Respond request on right gateway

Question

I've got a quite simple scenario. Unfortunately I found no answer matching this problem. I have two linux routers (=gateways) for different WANs (192.168.0.70 and 192.168.0.80). Both are forwarding the port 50000 to a linux server 192.168.0.60. The server has only one interface with default gateway 192.168.0.70. With no additional configuration you have this behaviour:

incomming request over 192.168.0.70 -> response working (beacuse of default gateway)

incomming request over 192.168.0.80 -> not working because response takes 192.168.0.70

How can I manage that the requests through 192.168.0.80 are send back through 192.168.0.80?

Answer 1

We shall have to mark NEW connections with a marker, then distinguish the outgoing packets on the basis of the marker, and use either of two routing tables to route them to the appropriate gateway. It is possible you have to load the CONNTRACK module,

          modprobe ip_conntrack

Let us call MAC70 the MAC address of gateway 192.168.0.70, and MAC80 the MAC address of 192.168.0.80. Then

       iptables -A INPUT -m state --state NEW -m mac --mac-source MAC70 -p tcp --dport 50000 -j CONNMARK --set-mark 1
       iptables -A INPUT -m state --state NEW -m mac --mac-source MAC80 -p tcp --dport 50000 -j CONNMARK --set-mark 2

These two rules mark the incoming, new connections (for TCP protocol, modify if you need to) with two simple markers.The markers are for the whole connections, i.e. all following packets of the type ESTABLISHED, RELATED belonging to this initial packet will have the same mark.

The distinction can only be made on the basis of the MAC address of the gateway, because the source IP address of each packet is that of the client which begins the connection, not that of the gateway. Hence this only applies to ethernet connections, because wifi frames do not carry MAC addresses.

Now

       ip rule add fwmark 1 table router70
       ip rule add fwmark 2 table router80

these two commands specify which routing table (of two) to use, depending on the connection/packet mark.

Now we setup two routing tables:

        echo 200 router70 >> /etc/iproute2/rt_tables
        echo 201 router80 >> /etc/iproute2/rt_tables
        ip route add 192.168.0.0/24 dev eth0 table router70
        ip route add 192.168.0.0/24 dev eth0 table router80
        ip route add default via 192.168.0.70 table router70
        ip route add default via 192.168.0.80 table router80

This assumes your ethernet NIC is called eth0, otherwise change accordingly. The routing for all other ports and/or protocols remains the one you already have, whatever that may be.

You are done.