How to use IPtables for load balancing in gateway

Question

I have 3 NICs. NIC1 and NIC2 are used for internet connections an LAN is used for intranet connection.

I want to balance the load to ISPs using ip tables. As I am a noob, my crude attempt is given in the following code, obviously without success. This code was assembled by looking at many websites on the topic.

we would like to optimally use the incoming internet in LAN using Round-Robin method

or

Is it possible to split the two isps, i.e, for systems 1 to 5 (ISP1) and 5 to 10 (ISP2) using routing tables?

Hope someone out there will help me, which is very much appreciated.

set -x
IPT="/sbin/iptables"
NIC1="enp4s5f0"
NIC2="enp4s5f1"
LAN="ens2"
ISP1="192.168.9.33"
ISP2="192.168.10.33"

#***************
# reset iptables
#_______________
## reset the default policies in the filter table.
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

## reset the default policies in the nat table.
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

## reset the default policies in the mangle table.
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

## flush all the rules in the filter and nat tables.
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

## erase all chains that's not default in filter and nat table.
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X


#*********************
# enable IP forwarding
#_____________________
echo 1 > /proc/sys/net/ipv4/ip_forward


#****************
# rules 
#________________
$IPT -A INPUT -m state --state INVALID -j DROP 
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -A INPUT -p icmp -j ACCEPT 
$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 

$IPT -A FORWARD -m state --state INVALID -j DROP 
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -A FORWARD -p icmp -j ACCEPT 

$IPT -t nat -A PREROUTING -i NIC1 -p tcp --dport 80\ 
            -m state --state NEW -m statistic --mode\ 
            random --probability .33 -j  DNAT --to-destination 10.1.1.1:1

$IPT -t nat -A PREROUTING -i NIC2 -p tcp --dport 80\ 
            -m state --state NEW -m statistic --mode\ 
            random --probability .33 -j  DNAT --to-destination 10.1.1.1:2

$IPT -A FORWARD -i $NIC1 -o $LAN -j ACCEPT
$IPT -A FORWARD -i $NIC2 -o $LAN -j ACCEPT


# ifconfig -a


#********************************
# allow certain hosts full access
#________________________________

allowHost() {
    $IPT -A FORWARD -i $LAN -s $1 -j ACCEPT 
}

allowHost 192.168.2.10
allowHost 192.168.2.11
allowHost 192.168.2.12
allowHost 192.168.2.13
allowHost 192.168.2.14
allowHost 192.168.2.15

####Extra
$IPT -A FORWARD -d 8.8.8.8 -p tcp -m multiport --dports 53 -j ACCEPT

#********************
# block anything else
#____________________
$IPT -A FORWARD -j LOG -m limit --limit 10/minute --limit-burst 1 --log-prefix "Blocked:"
$IPT -A FORWARD -j DROP

/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_nat

Let me clarify a point here, are we talking of balancing the load to each of connected computers, i.e. sharing the in-bound data packets from the two ISPs? — George Udosen, Jun 01 '19 at 10:32
@GeorgeUdosen, No we would like to optimally use the incoming internet in LAN using Round-Robin method. — Purushothaman, Jun 01 '19 at 10:36
Please can you add an image of your network connection or a sketch. Look at this example: https://www.webair.com/community/simple-stateful-load-balancer-with-iptables-and-nat/ — George Udosen, Jun 01 '19 at 10:51
@GeorgeUdosen, I have seen this website, but I am unable to understand the code. Is it possible to split the two isps, i.e, for systems 1 to 5 (ISP1) and 5 to 10 (ISP2) using routing tables. — Purushothaman, Jun 01 '19 at 11:06
Yes, that is very possible and now that you have stated your configuration clearly we can understand better. — George Udosen, Jun 01 '19 at 11:16
it can be done through marking packet using mangle table, and set routing policy based on marked packet. — Khimananda Oli, Jun 05 '19 at 05:41

George Udosen · Answer 1 · 2019-06-06T17:05:40.070

WARNING: READ THROUGH FIRST BEFORE EXECUTING

DISCLAIMER: Untested

Prerequisites:

