I could look into shorewall, but I'm baffeled as to why my configuration isn't working.
I dropped my eth1/eth2 and all ip route stuff, and went exactly with the configuration from the website mentioned above (but changed eth0=eth1), but I still get miss matched IP routes.
office:~# ip route get to
11.1.1.111.1.1.1 via
192.168.0.1 dev eth2 src
192.168.0.200 cache mtu 1500 advmss 1460 hoplimit 64
office:~# ip route get to
12.1.1.112.1.1.1 via
192.168.0.1 dev eth2 src
192.168.1.200
cache mtu 1500 advmss 1460 hoplimit 64
office:~# ip route get to
13.1.1.113.1.1.1 via
192.168.0.1 dev eth2 src
192.168.0.200 cache mtu 1500 advmss 1460 hoplimit 64
office:~# ip route get to
14.1.1.114.1.1.1 via
192.168.0.1 dev eth2 src
192.168.1.200 cache mtu 1500 advmss 1460 hoplimit 64
office:~# ip route get to
15.1.1.1
15.1.1.1 via
192.168.0.1 dev eth2 src
192.168.0.200 cache mtu 1500 advmss 1460 hoplimit 64
office:~#
First of all it seems to never want want to route via eth1, and we see a mismatch where eth1 source ip is trying to go out via eth2, and this is the exact same behavior my configuration is having.
Totally stumped..