I want to:
1. Use WAN-DSL as primary connection for my LAN (10.0.0.0/24).
2. Failover to WAN-SC upon failure of WAN-DSL.
3. Assign traffic from a specific host (10.0.0.252) to always use WAN-SC.
4. Dst-nat (port-forward) tcp 3389 traffic to an internal host (10.0.0.12) over WAN-DSL.
5. Dst-nat (port-forward) tcp 3389 traffic to same internal host also over WAN-SC.
After going over tutorials and how-tos on the Internet, I have a basic configuration setup. However it does not work yet, and need some input on whether I am approaching this from the correct angle.
Code: Select all
Flags: X - disabled, I - invalid, D - dynamic 0 chain=input action=mark-connection new-connection-mark=WAN-DSL-connections passthrough=no in-interface=WAN-DSL 1 chain=input action=mark-connection new-connection-mark=WAN-SC-connections passthrough=no in-interface=WAN-SC 2 X chain=prerouting action=mark-connection new-connection-mark=WAN-SC-connections passthrough=no src-address=10.0.0.252 dst-address-type=!local in-interface=LAN 3 chain=prerouting action=mark-connection new-connection-mark=WAN-DSL-connections passthrough=no dst-address-type=!local in-interface=LAN 4 chain=output action=mark-routing new-routing-mark=to-WAN-DSL passthrough=no connection-mark=WAN-DSL-connections 5 chain=output action=mark-routing new-routing-mark=to-WAN-SC passthrough=no connection-mark=WAN-SC-connections
Here is my theory behind this:
Code: Select all
Flags: X - disabled, I - invalid, D - dynamic 0 chain=dstnat action=dst-nat to-addresses=10.0.0.12 protocol=tcp in-interface=WAN-DSL dst-port=3389 1 chain=dstnat action=dst-nat to-addresses=10.0.0.12 protocol=tcp in-interface=WAN-SC dst-port=3389 2 chain=srcnat action=masquerade out-interface=WAN-SC connection-mark=WAN-SC-connections 3 chain=srcnat action=masquerade out-interface=WAN-DSL connection-mark=WAN-DSL-connections
1. Use mangle rules to mark any connections coming into each WAN connection (input chain).
2. Mark any connections from 10.0.0.252 with the WAN-SC-connections mark (prerouting chain). This rule is currently disabled. It doesn’t work when I enable it, I think due to the issue I am having with the routing marks.
3. Mark everything else from the LAN with the WAN-DSL-connections mark (prerouting chain).
4. On our output chain set a unique routing mark that corresponds with each of the two connection marks.
5. Set the gateway for each default route based on routing-mark and let each interface masquerade rule NAT the traffic.
I have two default routes with the ping probe enabled (one going to each provider), with the WAN-SC set to a higher distance (for the failover function). However when I try to set each default route to use its respective routing-mark (to-WAN-X), traffic just seems to be dropped and I get no traffic flow. Everything seems to be getting marked properly, but the routing table does not seem to be honoring the routing-marks.
Does anyone have any ideas why this isn’t working properly? Am I approaching this problem with the correct method? Thanks