Comprehensive Description of three two-line policy route access methods

It is very useful to know about two-line policy routing. Here we mainly explain three implementation methods of Two-line policy routing, I have referred to the post on Dual-line policy routing of China Telecom + China Netcom in the next Forum, and summarized several ways to achieve dual-Line Policy Routing Based on the actual environment as follows, hoping to help anyone who needs it, the dual-line routing is much more complicated than the single-line routing, but it is not difficult to understand the principle of the dual-line routing.

Implementation of a two-line routing policy

1. Static Routing is the easiest way)

1) set the default route, such as China Telecom

Iproutereplacedefaultvia Telecom gateway deveth1

2) configure a two-line route for another line

Iprouteadd Netcom route table 1via Netcom gateway deveth2metric1
Iprouteadd Netcom route table 2via Netcom gateway deveth2metric1
....

3) Add the original return route

After the routing rules of the Two-line rule are set, you must add the corresponding "original route return route" data for each line to the data from which the line comes, and finally exit from this line ), otherwise, the problem will occur: the telecom user cannot access the server through the IP address of China Netcom, And the Netcom user cannot access the server through the Telecom IP address.

Iprouteflushtable100
Iprouteadddefaultvia Telecom gateway deveth1src Telecom IPtable100prio50
Ipruleaddfrom Telecom IPtable100
Iprouteflushtable200
Iprouteadddefaultvia Netcom gateway deveth2src Netcom IPtable200prio50
Ipruleaddfrom Netcom IPtable200
Iprouteadd192.168.0.0/24deveth0scopelinksrc192. 168.0.1table100
Iprouteadd192.168.0.0/24deveth0scopelinksrc192. 168.0.1table200

2. Two-Line Policy Routing

For convenience, we have added two route tables, China Telecom => 100, China Netcom => 200. In this way, when adding rules, we can directly replace numbers with custom names.

Echo "100ctc">/etc/iproute2/rt_tables
Echo "200cnc">/etc/iproute2/rt_tables

1) set the default route for China Telecom)
Iproutereplacedefaultvia Telecom gateway deveth1

2) Implement two-line Policy Routing Based on the target address for China Netcom
Ipruleaddto Netcom route table 1tablecncprio100
Ipruleaddto Netcom route table 2tablecncprio100
....

3) Add the original return route
Prouteflushtablectc
Iprouteadddefaultvia Telecom gateway deveth1src Telecom IPtablectc
Iprouteadd192.168.0.0/24deveth0scopelinksrc192. 168.0.1tablectc
Ipruleaddfrom Telecom IPtablectc
Iprouteflushtablecnc
Iprouteadddefaultvia Netcom gateway deveth2src Netcom IPtablecnc
Iprouteadd192.168.0.0/24deveth0scopelinksrc192. 168.0.1tablectc
Ipruleaddfrom Netcom IPtablecnc

3. Mark iptables + iproute2fwmark

1) mark the connection with CONNMARK

Incoming Internet Data
Iptables-tmangle-APREROUTING-ieth1-mconntrack -- ctstateNEW-jCONNMARK -- set-mark0x100
Iptables-tmangle-APREROUTING-ieth2-mconntrack -- ctstateNEW-jCONNMARK -- set-mark0x200

Forwarded data
Iptables-tmangle-APOSTROUTING-oeth1-mconntrack -- ctstateNEW-jCONNMARK -- set-mark0x100
Iptables-tmangle-APOSTROUTING-oeth2-mconntrack -- ctstateNEW-jCONNMARK -- set-mark0x200

Incoming LAN data
Iptables-tmangle-APREROUTING-ieth0-mconntrack -- ctstateESTABLISHED, RELATED-jCONNMARK -- restore-mark

Local outgoing data
Iptables-tmangle-AOUTPUT-mconntrack -- ctstateESTABLISHED, RELATED-jCONNMARK -- restore-mark

2) Implement fwmark-based dual-line routing in IPROUTE2

Ipruleaddfwmark0x100tablectcprio40
Ipruleaddfwmark0x200tablecncprio40

3) Add the original return route

Iprouteaddtablectcto $ CTC_NETdeveth1scopelink
Iprouteaddtablectcto $ CNC_NETdeveth2scopelink
Iprouteaddtablectcto192.168.0.0/24deveth0scopelink
Iprouteadddefaultvia Telecom gateway deveth1tablectc
Iprouteaddtablecncto $ CTC_NETdeveth1scopelink
Iprouteaddtablecncto $ CNC_NETdeveth2scopelink
Iprouteaddtablecncto192.168.0.0/24deveth0scopelink
Iprouteadddefaultvia Netcom gateway deveth2tablecnc

Iptables/NAT rules

Sbin/iptables-tnat-APOSTROUTING-oeth1-s lan cidr Block-jSNAT -- to-source telecom internet IP
Sbin/iptables-tnat-APOSTROUTING-oeth2-s lan cidr Block-jSNAT -- to-source Netcom Internet IP

If the Internet IP address is dynamic, you can use MASQUERADE

Sbin/iptables-tnat-APOSTROUTING-oeth1-s lan cidr Block-jMASQUERADE
Sbin/iptables-tnat-APOSTROUTING-oeth2-s lan cidr Block-jMASQUERADE