LINUX.ORG.RU

2 wan routing HELP


0

0

Имеется следующая конфигурация :


маршруты

193.111.254.232	255.255.255.248	0.0.0.0	WAN 
192.168.0.0	255.255.255.0	0.0.0.0	LAN & WLAN 
169.254.0.0	255.255.0.0	0.0.0.0	LAN & WLAN 
0.0.0.0	0.0.0.0	193.111.254.233	WAN


правило для фаерволла

#!/bin/sh 
WAN2_IFNAME=vlan2 
WAN2_IPADDR=10.0.0.2 
WAN2_GATEWAY=10.0.0.1 
WAN2_NETMASK=255.0.0.0 
if [ "$(nvram get wan2_ipaddr)" != "$WAN2_IPADDR" ]; then 
nvram set wan2_ifname=$WAN2_IFNAME 
nvram set wan2_ipaddr=$WAN2_IPADDR 
nvram set wan2_gateway=$WAN2_GATEWAY 
nvram set wan2_netmask=$WAN2_NETMASK 
nvram commit 
fi 
ifconfig $(nvram get wan2_ifname) up $(nvram get wan2_ipaddr) netmask $(nvram get wan2_netmask) 
#!/bin/sh 
ip rule flush 
ip rule add lookup main prio 32766 
ip rule add lookup default prio 32767 
ip rule add from $(nvram get wan_ipaddr) table 100 prio 100 
ip rule add fwmark 0x100 table 100 prio 101 
ip rule add from $(nvram get wan2_ipaddr) table 200 prio 200 
ip rule add fwmark 0x200 table 200 prio 201 
ip route flush table 100 
ip route flush table 200 
for TABLE in 100 200 
do 
ip route | grep link | while read ROUTE 
do 
ip route add table $TABLE to $ROUTE 
done 
done 
ip route add table 100 default via $(nvram get wan_gateway) 
ip route add table 200 default via $(nvram get wan2_gateway) 
#!/bin/sh 
#DD-WRT firewall rules 
#BEGIN 
#apply simple forward rules 
for RULE in $(nvram get forward_spec) 
do 
FROM=`echo $RULE | cut -d '>' -f 1` 
TO=`echo $RULE | cut -d '>' -f 2` 
STATE=`echo $FROM | cut -d ':' -f 2` 
PROTO=`echo $FROM | cut -d ':' -f 3` 
SPORT=`echo $FROM | cut -d ':' -f 4` 
DEST=`echo $TO | cut -d ':' -f 1` 
DPORT=`echo $TO | cut -d ':' -f 2` 
if [ "$STATE" = "on" ]; then 
if [ "$PROTO" = "both" ]; then 
#udp 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p udp --dport $SPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p udp -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT 
#tcp 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p tcp --dport $SPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT 
else 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p $PROTO --dport $SPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p $PROTO -d $(nvram get wan2_ipaddr) --dport $SPORT -j DNAT --to $DEST:$DPORT 
fi 
fi 
done 
#apply range forward rules 
for RULE in $(nvram get forward_port) 
do 
FROM=`echo $RULE | cut -d '>' -f 1` 
TO=`echo $RULE | cut -d '>' -f 2` 
STATE=`echo $FROM | cut -d ':' -f 2` 
PROTO=`echo $FROM | cut -d ':' -f 3` 
SPORT=`echo $FROM | cut -d ':' -f 4` 
EPORT=`echo $FROM | cut -d ':' -f 5` 

