I have got a Linux server machine which I also use as network gateway / "router". It has three network interfaces active – two network interfaces connected to the internet over different ISPs and the third one providing internet access to my local machines through NAT. I have load balancing between the WAN links.
From the server, the network is accessible just fine – everything works, load balancing works and generally no packet losses. Connections between the server and the local machines works totally fine, too. But if I access the internet / WAN from a local machine through the server, I always see constant packet loss of ~40%. This makes connections very unstable. With a bit of investigating, I could see that I receive (and lose) packets coming through both of the interfaces more or less equally, so it's not like one of the interfaces would be dragging everything else down by losing all of its packets.
If I disable either of the two WAN links, this packet loss instantly disappears. It instantly reappears if I enable both WAN links again.
What could cause this? Any hints how to troubleshoot this problem without having to give up one of the WAN links?
my iptables
filter table:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
my iptables
nat table:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.42.0.0/24 !10.42.0.0/24
my iptables
mangle table:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 mark match ! 0x0
MARK all -- 0.0.0.0/0 0.0.0.0/0 state NEW MARK set 0x2
MARK all -- 0.0.0.0/0 0.0.0.0/0 state NEW statistic mode random probability 0.50000000000 MARK set 0x1
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
ip route show
output:
default
nexthop via 10.7.0.254 dev eth0 weight 1
nexthop via 78.62.255.254 dev eth2 weight 1
10.7.0.0/16 dev eth0 proto kernel scope link src 10.7.5.102
10.42.0.0/24 dev eth1 proto kernel scope link src 10.42.0.254
78.62.192.0/18 dev eth2 proto kernel scope link src 78.62.239.10
169.254.0.0/16 dev eth1 scope link metric 1000
everything's unedited as-is – don't care about "privacy" much in this case