IPTABLES and load balancing multiple ISPs


We're setting up a triple homed linux box with Slackware 10.2. We're running a patched kernel for various reasons.

eth0 = LAN
eth1 = ISP 1
eth2 = ISP 2

Both ISPs give us a static 8 IP range.

We first tried to do something like this: http://lartc.org/howto/lartc.rpdb.multiple-links.html
which sort of works but seems a bit unreliable. (bind 9.3.2 is installed locally)

As an alternative I'm now trying to get this to work: http://www.linux.com.lb/wiki/index.pl?node=Load%20Balancing%20Across%20Multiple%20Links (this is worth a read too: http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound )

Here's the problem - it requires the "random" option from netfilter iptables patch-o-matic to be installed.  

We've got iptables 1.3.5 installed but when I run the patchomatic ./runme base command it does not include "random" as a target.   Patch-o-matic version is patch-o-matic-ng-20040621.

Is anybody able to let me know how to patch the kernel and iptables to include this target?

libipt_random.c appears to be in iptables 1.3.5 but there is no libipt_random.so after compilation.

Can anybody help me figure out what's going on please?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

here is the best tutorial to do that

pablouruguay, this tutorial is for routed, not NATed links. For NATed it doesn't fit well. This problem described here: http://linux-ip.net/html/adv-multi-internet.html#adv-multi-internet-inbound (wesbird posted it in his question :)

wesbird, I suppose you are using kernel 2.6.15?
Read here how to install 'random' module. Probably you have old version of patch-o-magic. Read here for more details: http://www.linuxjournal.com/node/7180/

Running POM is simple; download the latest Patch-o-matic tarball from the directory /pub/patch-o-matic on ftp.netfilter.org, restore it on your system and run the following command while logged in as root. Make sure to give the correct kernel source directory name as the value of the KERNEL_DIR parameter:

KERNEL_DIR=/usr/src/linux-2.6.15 ./runme random

wesbirdAuthor Commented:
Hi again,

Am I making some silly mistake here?

did a make clean on the kernel,
tried ./runme random on the correct kernel source tree

it said that the patch was already applied
rebuilt the kernel and I'm still getting this:

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: Couldn't load match `random':/usr/lib/iptables/libipt_random.so: cannot open shared object file: No such file or directory
Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

reistall iptables

the library doesn't link to the system.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
also you need correct iptables source tree before applying patch
KERNEL_DIR=/usr/src/linux/ IPTABLES_DIR=/where_is_your_iptables/ ./runme random
next rebiuld and install iptables
next rebuild and install kernel
Today I did it on lates kernel. Works fine.
Also there is 'nth' extention module in iptables. Use it and you may match any Nth packet, so load balancing will bee more predictable. To add it to your sorces use: ./runme nth
To read more about 'nth' man iptables or read help file for 'nth' modile in path-o-matic
After patching kernel, don't forget to run 'make menuconfig' a to toggle 'random match' and 'nth match' modules in appropriate branches.
Here is example of how random works:
[root@localhost ~]# iptables -A INPUT -m random -j REJECT
[root@localhost ~]# ping localhost
PING localhost.localdomain ( 56(84) bytes of data.
64 bytes from localhost.localdomain ( icmp_seq=1 ttl=64 time=0.214 ms
From localhost.localdomain ( icmp_seq=4 Destination Port Unreachable

[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere             random 50% reject-with icmp-port-unreachable

[root@localhost ~]# uname -a
Linux localhost.localdomain #3 PREEMPT Sat Apr 29 14:13:28 VLAST 2006 i686 i686 i386 GNU/Linux

wesbirdAuthor Commented:
Hi again,

ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20060427.tar.bz2 has allowed me select it, but I've still got a couple of problems.  

iptables: Unknown error 4294967295

>> After patching kernel, don't forget to run 'make menuconfig' a to toggle 'random match' and 'nth match' modules in appropriate branches.

I've just spotted that I've still got a problem with the build.  I'm using make gconfig as opposed to menuconfig - it didn't seem to do the appropriate update.    I just found nth and random under Networking->Networking Support->Networking Options->Network Packet Filtering and they weren't checked.

Will post again tomorrow after attempting another rebuild.

To activate 'nth' module, run:
KERNEL_DIR=/usr/src/linux/ IPTABLES_DIR=/where_is_your_iptables/ ./runme random nth
then toggle kernel parameter (doesn't matter if you are using GUI config)
then in kernel directory:

make install
make modules_install

then in iptables source directory:
make install

This error appeares either if your kernel doesn't support these modules (you didn't perform 'make install' for kernel) or if you are using incorrect parameters with this module.
wesbirdAuthor Commented:

We've also applied this patch for dead gateway detection which seems to improve things somewhat: http://www.ssi.bg/~ja/

wesbirdAuthor Commented:
The dead gateway detection is really cool and now the automatic failover is working too - it still takes a minute or so, but that's quicker than I can fix it at 3am - not just from disconencting eth1 or eth2, but also line failure of the DSL boxes.

Thanks for your help.

These are the values changed:

root@darkstar:/proc/sys/net/ipv4/route# ls -l
total 0
-rw-r--r--  1 root root 0 2006-05-25 16:21 error_burst
-rw-r--r--  1 root root 0 2006-05-25 16:21 error_cost
--w-------  1 root root 0 2006-05-25 16:21 flush
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_elasticity
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_interval
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_min_interval
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_min_interval_ms
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_thresh
-rw-r--r--  1 root root 0 2006-05-25 16:21 gc_timeout
-rw-r--r--  1 root root 0 2006-05-25 16:21 max_delay
-rw-r--r--  1 root root 0 2006-05-25 16:21 max_size
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_adv_mss
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_delay
-rw-r--r--  1 root root 0 2006-05-25 16:21 min_pmtu
-rw-r--r--  1 root root 0 2006-05-25 16:21 mtu_expires
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_load
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_number
-rw-r--r--  1 root root 0 2006-05-25 16:21 redirect_silence
-rw-r--r--  1 root root 0 2006-05-25 16:21 secret_interval
root@pcgate:/proc/sys/net/ipv4/route# cat *
cat: flush: Operation not permitted
Thank you for info.
Next time instead of "ls" and "cat *", use "grep . *" it shows filenames with content.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.