually test if the network is load balanced?
when I execute the script and route add manually, I have Internet connection, but I think that it's not load balanced.
GitHub | Git Server | Blog
Offline
That output is after your test?
Try using this as your test:
curl http://ipq.li/How can I actually test if the network is load balanced?
Running the above command multiple times, you should get your different IP addresses each time.
when I execute the script and route add manually, I have Internet connection, but I think that it's not load balanced.
Correct, that's just using the one connection.
Last edited by fukawi2 (2012-11-22 22:33:18)
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
Offline
I'm out of ideas right now.
It's almost like traffic that originates locally doesn't go through the PREROUTING chain in the mangle table, but I'm sure it does.
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
apart from `systemctl start iptables` do I have to do anything else to enable the iptables?
Last edited by ttouch (2012-11-23 16:03:50)
GitHub | Git Server | Blog
Offline
apart from `systemctl start iptables` do I have to do anything else to enable the iptables?
No.
All that does is execute `iptables-restore < /etc/iptables/iptables.rules` anyway, there's nothing special about it (no daemons or anything)
Last edited by fukawi2 (2012-11-25 22:05:25)
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
I have no choice but to knock my head against the wall...
GitHub | Git Server | Blog
Offline