iptables + multiple gateways not firewalling

Ian Coetzee ubuntu at iancoetzee.za.net
Sat Dec 12 09:30:47 UTC 2009


Hi all

I have a small problem here (I may have just overlooking something here)

I have a ubuntu 9.10 server here. On it I do web proxing through one
provider, and mail through another.

I had it set up with one NIC and it worked (in my testing
environment). However I am unable get get it to work, after I inserted
another NIC to route the mail out through.

I *think* I narrowed it down to the fact that ip tables is not
firewalling eth1(which is the new NIC I inserted).

I can ping both my NIC's subnets that is connected to them.

Any help will be greatly appreciated.

My config is as such (public IPs is changed due to lurking eyes :) )

eth0 (internal) -> 192.168.1.3/24 gateway 192.168.1.15
eth1 (external) -> 111.111.111.52/29 gateway 111.111.111.49

iptables rules:
 cat /etc/iptables.up.rules
# Generated by iptables-save v1.4.4 on Sat Dec 12 11:02:07 2009
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
#mark outgoing tcp/25 packets for routing
-A OUTPUT -p tcp -m tcp --sport 25 -j MARK --set-mark 0x10
COMMIT
# Completed on Sat Dec 12 11:02:07 2009
# Generated by iptables-save v1.4.4 on Sat Dec 12 11:02:07 2009
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
#Set source address on outgoing packet eth1
-A POSTROUTING -o eth1 -j SNAT --to-source 111.111.111.52
COMMIT
# Completed on Sat Dec 12 11:02:07 2009
# Generated by iptables-save v1.4.4 on Sat Dec 12 11:02:07 2009
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#log incomming and outging traffic on eth1
-A OUTPUT -o eth1 -j LOG
-A INPUT -i eth1 -j LOG
COMMIT
# Completed on Sat Dec 12 11:02:07 2009

ip ru sh
0:      from all lookup local
32765:  from all fwmark 0x10 lookup mail
32766:  from all lookup main
32767:  from all lookup default

ip ro sh table mail
default via 111.111.111.49 dev eth1




More information about the ubuntu-users mailing list