Hello!

Szeretnek sulyozassal terhelestmegosztani tobb internet kapcsolat kozott. Epitettem egy kis tesztkornyezetetet, de furcsasagokat tapasztalok… Ebben kernem a segitsegeteket. Az lenne a cel, hogy a local halon levo gepek internet elereseihez hasznalja mindket vonalat. Igy nez ki most a teszt rendszer:

local halo -> teszt proxy -> kamu ISP1 | kamu ISP2 -> jelenleg hasznalatos proxy -> internet
10.1.0.0/16    10.1.0.46        1.1.1.10      2.2.2.10            10.1.0.254

A problemam:

Ha a local halon beallitom ot proxynak, megy a net, de nagyon lassu, es csak az egyik „ISP-t (2.2.2.10Ö)” hasznalja. Ha magarol a tesztproxyrol netezek, akkor tokeletesen megy a load balance, es latszolag sebesseg gondok sincsenek..
Mit rontok el?

koszi!!!

A config a teszt proxyn (tudom randa, de legalabb itt van minden):

#!/bin/bash

OIP1=”1.1.1.1″
OIF1=”eth0″

OIP2=”2.2.2.2″
OIF2=”eth1″

INTIP=”10.1.0.46″
INTIF=”eth2″

# define iptables:

IPT=”/sbin/iptables”

# enable forwarding:

echo „1” > /proc/sys/net/ipv4/ip_forward

# Flush existing rules, tables, routes:

$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

ip link set lo down
ip link set eth0 down
ip link set eth1 down
ip link set eth2 down

ip route flush table all

## Our new shiny rules:

$IPT -t nat -A POSTROUTING -o $OIF1 -s 10.1.0.0/16 -j SNAT –to $OIP1
$IPT -t nat -A POSTROUTING -o $OIF2 -s 10.1.0.0/16 -j SNAT –to $OIP2

$IPT -t filter -N keep_state
$IPT -t filter -A keep_state -m state –state NEW,RELATED,ESTABLISHED -j ACCEPT
$IPT -t filter -A keep_state -j RETURN

$IPT -t nat -N keep_state
$IPT -t nat -A keep_state -m state –state NEW,RELATED,ESTABLISHED -j ACCEPT
$IPT -t nat -A keep_state -j RETURN

$IPT -t nat -A PREROUTING -j keep_state
$IPT -t nat -A POSTROUTING -j keep_state
$IPT -t nat -A OUTPUT -j keep_state
$IPT -t filter -A INPUT -j keep_state
$IPT -t filter -A FORWARD -j keep_state
$IPT -t filter -A OUTPUT -j keep_state

## ROUTING:

## our tiny loopback device:

ip link set lo up
ip addr add 127.0.0.1/8 brd + dev lo

## the localnet interface:

ip link set eth2 up
ip addr add 10.1.0.46/16 brd + dev eth2
ip rule add prio 50 table main
ip route del default table main

## the internet interface 1 (ISP1)

ip link set eth0 up
ip addr flush dev eth0
ip addr add 1.1.1.1/16 brd 1.1.255.255 dev eth0

## the internet interface 2 (ISP2)

ip link set eth1 up
ip addr flush dev eth1
ip addr add 2.2.2.2/16 brd 2.2.255.255 dev eth1

##
## The load balancing route table:
##

ip rule add prio 222 table 222
ip route add default table 222 proto static
nexthop via 1.1.1.10 dev eth0
nexthop via 2.2.2.10 dev eth1

## The route table of ISP1

ip rule add prio 201 from 1.1.0.0/16 table 201
ip route add default via 1.1.1.10 dev eth0 src 1.1.1.1 proto static table 201
ip route append prohibit default table 201 metric 1 proto static

## The route table of ISP2

ip rule add prio 202 from 2.2.0.0/16 table 202
ip route add default via 2.2.2.10 dev eth1 src 2.2.2.2 proto static table 202
ip route append prohibit default table 202 metric 1 proto static

ip address list kimenete:

1: lo: mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
      valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:04:e2:00:77:a8 brd ff:ff:ff:ff:ff:ff
    inet 1.1.1.1/16 brd 1.1.255.255 scope global eth0
3: eth1: mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:05:5d:80:51:2f brd ff:ff:ff:ff:ff:ff
    inet 2.2.2.2/16 brd 2.2.255.255 scope global eth1
4: eth2: mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:17:31:92:59:c1 brd ff:ff:ff:ff:ff:ff
    inet 10.1.0.46/16 brd 10.1.255.255 scope global eth2
    inet6 fe80::217:31ff:fe92:59c1/64 scope link
      valid_lft forever preferred_lft forever

ip route list kimenete:

2.2.0.0/16 dev eth1  proto kernel  scope link  src 2.2.2.2
10.1.0.0/16 dev eth2  proto kernel  scope link  src 10.1.0.46
1.1.0.0/16 dev eth0  proto kernel  scope link  src 1.1.1.1

iptables -vL kimenete:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
  395 36066 keep_state  all  —  any    any    anywhere            anywhere           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
    0    0 keep_state  all  —  any    any    anywhere            anywhere           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
  216 26085 keep_state  all  —  any    any    anywhere            anywhere           

Chain keep_state (3 references)
pkts bytes target    prot opt in    out    source              destination       
  611 62151 ACCEPT    all  —  any    any    anywhere            anywhere            state NEW,RELATED,ESTABLISHED
    0    0 RETURN    all  —  any    any    anywhere            anywhere   

iptables -t nat -vL kimenete:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
  24  4238 keep_state  all  —  any    any    anywhere            anywhere           

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
    0    0 SNAT      all  —  any    eth0    10.1.0.0/16          anywhere            to:1.1.1.1
    1  428 SNAT      all  —  any    eth1    10.1.0.0/16          anywhere            to:2.2.2.2
    1    69 keep_state  all  —  any    any    anywhere            anywhere           

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target    prot opt in    out    source              destination       
    1    69 keep_state  all  —  any    any    anywhere            anywhere           

Chain keep_state (3 references)
pkts bytes target    prot opt in    out    source              destination       
  26  4376 ACCEPT    all  —  any    any    anywhere            anywhere            state NEW,RELATED,ESTABLISHED
    0    0 RETURN    all  —  any    any    anywhere            anywhere           

ip rule kimenete:

0:      from all lookup local
50:    from all lookup main
201:    from 1.1.0.0/16 lookup 201
202:    from 2.2.0.0/16 lookup 202
222:    from all lookup 222
32766:  from all lookup main
32767:  from all lookup default

es ez itt pl nagyon furi (nekem):

tesztproxy:~# ip route get 72.14.207.99
72.14.207.99 via 2.2.2.10 dev eth1  src 1.1.1.1
    cache  mtu 1500 advmss 1460 hoplimit 64

tesztproxy:~# ip route get 72.21.210.11
72.21.210.11 via 2.2.2.10 dev eth1  src 2.2.2.2
    cache  mtu 1500 advmss 1460 hoplimit 64