# Gentoo Router - Interface Bonding & IPTables?

## Crimjob

Hello again all,

I recently wanted to give interface bonding a go and I seem to be having some issues. I have a current set of firewall rules with iptables set up to act as a router, with LAN as ETH1 and WAN as ETH0. This works fine when I only have the two interfaces.

I was thinking it would be simple enough, comment out individual interfaces, set up bonding, start the bonded interface, change iptable rules to suit, but apparently I was wrong.

I was able to comment out individual interfaces, set up and start bonding, at which point I'm still able to access the server no problem, but since iptables isn't running, no internet for my LAN.

This is where it seems to get tricky. I only have 4 mentions of eth1 in my iptables setup, and I changed all of those to bond0, loaded iptables, and I stay connected to SSH, can still browse the server locally etc., but still no internet for my LAN. I even tried allowing bond0, eth1, eth2 in iptables but no change.+

I really don't understand what I'm doing wrong here, it seems fairly straight forward. Is there something specific to be done to the bonded interface? Or something specific within iptables?

my /etc/conf.d/net

```

slaves_bond0="eth1 eth2"

config_bond0=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.0.0" )

```

and my iptables (which is currently configured for eth1, however I just replaced all mentions of eth1 with bond0 and nothing happens)

```

*nat

:PREROUTING ACCEPT [71839:7061900]

:POSTROUTING ACCEPT [216:51799]

:OUTPUT ACCEPT [26914:1842823]

-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80

-A PREROUTING -i eth0 -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.1:81

-A PREROUTING -i eth0 -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.3:81

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.1:10000

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10001 -j DNAT --to-destination 192.168.0.3:10000

-A PREROUTING -i eth0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.101:53

-A PREROUTING -i eth0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.0.101:53

-A PREROUTING -i eth0 -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.0.101:80

-A PREROUTING -i eth0 -p udp -m udp --dport 88 -j DNAT --to-destination 192.168.0.101:88

-A PREROUTING -i eth0 -p tcp -m tcp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074

-A PREROUTING -i eth0 -p udp -m udp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074

-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.102:443

-A PREROUTING -i eth0 -p tcp -m tcp --dport 5223 -j DNAT --to-destination 192.168.0.102:5223

-A PREROUTING -i eth0 -p udp -m udp --dport 3478 -j DNAT --to-destination 192.168.0.102:3478

-A PREROUTING -i eth0 -p udp -m udp --dport 3479 -j DNAT --to-destination 192.168.0.102:3479

-A PREROUTING -i eth0 -p udp -m udp --dport 3658 -j DNAT --to-destination 192.168.0.102:3658

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070

-A PREROUTING -i eth0 -p udp -m udp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10071 -j DNAT --to-destination 192.168.0.102:10071

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10072 -j DNAT --to-destination 192.168.0.102:10072

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10073 -j DNAT --to-destination 192.168.0.102:10073

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10074 -j DNAT --to-destination 192.168.0.102:10074

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10075 -j DNAT --to-destination 192.168.0.102:10075

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10076 -j DNAT --to-destination 192.168.0.102:10076

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10077 -j DNAT --to-destination 192.168.0.102:10077

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10078 -j DNAT --to-destination 192.168.0.102:10078

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10079 -j DNAT --to-destination 192.168.0.102:10079

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10080 -j DNAT --to-destination 192.168.0.102:10080

-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80

-A PREROUTING -i eth0 -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.1:81

-A PREROUTING -i eth0 -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.3:81

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 192.168.0.1:10000

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10001 -j DNAT --to-destination 192.168.0.3:10000

-A PREROUTING -i eth0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.101:53

-A PREROUTING -i eth0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.0.101:53

-A PREROUTING -i eth0 -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.0.101:80

-A PREROUTING -i eth0 -p udp -m udp --dport 88 -j DNAT --to-destination 192.168.0.101:88

-A PREROUTING -i eth0 -p tcp -m tcp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074

-A PREROUTING -i eth0 -p udp -m udp --dport 3074 -j DNAT --to-destination 192.168.0.101:3074

-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.102:443

-A PREROUTING -i eth0 -p tcp -m tcp --dport 5223 -j DNAT --to-destination 192.168.0.102:5223

-A PREROUTING -i eth0 -p udp -m udp --dport 3478 -j DNAT --to-destination 192.168.0.102:3478

-A PREROUTING -i eth0 -p udp -m udp --dport 3479 -j DNAT --to-destination 192.168.0.102:3479

-A PREROUTING -i eth0 -p udp -m udp --dport 3658 -j DNAT --to-destination 192.168.0.102:3658

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070

-A PREROUTING -i eth0 -p udp -m udp --dport 10070 -j DNAT --to-destination 192.168.0.102:10070

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10071 -j DNAT --to-destination 192.168.0.102:10071

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10072 -j DNAT --to-destination 192.168.0.102:10072

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10073 -j DNAT --to-destination 192.168.0.102:10073

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10074 -j DNAT --to-destination 192.168.0.102:10074

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10075 -j DNAT --to-destination 192.168.0.102:10075

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10076 -j DNAT --to-destination 192.168.0.102:10076

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10077 -j DNAT --to-destination 192.168.0.102:10077

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10078 -j DNAT --to-destination 192.168.0.102:10078

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10079 -j DNAT --to-destination 192.168.0.102:10079

-A PREROUTING -i eth0 -p tcp -m tcp --dport 10080 -j DNAT --to-destination 192.168.0.102:10080

-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

# Completed on Tue Dec 21 18:09:58 2010

# Generated by iptables-save v1.4.6 on Tue Dec 21 18:09:58 2010

*mangle

:PREROUTING ACCEPT [34484662:33409678325]

:INPUT ACCEPT [638453:230510278]

:FORWARD ACCEPT [33831166:33163141834]

:OUTPUT ACCEPT [543482:124765518]

:POSTROUTING ACCEPT [34374661:33287927445]

COMMIT

# Completed on Tue Dec 21 18:09:58 2010

# Generated by iptables-save v1.4.6 on Tue Dec 21 18:09:58 2010

*filter

:INPUT DROP [78:4804]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [33160:2135658]

:THRU - [0:0]

-A INPUT -s 127.0.0.0/8 -i eth0 -j DROP

-A INPUT -s 192.168.0.0/16 -i eth0 -j DROP

-A INPUT -s 172.16.0.0/12 -i eth0 -j DROP

-A INPUT -s 10.0.0.0/8 -i eth0 -j DROP

-A INPUT ! -i eth1 -p udp -m udp --dport 67 -j REJECT --reject-with icmp-port-unreachable

-A INPUT ! -i eth1 -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable

-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP

-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A INPUT -f -j DROP

-A INPUT -i lo -j ACCEPT

-A INPUT -i eth1 -j ACCEPT

-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

-A INPUT -j THRU

-A FORWARD -d 192.168.0.0/16 -i eth1 -j DROP

-A FORWARD -s 192.168.0.0/16 -i eth1 -j ACCEPT

-A FORWARD -d 192.168.0.0/16 -i eth0 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 53 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 81 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 82 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 88 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 3074 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 3074 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 3478 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 3479 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 3658 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 5223 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 9293 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10000 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10001 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10070 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 10070 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10071 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10072 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10073 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10074 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10075 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10076 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10077 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10078 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10079 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 10080 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 30595 -j ACCEPT

-A THRU -i eth0 -p tcp -m tcp --dport 58222:58333 -j ACCEPT

-A THRU -i eth0 -p udp -m udp --dport 6881 -j ACCEPT

COMMIT

