iptables PortForward не работает должным образом
4 интернет-провайдера подключены к шлюзу, я попытался использовать iptables для балансировки нагрузки, но только один интернет-провайдер используется для подключения к Интернету, в то время как остальные интернет-провайдеры бездействуют, как видно из вывода ifstat.
Пожалуйста, пройдите сценарий и посоветуйте соответственно. Ваша помощь очень ценится.
# /etc/network/interfaces
auto lo
iface lo inet loopback
auto enp4s5f0
iface enp4s5f0 inet static
address 192.168.7.2
netmask 255.255.255.0
gateway 192.168.7.1
dns-nameservers 8.8.8.8 8.8.4.4
auto enp4s5f1
iface enp4s5f1 inet static
address 192.168.8.2
netmask 255.255.255.0
gateway 192.168.8.1
dns-nameservers 8.8.8.8 8.8.4.4
auto enp4s6f0
iface enp4s6f0 inet static
address 192.168.9.2
netmask 255.255.255.0
gateway 192.168.9.1
dns-nameservers 8.8.8.8 8.8.4.4
auto enp4s6f1
iface enp4s6f1 inet static
address 192.168.10.2
netmask 255.255.255.0
gateway 192.168.10.1
dns-nameservers 8.8.8.8 8.8.4.4
auto ens2
iface ens2 inet static
address 192.168.2.190
netmask 255.255.255.0
#gateway 192.168.2.1
dns-nameservers 8.8.8.8 8.8.4.4
ipt.sh
#!/bin/bash
set -x
IPT="/sbin/iptables"
NIC1="enp4s5f0"
NIC2="enp4s5f1"
NIC3="enp4s6f0"
NIC4="enp4s6f1"
LAN="ens2"
ISP1="192.168.7.33"
ISP2="192.168.8.33"
ISP3="192.168.9.33"
ISP4="192.168.10.33"
IIP="192.168.2.190"
echo 1 >| /proc/sys/net/ipv4/ip_forward
echo 0 >| /proc/sys/net/ipv4/conf/all/rp_filter
#***************
# reset iptables
#_______________
## reset the default policies in the filter table.
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
## reset the default policies in the nat table.
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
## reset the default policies in the mangle table.
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
## flush all the rules in the filter and nat tables.
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
## erase all chains that's not default in filter and nat table.
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X
#****************
# rules
#________________
$IPT -A INPUT -m state --state INVALID -j DROP
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p icmp -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
$IPT -A FORWARD -m state --state INVALID -j DROP
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -p icmp -j ACCEPT
#****************
ip route add default scope global \
nexthop via $ISP1 dev $NIC1 weight 1 \
nexthop via $ISP2 dev $NIC2 weight 1 \
nexthop via $ISP3 dev $NIC3 weight 1 \
nexthop via $ISP4 dev $NIC4 weight 1
#iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
#iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
#iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.25 -j MARK --set-mark 10
#iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.25 -j MARK --set-mark 20
#iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.25 -j MARK --set-mark 30
#iptables -t mangle -A PREROUTING -m statistic --mode random --probability 0.25 -j MARK --set-mark 40
#iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
$IPT -A POSTROUTING -t nat -s 192.168.2.0/255.255.255.0 -o $NIC1 -j SNAT --to-source $ISP1
$IPT -A POSTROUTING -t nat -s 192.168.2.0/255.255.255.0 -o $NIC2 -j SNAT --to-source $ISP2
$IPT -A POSTROUTING -t nat -s 192.168.2.0/255.255.255.0 -o $NIC3 -j SNAT --to-source $ISP3
$IPT -A POSTROUTING -t nat -s 192.168.2.0/255.255.255.0 -o $NIC4 -j SNAT --to-source $ISP4
#$IPT -A POSTROUTING -t nat -s 192.168.2.0/255.255.255.0 -o $NIC4 -j SNAT --to-source $ISP4
iptables -P FORWARD DROP
#********************************
# allow certain hosts full access
#________________________________
allowHost() {
iptables -A FORWARD -i $LAN -s $1 -j ACCEPT
}
ip route flush cache
ifstat -bt
ens2 enp4s5f0 enp4s5f1 enp4s6f0 enp4s6f1
Kbps in Kbps out Kbps in Kbps out Kbps in Kbps out Kbps in Kbps out Kbps in Kbps out
1.88 0.00 0.94 0.47 0.00 0.00 0.00 0.00 0.00 0.00
2.04 0.00 0.70 0.70 0.00 0.00 0.00 0.00 0.00 0.00
8.09 6.98 1.17 0.70 0.47 0.00 1.40 0.47 0.47 0.00
1.31 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
3.14 0.00 0.52 0.52 0.00 0.00 0.00 0.00 0.00 0.00
3.14 0.00 0.51 0.51 0.00 0.00 0.00 0.00 0.00 0.00
2.68 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
7.87 4.68 0.47 0.00 0.47 0.00 0.47 0.00 0.47 0.00
1.78 0.33 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
4.66 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
30271.07 915.72 0.00 0.00 0.94 0.47 0.00 0.00 0.00 0.00
5576.91 566.14 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
170.83 208.16 0.47 0.00 0.47 0.00 0.47 0.00 0.47 0.00
37166.45 1144.21 56.66 30.21 0.00 0.00 0.00 0.00 0.00 0.00
87935.34 2220.31 36.37 1.54 0.00 0.00 0.00 0.00 0.00 0.00
11944.23 263.43 0.94 0.98 0.00 0.00 0.00 0.00 0.00 0.00
25600.64 564.53 0.51 0.00 0.00 0.00 0.00 0.00 0.00 0.00
3.13 0.00 0.47 0.00 0.00 0.00 1.40 0.47 0.47 0.00
26966.93 609.43 0.47 0.47 0.47 0.00 0.00 0.00 0.00 0.00
3.14 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
3.14 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
2.68 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
3.13 0.00 0.47 0.00 0.00 0.00 0.47 0.00 0.47 0.00
4.03 5.73 2.72 2.72 0.47 0.00 0.00 0.00 0.00 0.00
4.60 0.84 6.53 6.53 0.00 0.00 0.00 0.00 0.00 0.00
#
Сеть
Network: Card-1: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller driver: r8169
IF: ens2 state: up speed: 100 Mbps duplex: full mac: 00:1c:c0:85:7c:43
Card-2: Intel 82546EB Gigabit Ethernet Controller (Copper) driver: e1000
IF: enp4s5f0 state: up speed: 1000 Mbps duplex: full mac: 00:11:0e:25:11:4e
Card-3: Intel 82546EB Gigabit Ethernet Controller (Copper) driver: e1000
IF: enp4s5f1 state: up speed: 100 Mbps duplex: full mac: 00:11:0e:25:11:4f
Card-4: Intel 82546EB Gigabit Ethernet Controller (Copper) driver: e1000
IF: enp4s6f0 state: up speed: 100 Mbps duplex: full mac: 00:11:0e:23:02:1a
Card-5: Intel 82546EB Gigabit Ethernet Controller (Copper) driver: e1000
IF: enp4s6f1 state: up speed: 1000 Mbps duplex: full mac: 00:11:0e:23:02:1b
0
задан Purushothaman
15 June 2019 в 07:52
поделиться