if [ "$STATE" = "on" ]; then 
if [ "$PROTO" = "both" ]; then 
#udp 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p udp --dport $SPORT:$EPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p udp -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO 
#tcp 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p tcp --dport $SPORT:$EPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO 
else 
#iptables -A FORWARD -d $(nvram get wan2_ipaddr) -p $PROTO --dport $SPORT:$EPORT -j ACCEPT 
iptables -A PREROUTING -t nat -p $PROTO -d $(nvram get wan2_ipaddr) --dport $SPORT:$EPORT -j DNAT --to $TO 
fi 
fi 
done 
iptables -A PREROUTING -t nat -p icmp -d $(nvram get wan2_ipaddr) -j DNAT --to $(nvram get lan_ipaddr) 
if [ $(nvram get remote_management) -eq 1 ]; then 
iptables -A PREROUTING -t nat -p tcp -d $(nvram get wan2_ipaddr) \ 
--dport $(nvram get http_wanport) -j DNAT --to $(nvram get lan_ipaddr):$(nvram get http_lanport) 
fi 
if [ $(nvram get dmz_enable) -eq 1 ]; then 
DMZ_IP=$(nvram get lan_ipaddr | sed -r 's/[0-9]+$//')$(nvram get dmz_ipaddr) 
iptables -A PREROUTING -t nat -d $(nvram get wan2_ipaddr) -j DNAT --to $DMZ_IP 
fi 
iptables -A PREROUTING -t nat --dest $(nvram get wan2_ipaddr) -j TRIGGER --trigger-type dnat 
iptables -A FORWARD -i $(nvram get wan2_ifname) -o $(nvram get lan_ifname) -j TRIGGER --trigger-type in 
iptables -A PREROUTING -t mangle -i $(nvram get wan2_ifname) -j IMQ --todev 0 
iptables -A PREROUTING -t mangle -i $(nvram get wan2_ifname) -j SVQOS_IN 
iptables -A POSTROUTING -t mangle -o $(nvram get wan2_ifname) -j SVQOS_OUT 
#DD-WRT END 
#Save the gateway in the connection mark for new incoming connections 
iptables -t mangle -A PREROUTING -i $(nvram get wan_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100 
iptables -t mangle -A PREROUTING -i $(nvram get wan2_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x200 
# Save the gateway in the connection mark for new outgoing connections 
iptables -t mangle -A POSTROUTING -o $(nvram get wan_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100 
iptables -t mangle -A POSTROUTING -o $(nvram get wan2_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x200 
# Use the correct gateway for reply packets from the LAN 
iptables -t mangle -A PREROUTING -i $(nvram get lan_ifname) -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark 
# Use the correct gateway for reply packets from local connections 
iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark 
#mask known packets to its source address 
iptables -A POSTROUTING -t nat -m mark --mark 0x100 -j SNAT --to-source $(nvram get wan_ipaddr) 
iptables -A POSTROUTING -t nat -m mark --mark 0x200 -j SNAT --to-source $(nvram get wan2_ipaddr) 
#permit access to wan2 
iptables -A POSTROUTING -t nat -j MASQUERADE -o $(nvram get wan2_ifname) 
#restore-mark is done in PREROUTING. If restored again, will loose the outgoing marks 
iptables -t mangle -D SVQOS_OUT -j CONNMARK --restore-mark 2> /dev/null 
#iptables -t mangle -A PREROUTING -i $(nvram get lan_ifname) -m multiport -p tcp --dport 22,25,80,110,119,143,443,993,3389 -j MARK --set-mark 0x100 
#use WAN1 for common navigation, WAN2 for P2P traffic and others 
#iptables -t mangle -I PREROUTING -i $(nvram get lan_ifname) -s 192.168.1.100 -j MARK --set-mark 0x200 
#iptables -t mangle -I PREROUTING -i $(nvram get lan_ifname) -s 192.168.1.100 -j LOG --log-prefix 'P2P: ' 
RP_PATH=/proc/sys/net/ipv4/conf 
for IFACE in `ls $RP_PATH`; do 
echo 0 > $RP_PATH/$IFACE/rp_filter 
done

1) задача добавить роуты для 2 го ван интерфеса средствами Iptables
2) при падении 1 го из ванов все переходит на другой?
3) нормально ли будет работать подобная балансировка
СПАСИБО БОЛЬШОЕ ЗАРАНЕЕ ЗА ВАШУ ПОМОШЬ


Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.