[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Two gateways on same network

It is normal that if I connect to your public IP (say IPa) from the
128k line my connection times out.

It is normal because I am in Internet and my machine sends the SYN
packet to your IPa, then SYN packet arrives to your linux machine, but
the routing table in your linux machine says that the response
(SYN/ACK packet) must go via the 4Mb ADSL gateway (
The SYN/ACK traverses the 4Mb gateway and the gateway NATs this packet
(the source IP) with it's public IP address (say IPb).
So, from the point of view of my machine, I send the SYN packet to IPa
but the response (SYN/ACK packet) arrives from IPb (my machine knows
NOTHING about IPb).
Of course the connection can NOT be established.
In summary:
Of course, ip routes are system wide (not per interface routes).

There are a lot of ways, following is my proposal:
1. Your linux machine has only one network card. In this card you will
use two ip addresses, one primary and one virtual, in other words:
ifconfig eth0 netmask up
ifconfig eth0:1 netmask up
2. Configure NAT of your routers in the following way:
Router 4Mb will forward port 25 of their public ip to
Router 128k will forward port 25 of their public ip to
3. Here comes the "trick".
Linux kernel allows you to have multiple routing tables at the same
time (don't panic, it is very easy ti use :-) ).
Install iproute2 package.
The idea is to have two routing tables.
One table (table_isp4M) says that the default route is
The other one (table_isp128k) says that the default route is
Then, add ip rules (NOT ip routes) for using table_isp4M is the
traffic comes from and table_isp128k if the traffic comes
Note that, it is mandatory that if a machine have multiple interfaces
that can reach the client ip, a TCP response must use the IP address
that have received the SYN packet from the client.
4. Create the two routing tables (see Linux Advanced Routing HOWTO)
but this is very simple, it is only to put two lines (one for each
routing table) at /etc/iproute2/rt_tables
5. Add the static routes to one of each tables.
ip route add default via table isp_128k
ip route add default via table isp_4M
6. Add ip rules
First, see the output from "ip rules show"
ip rule add from lookup table table_isp4M
ip rule add from lookup table table_128k

At this point, you will answer port 25 tcp connections via the 4M link
if the SYN packet  from internet arrives to IPa or 128k link if the
syn packet from internet arrives from IPb.

Of course, linux kernel allows you to do more cool things like this,
for example, keep in mind that it is possible to use iptables to
"mark" (no packet alteration at all, only a mark while the packet
traverses the kernel code) packets using almost ANY criteria and then
use one table or another in function of that mark.

Hope this helps.


On 12/7/06, Hans du Plooy <koffiejunkielistlurker@koffiejunkie.za.net> wrote:
Hi guys,

I'm setting up a Debian antispam mail relay.  I have two gateways on the
network (two separate internet connections):

4mbit ADSL =
128k line =

Both have NAT firewalls, both forward port 25 to the Debian box.  I'm
trying to do the following:

Always use as the default gateway, except when:

1.  Connections are received via  Because if it doesn't
reply via the same gateway, the connection just times out.

2.'s connection goes down, for whatever reason.

So basically the leased line would be a backup MX.

I have put two network cards in, both with IPs on the same network, but
with different gateways specified in /etc/network/interfaces.  But for
some reason both try to use as the gateway, regardless.

If the second network card is not necessary, that would be OK too.


To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: