继上一贴 https://www.v2ex.com/t/499006#reply19 之后,目前遇到新的问题
我这里电信公网,且支持多拨,经测试可以稳定 3 拨,如下所示(实际公网 IP,已替换)
ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1492 inet 1.1.1.1 netmask 255.255.255.255 destination 1.1.1.1 ppp txqueuelen 3 (Point-to-Point Protocol) RX packets 187360 bytes 131600760 (125.5 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 78252 bytes 55020422 (52.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ppp1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1492 inet 2.2.2.2 netmask 255.255.255.255 destination 2.2.2.1 ppp txqueuelen 3 (Point-to-Point Protocol) RX packets 42 bytes 2369 (2.3 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 5 bytes 58 (58.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ppp2: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1492 inet 3.3.3.3 netmask 255.255.255.255 destination 3.3.3.1 ppp txqueuelen 3 (Point-to-Point Protocol) RX packets 197 bytes 10427 (10.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 5 bytes 58 (58.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
但是,搜索比较多的帖子之后,发现并不能如意得实现负载均衡,我是这么配置的
1、IP 规则
ip rule add fwmark 0x10 table ppp0 pref 0x10
ip rule add fwmark 0x11 table ppp1 pref 0x11
ip rule add fwmark 0x12 table ppp2 pref 0x12
ip rule add from 1.1.1.1 table ppp0 pref 0x20
ip rule add from 2.2.2.2 table ppp0 pref 0x21
ip rule add from 3.3.3.3 table ppp0 pref 0x22
2、iptables 我的内网网口为 eno2, 内网网段( 10.0.1.0/24 )
iptables -I INPUT 1 -i eno2 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -p UDP --dport bootps ! -i eno2 -j REJECT
iptables -A INPUT -p UDP --dport domain ! -i eno2 -j REJECT
iptables -I FORWARD -i eno2 -d 10.0.1.0/24 -j DROP
iptables -A FORWARD -i eno2 -s 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -i eno2 -s 10.0.1.0/24 -j ACCEPT
iptables -A FORWARD -i ppp0 -d 10.0.1.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -i ppp1 -d 10.0.1.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -i ppp1 -d 10.0.1.0/255.255.255.0 -j ACCEPT
###############
iptables -t mangle -F
iptables -t mangle -X PPP0
iptables -t mangle -X PPP1
iptables -t mangle -X PPP2
iptables -t mangle -N PPP0
iptables -t mangle -N PPP1
iptables -t mangle -N PPP2
iptables -t mangle -A PPP0 -j MARK --set-mark 0x10
iptables -t mangle -A PPP1 -j MARK --set-mark 0x11
iptables -t mangle -A PPP2 -j MARK --set-mark 0x12
iptables -t mangle -A PPP0 -j CONNMARK --save-mark
iptables -t mangle -A PPP1 -j CONNMARK --save-mark
iptables -t mangle -A PPP2 -j CONNMARK --save-mark
iptables -t mangle -A OUTPUT -o ppp+ -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A OUTPUT -o ppp+ -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A OUTPUT -o ppp+ -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A OUTPUT -o ppp+ -p tcp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -o ppp+ -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A OUTPUT -o ppp+ -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A OUTPUT -o ppp+ -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A OUTPUT -o ppp+ -p udp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -o ppp+ -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A OUTPUT -o ppp+ -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A OUTPUT -o ppp+ -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A OUTPUT -o ppp+ -p icmp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p tcp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p tcp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p udp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p udp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 0 -j PPP0
