Professional Documents
Culture Documents
IP Address Configuration
Mangle Configuration
Route
Explanation
First we give a code snippet and then explain what it actually does.
For the ip firewall mangle, 5 uplink connection need 5 connection mark and 5 routing
mark.
Mangle 1 : nth : 5,1
Mangle 2 : nth : 4,1
Mangle 3 : nth : 3,1
Mangle 4 : nth : 2,1
Mangle 5 : No nth
Here the explanation :
Mangle 1 : read all traffic and match 1/5 of traffic
Mangle 2 : read 4/5 traffic and match 1/4 of they traffic (1/5 total traffic)
Mangle 3 : read 3/4 from 4/5 traffic above (or 3/5 total traffic) and match 1/2 traffic
above (1/5 total traffic)
Mangle 4 : read 2/3 from 3/5 total traffic (or 2/5 total traffic) and match 1/2 traffic above
(1/5 total traffic)
Mengle 5 : read the rest of traffic (1/5 total traffic)
Quick Start for Impatient Configuration export from the gateway router:
Explanation First we give a code snippet and then explain what it actually does.
Mangle :
The router has two upstream (WAN) interfaces with the addresses of 10.111.0.2/24 and
10.112.0.2/24. The LAN interface has the name "Local" and IP address of
192.168.0.1/24.
First we take every second packet that establishes new session (note connection-
state=new), and mark it with connection mark "odd". Consequently all successive
packets belonging to the same session will carry the connection mark "odd". Note that
we are passing these packets to the second rule (passthrough=yes) to place a routing mark
on these packets in addition to the connection mark.
add chain=prerouting in-interface=Local connection-
mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no comment="" disabled=no
The rule above places the routing mark "odd" on all packets that belong to the "odd"
connection and stops processing all other mangle in prerouting chain rules for these
packets.
These rules do the same for the remaining half of the traffic as the first two rules for the
first half of the traffic. The code above effectively means that each new connection
initiated through the router from the local network will be marked as either "odd" or
"even" with both routing and connection marks.
NAT
All traffic marked "odd" is being NATted to source IP address of 10.111.0.2, while traffic
marked "even" gets "10.112.0.2" source IP address.
Routing.
For all traffic marked "odd" (consequently having 10.111.0.2 translated source address)
we use 10.111.0.1 gateway. In the same manner all traffic marked "even" is routed
through the 10.112.0.1 gateway. Finally, we have one additional entry specifying that
traffic from the router itself (the traffic without any routing marks) should go to
10.112.0.1 gateway.