| View previous topic :: View next topic |
| Author |
Message |
jkhax0r
n00b
Joined: 07 Mar 2005
Posts: 22
|
 Posted: Thu Dec 15, 2005 5:22 pm Post subject: Traffic Shaping Problem |
 |
|
I am trying to setup a sort of router/firewall for my home that will effectively obtain two IPs to the internet and do a sort of connection sharing between the two...
I have two wired NICs and one wireless card
I am trying to set it up so that one NIC connects to my Cable Modem, the wireless card connects to a separate wireless AP, and the other NIC connects to a switch and the rest of my network. When just using the wireless, I have no problems setting up a dhcp server and sharing out the internet connection to my network.
I have setup fwbuilder, however, to forward all packets with a destination of TCP/UDP ports > 1000 out the wireless connection and all others out the wired WAN connection. When I grab a dynamic IP from my cable modem, and then grab a dynamic IP from the wireless AP, its like the only internet connection that exists is the most recent one I connected to. I am experienced with gentoo on the desktop but am a complete noob to anything server/iptables related so I am guessing this is something obvious. I can provide the produced fwbuilder script if necessary.
When I only connect to one connection, and just change the NAT rule to disregard the ports, everything works. With the port triggering on, if I connect to the Wired Cable modem, I can send traffic and do web browsing, then If I connect the wireless, the web browsing dies (port 80), but access to upper ports starts working. I'm sure this is something obvious to anyone who has ever done any traffic shaping with 2 internet connections on one box. Its just like both can't exist at once.
Thank you for reading. |
|
| Back to top |
|
 |
frostschutz
Advocate
Joined: 22 Feb 2005
Posts: 2977
Location: Germany
|
| Posted: Thu Dec 15, 2005 5:54 pm Post subject: Re: Traffic Shaping Problem |
|
|
| jkhax0r wrote: | | I have setup fwbuilder, however, to forward all packets with a destination of TCP/UDP ports > 1000 out the wireless connection and all others out the wired WAN connection. |
I could help with traffic shaping problems to a certain extend, but what you seem to have here is a routing problem. What you're looking for is a way to do port-based routing. I've never done anything like that, but the general way to go about this seems to be to mark the packets with iptables (using 0:1000 port range or whatever), and then have them sorted into routing tables you created with iproute2. This process is described to some extend on this page. |
|
| Back to top |
|
|
jkhax0r
n00b
Joined: 07 Mar 2005
Posts: 22
|
| Posted: Thu Dec 15, 2005 7:19 pm Post subject: |
|
|
First off, thank you for your reply.
From the link you referenced:
| Quote: | | I'll restrict my comments to statically assigned public IP address ranges unless I mention (in particular) dynamically allocated addresses. |
I will be using dynamically assigned addresses from my ISP. I think the line that needs to be changed is:
| Quote: | iptables -t nat -A POSTROUTING -o eth4 -j SNAT --to-source 67.17.28.12
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 205.254.211.179 |
Would this somehow work:
| Code: | iptables -t nat -A POSTROUTING -o eth4 -j SNAT --to-source eth0
iptables -t nat -A POSTROUTING -o eth4 -j SNAT --to-source wlan0
|
or should I just setup a script to somehow read the dynamically assigned address from ifconfig and change it to | Code: | iptables -t nat -A POSTROUTING -o eth4 -j SNAT --to-source $DYNAMIC_ETH0_IP
iptables -t nat -A POSTROUTING -o eth4 -j SNAT --to-source $DYNAMIC_WLAN_IP |
It seems there should be a better way.
Excuse me if I am way off... I have not even gotten a chance to go home yet to try this.
Again, thanks for the post... I think it will save me from hours and hours of just trial and error. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
