<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"><html><head><meta name="qrichtext" content="1" /><style type="text/css">p, li { white-space: pre-wrap; }</style></head><body style=" font-family:'DejaVu Sans'; font-size:9pt; font-weight:400; font-style:normal;">Hola Amigos:<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Finalmente logré mi cometido y pude instalarle a un linksys wrt54gl dos conexiones de internet simultáneamente y todo funciona de maravilla.<br>
El script de iptables se ocupa del balanceo de carga y hace que una petición salga por un proveedor y la siguiente petición salga por el otro, es decir, una vez a cada uno.<br>
Les cuento todo esto porque necesitaría reemplazar esta forma de balanceo por otra arbitraria. Lo que quiero es que el puerto 80, 443, 25 y 110 salgan por un proveedor y el resto por el otro (sin balanceo... siempre así). El problema es que no entiendo bien de iptables... ni siquiera se que buscar en google... iptables es muy extenso.<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Copio el script para quien quiera ayudarme:<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>#!/bin/sh <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip rule flush <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip rule add lookup main prio 32766 <br>
ip rule add lookup default prio 32767 <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip rule add from $(nvram get wan_ipaddr) table 100 prio 100 <br>
ip rule add fwmark 0x100 table 100 prio 101 <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip rule add from $(nvram get wan2_ipaddr) table 200 prio 200 <br>
ip rule add fwmark 0x200 table 200 prio 201 <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip route flush table 100 <br>
ip route flush table 200 <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>for TABLE in 100 200 <br>
do <br>
ip route | grep link | while read ROUTE <br>
do <br>
ip route add table $TABLE to $ROUTE <br>
done <br>
done <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>ip route add table 100 default via $(nvram get wan_gateway) <br>
ip route add table 200 default via $(nvram get wan2_gateway) <br>
ip route delete default <br>
ip route add default scope global equalize nexthop via $(nvram get wan_gateway) dev $(nvram get wan_ifname) nexthop via $(nvram get wan2_gateway) dev $(nvram get wan2_ifname) <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>insmod ipt_CONNMARK <br>
IPTABLES="/usr/sbin/iptables" <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>#DD-WRT firewall rules #BEGIN <br>
iptables -A PREROUTING -t nat -p icmp -d $(nvram get wan2_ipaddr) -j DNAT --to $(nvram get lan_ipaddr) <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>iptables -A PREROUTING -t nat --dest $(nvram get wan2_ipaddr) -j TRIGGER --trigger-type dnat <br>
iptables -A FORWARD -i $(nvram get wan2_ifname) -o $(nvram get lan_ifname) -j TRIGGER --trigger-type in <br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>#DD-WRT END <br>
<br>
$IPTABLES -F POSTROUTING -t nat <br>
$IPTABLES -t mangle -N ETH1 <br>
$IPTABLES -t mangle -F ETH1 <br>
$IPTABLES -t mangle -A ETH1 -j MARK --set-mark 0x100 <br>
$IPTABLES -t mangle -N ETH2 <br>
$IPTABLES -t mangle -F ETH2 <br>
$IPTABLES -t mangle -A ETH2 -j MARK --set-mark 0x200 <br>
$IPTABLES -t nat -N SPOOF_ETH1 <br>
$IPTABLES -t nat -F SPOOF_ETH1 <br>
$IPTABLES -t nat -A SPOOF_ETH1 -j LOG --log-prefix " SPOOF_ETH1 " <br>
$IPTABLES -t nat -A SPOOF_ETH1 -j SNAT --to $(nvram get wan_ipaddr) <br>
$IPTABLES -t nat -N SPOOF_ETH2 <br>
$IPTABLES -t nat -F SPOOF_ETH2 <br>
$IPTABLES -t nat -A SPOOF_ETH2 -j LOG --log-prefix " SPOOF_ETH2 " <br>
$IPTABLES -t nat -A SPOOF_ETH2 -j SNAT --to $(nvram get wan2_ipaddr) <br>
$IPTABLES -A INPUT -p icmp -s 192.168.1.0/24 -d 192.168.1.1 -j ACCEPT <br>
#Save the gateway in the connection mark for new incoming connections <br>
$IPTABLES -t mangle -A PREROUTING -i $(nvram get wan_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x100 <br>
$IPTABLES -t mangle -A PREROUTING -i $(nvram get wan2_ifname) -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x200 <br>
$IPTABLES -A POSTROUTING -t mangle -o $(nvram get wan_ifname) -j MARK --set-mark 0x100 <br>
$IPTABLES -A POSTROUTING -t mangle -o $(nvram get wan2_ifname) -j MARK --set-mark 0x200 <br>
$IPTABLES -t nat -A POSTROUTING -o $(nvram get wan_ifname) -j SPOOF_ETH1 <br>
$IPTABLES -t nat -A POSTROUTING -o $(nvram get wan2_ifname) -j SPOOF_ETH2 <br>
$IPTABLES -t mangle -A POSTROUTING -j CONNMARK --save-mark <br>
$IPTABLES -t mangle -A PREROUTING -i br0 -m state --state RELATED,ESTABLISHED -j CONNMARK --restore-mark <br>
# Use the correct gateway for reply packets from local connections <br>
$IPTABLES -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark <br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>#Acá seteo arbitrariamente que los puertos en cuestión salgan siempre por una conexión<br>
iptables -t nat -I POSTROUTING -p tcp -m multiport --destination-ports 80 -j SPOOF_ETH2 <br>
iptables -t mangle -I PREROUTING -p tcp -m multiport --destination-ports 80 -j ETH2 <br>
iptables -t mangle -I OUTPUT -p tcp -m multiport --destination-ports 80 -j ETH2<br>
iptables -t nat -I POSTROUTING -p tcp -m multiport --destination-ports 443 -j SPOOF_ETH2 <br>
iptables -t mangle -I PREROUTING -p tcp -m multiport --destination-ports 443 -j ETH2 <br>
iptables -t mangle -I OUTPUT -p tcp -m multiport --destination-ports 443 -j ETH2<br>
iptables -t nat -I POSTROUTING -p tcp -m multiport --destination-ports 25 -j SPOOF_ETH2 <br>
iptables -t mangle -I PREROUTING -p tcp -m multiport --destination-ports 25 -j ETH2 <br>
iptables -t mangle -I OUTPUT -p tcp -m multiport --destination-ports 25 -j ETH2<br>
iptables -t nat -I POSTROUTING -p tcp -m multiport --destination-ports 110 -j SPOOF_ETH2 <br>
iptables -t mangle -I PREROUTING -p tcp -m multiport --destination-ports 110 -j ETH2 <br>
iptables -t mangle -I OUTPUT -p tcp -m multiport --destination-ports 110 -j ETH2<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>RP_PATH=/proc/sys/net/ipv4/conf <br>
for IFACE in `ls $RP_PATH`; do <br>
echo 0 > $RP_PATH/$IFACE/rp_filter <br>
done<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p><p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p><p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Por último, estos aparatitos no tienen mucha capacidad de memoria, de hecho tuve que pulir mucho la configuración de mi sistema ya que no puede haber más de 36 kbytes en archivos de configuración, actualmente tengo menos de 2 kbytes libres.<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p><p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Saludos y Gracias<br>
<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Adrián </p></body></html>