Two default gateways on Debian Jessie

Question

Please notice that it is a duplicate, but the solution given before doesn't work for me! Everything explained below.

I got two networks with Internet... would like them both to work... if request is to network#1, network#2 should answer that request through it's gateway... same with network#2 - it should answer to requests through it's gateway.

ifconfig

eth0      Link encap:Ethernet  HWaddr b8:27:eb:82:ca:0c
          inet addr:192.168.1.200  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::57ac:b6e:33c1:8bbb/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:797 errors:0 dropped:0 overruns:0 frame:0
          TX packets:797 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:219915 (214.7 KiB)  TX bytes:117516 (114.7 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:d7:9f:59
          inet addr:192.168.2.200  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::6463:5ba:3b28:6d39/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1532 errors:0 dropped:1215 overruns:0 frame:0
          TX packets:201 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:364160 (355.6 KiB)  TX bytes:29417 (28.7 KiB)

ip route show table main

default via 192.168.1.1 dev eth0  metric 202
default via 192.168.2.1 dev wlan0  metric 303
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.200  metric 202
192.168.2.0/24 dev wlan0  proto kernel  scope link  src 192.168.2.200  metric 303

I got partially working solution:

ip route add default via 192.168.1.1 dev eth0 table 100
ip route add default via 192.168.2.1 dev wlan0 table 200

ip rule add from all lookup main suppress_prefixlength 0
ip rule add from 192.168.1.0/24 lookup 100
ip rule add from 192.168.2.0/24 lookup 200

This makes for example Apache (after port redirection on routers) answer to requests from both networks, but... only from outside. Local connection via 192.168.1.200 or 192.168.2.200 stops working... I mean... I can't connect to Apache from local network anymore.

Could anybody help me with that?

I tried also THIS solution, but it did not work... I can't connect through LINKs2 public IP to Apache server... maybe I am doing something wrong? Port forwarding seems to work, as I can see my request via iftop. Never getting an answer, tho'.

rt_tables

200 LINK1
201 LINK2

route.sh

ip route add 192.168.1.0/24 dev eth0 src 192.168.1.200 table LINK1
ip route add 192.168.2.0/24 dev wlan0 src 192.168.2.200 table LINK2
ip route add default via 192.168.1.1 table LINK1
ip route add default via 192.168.2.1 table LINK2
ip rule add from 192.168.1.1 table LINK1
ip rule add from 192.168.2.1 table LINK2

After that:

sigma@sigma:~/temp $ ip route show table LINK1
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0  scope link  src 192.168.1.200

sigma@sigma:~/temp $ ip route show table LINK2
default via 192.168.2.1 dev wlan0
192.168.2.0/24 dev wlan0  scope link  src 192.168.2.200

sigma@sigma:~/temp $ ip route show table main
default via 192.168.1.1 dev eth0  metric 202
default via 192.168.2.1 dev wlan0  metric 303
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.200  metric 202
192.168.2.0/24 dev wlan0  proto kernel  scope link  src 192.168.2.200  metric 303

sigma@sigma:~/temp $ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
default         fiber.home     0.0.0.0         UG    303    0        0 wlan0
192.168.1.0     *               255.255.255.0   U     202    0        0 eth0
192.168.2.0     *               255.255.255.0   U     303    0        0 wlan0

sigma@sigma:~/temp $ ip route show table all
default via 192.168.1.1 dev eth0  table LINK1
192.168.1.0/24 dev eth0  table LINK1  scope link  src 192.168.1.200
default via 192.168.2.1 dev wlan0  table LINK2
192.168.2.0/24 dev wlan0  table LINK2  scope link  src 192.168.2.200
default via 192.168.1.1 dev eth0  metric 202
default via 192.168.2.1 dev wlan0  metric 303
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.200  metric 202
192.168.2.0/24 dev wlan0  proto kernel  scope link  src 192.168.2.200  metric 303
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1
broadcast 192.168.1.0 dev eth0  table local  proto kernel  scope link  src 192.168.1.200
local 192.168.1.200 dev eth0  table local  proto kernel  scope host  src 192.168.1.200
broadcast 192.168.1.255 dev eth0  table local  proto kernel  scope link  src 192.168.1.200
broadcast 192.168.2.0 dev wlan0  table local  proto kernel  scope link  src 192.168.2.200
local 192.168.2.200 dev wlan0  table local  proto kernel  scope host  src 192.168.2.200
broadcast 192.168.2.255 dev wlan0  table local  proto kernel  scope link  src 192.168.2.200
local ::1 dev lo  proto kernel  metric 256
fe80::/64 dev eth0  proto kernel  metric 256
fe80::/64 dev wlan0  proto kernel  metric 256
unreachable default dev lo  table unspec  proto kernel  metric 4294967295  error -101
local ::1 dev lo  table local  proto none  metric 0
local fe80::57ac:b6e:33c1:8bbb dev lo  table local  proto none  metric 0
local fe80::e94f:8405:bbc7:20f5 dev lo  table local  proto none  metric 0
ff00::/8 dev eth0  table local  metric 256
ff00::/8 dev wlan0  table local  metric 256
unreachable default dev lo  table unspec  proto kernel  metric 4294967295  error -101

score 3 · Accepted Answer · answered Dec 11 '16 at 14:13

Assuming that I understand the problem correctly: You have two "internet" connections via two local interfaces and you'd like for responses to go through the same path they were received from.

I can think of two clean solutions:

1) Do policy routing based on the source IP. If the source IP is the one from eth0 then it should use one gateway, otherwise the other. That's similar to what you've done. From the top of my head:

ip route add default via GW1 table gw1
ip route add default via GW2 table gw2
ip rule from IP1 table gw1
ip rule from IP2 table gw2

2) Tag incoming packets with iptables, connection tracking and the CONNMARK target. Restore that mark on every outgoing packet and do policy routing based on the mark. Again, from the top of my head:

iptables -A INPUT -i wlan0 -t mangle -j MARK --set-mark 1
iptables -A INPUT -i eth0 -t mangle -j MARK --set-mark 2
iptables -A INPUT -j CONNMARK --save-mark
iptables -A OUTPUT -j CONNMARK --restore-mark
ip route add default via GW1 table gw1
ip route add default via GW2 table gw2
ip rule fwmark 1 table gw1
ip rule fwmark 2 table gw2

The above may need some fiddling but that's the general idea.

Thank you, that seems to work. I've managed to make it work combining 2 ways I mentioned in question too... — Flash Thunder, Dec 11 '16 at 15:55

Two default gateways on Debian Jessie

1 Answers1