Portforwarding bei MultiWAN mit Gateway im selben Subnetz

export IFWAN2=eth1
export WAN2IP=x.x.x.102
export WAN2GWIP=x.x.x.97

export IFLAN1=eth2
export LAN1IP=192.168.x.1


###LAN Server IPs
export WIN2008R201=192.168.x.3


#######Grundlegende Konfiguration
#Module für das Connection Tracking laden
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_conntrack_irc

# default-Policies setzen, Tabellen leeren und loeschen / NAT regeln für Multiwan bleiben erhalten
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -t nat -P PREROUTING  ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT      ACCEPT

iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X


#Routing aktivieren
echo 1 > /proc/sys/net/ipv4/ip_forward

#MultiWAN
ip route add default via $WAN1GWIP dev $IFWAN1 tab 1
ip route add default via $WAN2GWIP dev $IFWAN2 tab 2
ip rule add from $WAN1IP/32 tab 1 priority 500
ip rule add from $WAN2IP/32 tab 2 priority 600
ip route flush cache

####### Allow Regeln LAN/WAN between Firewall
#Loopback Verkehr erlauben
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT  -i lo -j ACCEPT

#Erlaube ICMP Echo Requests (eingehend / ausgehend)
iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#Erlaube DNS Abfragen (ausgehend)
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p udp --sport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

##Erlaube jeden Verkehr
#iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#Erlaube INPUT und OUTPUT für das interne Netzwerk
iptables -A OUTPUT -o $IFLAN1 -j ACCEPT
iptables -A INPUT  -i $IFLAN1 -j ACCEPT

######## Allow Regeln LAN-to-WAN
#Erlaube LAN > WAN (Masquerading in NAT)
iptables -t nat -A POSTROUTING -o $IFWAN1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o $IFWAN2 -j MASQUERADE

#Erlaube den internen LAN Verkehr (Ansonsten geht kein Masquerading)
iptables -A FORWARD -i $IFLAN1 -j ACCEPT
iptables -A FORWARD -o $IFLAN1 -j ACCEPT


####### Port Forwarding WAN-to-LAN  (!!!!!!!!!!! Aktuell funktioniert immer nur das Portfowarding von einem der beiden Interfaces)
###Forward $IFWAN1
iptables -t nat -A PREROUTING  -p tcp -m tcp -d $WAN1IP --dport 80 -j DNAT --to-destination $WIN2008R201:80
iptables -A FORWARD -m state -p tcp -d $WIN2008R201 --dport 80 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -m tcp -s $WIN2008R201 --sport 80 -j SNAT --to-source $WAN1IP

###Forward $IFWAN2  ###
iptables -t nat -A PREROUTING  -p tcp -m tcp -d $WAN2IP --dport 3389 -j DNAT --to-destination $WIN2008R201:3389
iptables -A FORWARD -m state -p tcp -d $WIN2008R201 --dport 3389 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -m tcp -s $WIN2008R201 --sport 3389 -j SNAT --to-source $WAN2IP