# Below is my routing setup.  It works fine as long as my gateway 
# is my default gateway from my main routing table.
# If I try to use my other gateway the NAT does not correctly map back to the originating IP. 
# ex. 192.168.0.99 requests a page from google.com.  Router rewrites the packet for with nated source.
#     packet comes back from the server. Packet is never nated back to 192.168.0.99
#
# for the setup below this works
# iptables -t mangle -A PREROUTING -s 192.168.0.99  -j MARK --set-mark 1
# and the following doesn't
# iptables -t mangle -A PREROUTING -s 192.168.0.99  -j MARK --set-mark 2
#
# the only thing I need to change to get the other to work is change the default gateway in the main routing table
# What else needs to be done so it will work correctly?


#Table 1 routing
ip route add 10.10.10.128/26 dev eth0 src 10.10.10.145 table T1
ip route add 192.168.0.0/24     dev eth0 table T1
ip route add default via 10.10.10.131 table T1
ip route add 127.0.0.0/8 dev lo   table T1

#Table 2 Routing
ip route add 10.10.0.5 dev ppp0 table T2
ip route add default via 10.10.0.5 dev ppp0 table T2
ip route add 192.168.0.0/24     dev eth0 table T2
ip route add 127.0.0.0/8 dev lo   table T2

#Default Routing
ip route add 10.10.10.128/26 dev eth0 src 10.10.10.145
ip route add 10.10.0.5 dev ppp0 src 10.10.0.66
ip route add 192.168.0.0/24     dev eth0
ip route add 127.0.0.0/8 dev lo
ip route add default via 10.10.10.131

ip rule add from 10.10.10.145 table T1
ip rule add from 10.10.0.66 table T2
ip rule add fwmark 1 table T1
ip rule add fwmark 2 table T2


#Begin iptables nat setup
iptables --flush
iptables --delete-chain
iptables -t nat --flush
iptables -t nat --delete-chain
iptables -t nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING --out-interface ppp0 -j MASQUERADE

iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT

#port forwarding
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 22 -j DNAT --to 192.168.0.33:22
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 23 -j DNAT --to 192.168.0.35:22
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 873 -j DNAT --to 192.168.0.33:873
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 1040 -j DNAT --to 192.168.0.33:1040
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5500 -j DNAT --to 192.168.0.15:5500
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5900 -j DNAT --to 192.168.0.15:5900
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 80 -j DNAT --to 192.168.0.33:80
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 443 -j DNAT --to 192.168.0.33:443
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 873 -j DNAT --to 192.168.0.33:443

#Copyable VNC
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5902 -j DNAT --to 192.168.0.99:5902
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5901 -j DNAT --to 192.168.0.98:5900

#Copyable VNC listening route
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5501 -j DNAT --to 192.168.0.98:5500
iptables -t nat -A PREROUTING -p tcp  -d 10.10.0.66 --dport 5502 -j DNAT --to 192.168.0.99:5500

echo 1 > /proc/sys/net/ipv4/ip_forward