Install the iptables persistent package

sudo apt-get install iptables-persistent

Backup your existing iptables rules:

sudo iptables-save > ~/iptables-export

Restore:

sudo iptables-restore < ~/iptables-export

Flush the former iptables rules:

sudo iptables -F && sudo iptables -t nat -F && sudo iptables -t mangle -F && sudo iptables -X && sudo iptables -t nat -X && sudo iptables -t mangle -X

Steps:

Add a new "route table" using this command from your terminal to handle the packets from one of the NIC's:
```
sudo bash -c 'echo "1 rt2" >> /etc/iproute2/rt_tables'
```

Enable ipv4 forwarding

sudo sysctl net.ipv4.ip_forward=1
sudo sysctl -p

Add filter that allows "masquwerading"

sudo iptables -t nat -A PREROUTING -i enp4s5f1 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.90
sudo iptables -t nat -A PREROUTING -i enp4s5f0 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.90


sudo iptables -t nat -A POSTROUTING -o ens2 -j MASQUERADE
sudo netfilter-persistent save
sudo netfilter-persistent reload

Edit the /etc/network/interfaces file and add the configuration for the second NIC, but ofcourse make a copy of the old one,

sudo cp /etc/network/interfaces /etc/network/interfaces.bkup:

iface enp4s5f1 inet static
    address <YOUR_NIC_ADD>/24
    netmask 255.255.255.0
    post-up ip route add 192.168.10.0/24 dev enp4s5f1 src 192.168.10.33 table rt2
    post-up ip route add default via 192.168.10.1 dev enp4s5f1 table rt2
    post-up ip rule add from 192.168.10.33/32 table rt2
    post-up ip rule add to 192.168.10.33/32 table rt2

Restart network manager:

sudo  systemctl restart NetworkManager.service

Add iptable rules:

sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
 --every 5 --packet 0 -j DNAT --to-destination 192.168.2.26

sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
 --every 4 --packet 0 -j DNAT --to-destination 192.168.2.27

sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
 --every 3 --packet 0 -j DNAT --to-destination 192.168.2.28

sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth
 --every 2 --packet 0 -j DNAT --to-destination 192.168.2.29

sudo iptables -t nat -A PREROUTING -i enp4s5f0 --to-destination 192.168.2.30

=====================================

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 5 --packet 0 -j DNAT --to-destination 192.168.2.21

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 4 --packet 0 -j DNAT --to-destination 192.168.2.22

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 3 --packet 0 -j DNAT --to-destination 192.168.2.23

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -m state --state NEW -m statistic --mode nth
     --every 2 --packet 0 -j DNAT --to-destination 192.168.2.24

    sudo iptables -t nat -A PREROUTING -i enp4s5f1 -j DNAT --to-destination 192.168.2.25

    sudo netfilter-persistent save
    sudo netfilter-persistent reload

Source:

https://scalingo.com/articles/2018/04/20/iptables.html

https://www.webair.com/community/simple-stateful-load-balancer-with-iptables-and-nat/

http://ipset.netfilter.org/iptables-extensions.man.html

https://www.linuxquestions.org/linux/answers/Networking/Spanning_Multiple_DSLs

How to save rules of the iptables?

https://linuxconfig.org/how-to-restart-network-on-ubuntu-16-04-xenial-xerus-linux

sudo iptables -t nat -A PREROUTING -i enp4s5f0 --to-destination 192.168.2.30
needed to be changed to

sudo iptables -t nat -A PREROUTING -i enp4s5f0 -m state --state NEW -m statistic --mode nth --every 1 --packet 0 -j DNAT --to-destination 192.168.2.30 — Purushothaman, Jun 06 '19 at 06:46
I am able to ping 8.8.8.8 from 192.168.2.21 but ping www.google.com does not work. — Purushothaman, Jun 06 '19 at 06:49

How to use IPtables for load balancing in gateway

1 Answers1

WARNING: READ THROUGH FIRST BEFORE EXECUTING

DISCLAIMER: Untested