```

----------

## richard.scott

I don't think you've set a default gateway for bond0

----------

## Crimjob

Don't have one set for eth1 unbonded either and it's working fine?

My WAN interface is currently dynamic IP, not sure what I'd put for route.

Rest of my conf.d/net

```

config_eth0=( "dhcp" )

config_eth1=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.0.0" )

```

----------

## Hu

It appears your nat rules are all duplicated.  Additionally, you could combine many of your rules into simpler ones by using the ability to match a range of contiguous ports and the ability to omit a destination port on the DNAT target, thereby preserving the original destination port.

Your rule THRU is written as though it were to permit traffic which you are NATing, but you attached it to INPUT instead of FORWARD.  Additionally, many of the THRU rules could benefit from consolidation via use of contiguous ports.

----------

## Crimjob

Yeah my rules are a bit of a hack job, and they may have been duplicated during a network outage in attempt of a speedy recovery. I am also not overly knowledgeable with IPTables, as I have not found a solid resource which accomplishes what I want to do for an example to work off of, and as such, this is pretty much a combination of the many tutorials I've found on the net.

I should be able to consolidate them, but I'm a bit confused on your other notes, as well as the fact that this current config works with eth1 but not bond0.

Would I just change

```
-A INPUT -j THRU 
```

to

```
-A FORWARD -j THRU 
```

?

And per your DNAT comment, something like

```
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:80 
```

to

```
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1 
```

?

----------

## Hu

Yes, to both of your questions.

----------

## Crimjob

Thank you sir! That definitely helped, quite a bit of browsing laggyness disappeared with that forward change.

I'll see what I can do for consolidation / cleaning up to make it a bit more clear, then I'll try to re-visit interface bonding.

----------