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 1 -j PPP1
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p icmp -m state --state NEW -m statistic --mode nth --every 3 --packet 2 -j PPP2
iptables -t mangle -A PREROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -p icmp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE
实际使用发现并不能做到负载均衡。如果不设置默认路由,服务器(这里是软路由自身)、客户机(内网),都不能使用。一旦添加某个 ppp 作为默认路由后,就只能用那个 ppp 上网。
我不知道我哪设置不正确……
1
xivisi OP 修正:
1、IP 规则 ip rule add fwmark 0x10 table ppp0 pref 0x10 ip rule add fwmark 0x11 table ppp1 pref 0x11 ip rule add fwmark 0x12 table ppp2 pref 0x12 ip rule add from 1.1.1.1 table ppp0 pref 0x20 ip rule add from 2.2.2.2 table ppp1 pref 0x21 ip rule add from 3.3.3.3 table ppp2 pref 0x22 |
2
xivisi OP 增加以下命令,暂时可行:
ip route add default via 1.1.1.1 table ppp0#这里的 1.1.1.1 是网关地址 ip route add default via 2.2.2.1 table ppp1 ip route add default via 3.3.3.1 table ppp2 |
3
cwbsw 2018-10-31 13:46:59 +08:00
贴上我模仿 mwan3 的负载均衡规则,直接用 mwan3 的话与 ipsec server 不兼容,你可以参考下。
wan 配置默认路由,wan1 和 wan2 不配置默认路由,wg 是科学上网,mwm_connected 是本地直连网段的 ipset。 0: from all lookup local 8: from all iif wg lookup main 11: from all iif pppoe-wan1 lookup main 12: from all iif pppoe-wan2 lookup main 88: from all fwmark 0x88 lookup 88 100: from all fwmark 0x100 lookup main 101: from all fwmark 0x101 lookup 101 102: from all fwmark 0x102 lookup 102 220: from all lookup 220 32766: from all lookup main 32767: from all lookup default iptables -t mangle -N mwm iptables -t mangle -N mwm_in iptables -t mangle -N mwm_rules iptables -t mangle -N mwm_policy_wan iptables -t mangle -N mwm_policy_wan1 iptables -t mangle -N mwm_policy_wan2 iptables -t mangle -N mwm_policy_wg iptables -t mangle -N mwm_policy_balance iptables -t mangle -A PREROUTING -j mwm iptables -t mangle -A mwm -j CONNMARK --restore-mark iptables -t mangle -A mwm -m mark --mark 0x0 -j mwm_in iptables -t mangle -A mwm -m mark --mark 0x0 -j mwm_rules iptables -t mangle -A mwm -j CONNMARK --save-mark #iptables -t mangle -A mwm_in -m mark --mark 0x0 -i pppoe-wan -j MARK --set-mark 0x100 iptables -t mangle -A mwm_in -m mark --mark 0x0 -i pppoe-wan1 -j MARK --set-mark 0x101 iptables -t mangle -A mwm_in -m mark --mark 0x0 -i pppoe-wan2 -j MARK --set-mark 0x102 iptables -t mangle -A mwm_policy_default -m mark --mark 0x0 -j MARK --set-mark 0x100 iptables -t mangle -A mwm_policy_wan1 -m mark --mark 0x0 -j MARK --set-mark 0x101 iptables -t mangle -A mwm_policy_wan2 -m mark --mark 0x0 -j MARK --set-mark 0x102 iptables -t mangle -A mwm_policy_wg -m mark --mark 0x0 -j MARK --set-mark 0x88 iptables -t mangle -A mwm_policy_balance -m mark --mark 0x0 -m statistic --mode random --probability 0.5 -j MARK --set-mark 0x101 iptables -t mangle -A mwm_policy_balance -m mark --mark 0x0 -j MARK --set-mark 0x102 iptables -t mangle -A mwm_rules -m mark --mark 0x0 -m set --match-set mwm_connected dst -j mwm_policy_default iptables -t mangle -A mwm_rules -m mark --mark 0x0 -m set --match-set tunnel dst -j mwm_policy_wg iptables -t mangle -A mwm_rules -m mark --mark 0x0 -m set --match-set pt1 dst -j mwm_policy_wan1 iptables -t mangle -A mwm_rules -m mark --mark 0x0 -m set --match-set pt2 dst -j mwm_policy_wan2 iptables -t mangle -A mwm_rules -m mark --mark 0x0 -m dscp --dscp 8 -j mwm_policy_balance iptables -t mangle -A mwm_rules -m mark --mark 0x0 -j mwm_policy_default iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark iptables -t mangle -A OUTPUT -m set --match-set mwm_connected dst -j mwm_policy_default iptables -t mangle -A OUTPUT -m set --match-set tunnel dst -j mwm_policy_wg iptables -t mangle -A OUTPUT -j CONNMARK --save-mark |