snat to multiple source ip

[Marco Berizzi]

Edmundo Carmona wrote:

> You are using multiroute path, right?

This is my firewall/proxy schema:


        +---------+
        |         |
        |         |              ---HDSL
        |         |             /
Private |firewall |            /
--------+         +---eth0----+-----adslA
network |   &     |            \
        | Squid   |             \
        |         |              ---adslB
        |         |
        +---------+


> what is the output of

> ip route show default

> (on the router, of course).

Here is:

hdsl_default_gateway_ip dev eth0  scope link
adslB_network dev eth0  proto kernel  scope link  src adslB_ip
adslA_network dev eth0  proto kernel  scope link  src adslA_ip
hdsl_network dev eth1  scope link
my_private_network dev eth2  proto kernel  scope link  src
linux_private_ip
127.0.0.0/8 dev lo  scope link
default via hdsl_default_gateway_ip dev eth0  metric 1

Then I run this script to add ip & gw for adsl connections:

$IP address add $ip_adsl_a/$netmask_adsl_a brd + dev eth0 label
eth0:adslA
$IP address add $ip_adsl_b/$netmask_adsl_b brd + dev eth0 label
eth0:adslB

$IP route add $adsl_network_a dev eth0 src $ip_adsl_a table adslA
$IP route add default via $GW_adsl_a table adslA
$IP route add $adsl_network_b dev eth0 src $ip_adsl_b table adslB
$IP route add default via $GW_adsl_b table adslB

$IP route add $adsl_network_a dev eth0 src $ip_adsl_a table adsl
$IP route add $adsl_network_b dev eth0 src $ip_adsl_b table adsl
$IP route add default equalize table adsl \
             nexthop dev eth0 via $GW_adsl_a weight 1 \
             nexthop dev eth0 via $GW_adsl_b weight 1

$IP rule add fwmark 1 table adsl priority 400
[firewall mark packets so they are going to this routing table]

However routing and SNAT should not be related.
My question is the following.
How does SNAT work when multiple ip are specified?

iptables -t nat -I POSTROUTING -s ipX --protocol tcp
-j SNAT --to first_ip --to second_ip

Why everytime I connect to www.dnsstuff.com I get always the
first_ip? And after refreshing show me the second ip?
I *think* that the round robin cycle works on a per socket/per host
couple.
Example:

1st socket opened to a.a.a.a  -->> SNAT with first_ip
2nd socket opened to b.b.b.b  -->> SNAT with first_ip
3rd socket opened to c.c.c.c  -->> SNAT with first_ip
4th socket opened to b.b.b.b  -->> SNAT with second_ip
5th socket opened to d.d.d.d  -->> SNAT with first_ip
6th socket opened to a.a.a.a  -->> SNAT with second_ip

Can anyone confirm this? Wrong or correct?