More questions on policy routing w/ multiple links

Chris Chabot chabotc@reviewboard.com
Mon, 20 Aug 2001 04:34:37 +0200


Ok, after a few days of playing around with iproute2 and iptables, i
have found out how to send replies out over the interface that the
connection came in from ... in the end it's quite simple (found the
awser in an old post to the linux kernel list:
http://boudicca.tux.org/hypermail/linux-kernel/2000week23/0695.html)

So now that i have that working, i would love to be able to route
certain services over certain routes.. The Linux Advanced Routing How-To
will give you the folowing example:

# echo 201 mail.out >> /etc/iproute2/rt_table_names
# iptables -A PREROUTING -t mangle -p tcp --dport 25 -j MARK --set-mark
1
# ip rule add fwmark 1 table mail.out
# ip route add default via GATEWAY dev DEV table mail.out

However, when i think about how this would apply to my setup, i see a
number of problems. First of all, since the uplinks are a cable modem &
an adsl modem, they dont accept 'foreign source ip's'. So plain routing
the trafic thru a different interface won't do.

So, i presumed the awnser would be SNAT (source addr. translation),
using SNAT to set the source IP to the correct link's ip address. So
while reading the iptables documentation, i found this SNAT line:

# iptables -t nat -A POSTROUTING -p tcp --dport 25 -j SNAT --to CABLE_IP

This will translate the IP addr 'ADSL_IP' to 'CABLE_IP' when the packet
is destined for port 25 ... however (!) since this is only posible for a
POSTROUTING chain, and not PREROUTING, the packet will be send thru the
ADSL line (which is the default route), instead of the CABLE line (Now
with the CABLE_IP as source ip though, which is invalid for that link,
so the packet dies an early death)

Does anyone know how to solve this?

What i would like to achive:

* When the box has an outgoing connection to dest port [ pop3 / smtp /
imap ], use the cable modem's ip and link
* On any other outgoing connection, leave as is (adsl modem's ip and
link)

Any help or hints would be greatly appreciated!

    --Chris