QUOTE(strace @ Nov 3 2006, 12:07 PM)
Since squid packets can't be marked without ROUTE mangle, how about I put it this way:
CODE
Clients -> router -> WAN1 (squid traffics)
|
|
WAN2(other traffics)
Yes this is more simple, divert all connections excluding squid/other ports to WAN2.
Sorry, I'm really bad with iptables

In former problem:
No, there is no need for squid patching. My mangle rule is wrong, the correct one is already answered in the mailing list. That is change from:
iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK --set-mark 2
to
iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 2
For a while i was confuse with chain OUTPUT because i guess it evaluated after routing already done, but the truth is not. See
http://l7-filter.sourceforge.net/PacketFlow.png to see how routing is decided.
After that, just follow for the rest.
Current setup:
- I would prefer the former rather than later as it's cleaner approach. If you decide to use this setup, you'll need to mark every packet except tcp dport 80. This would also increase unnecessary processing overhead. But the concept is still the same:
- route only happen at IP layer, so it don't know about TCP port number. So it needs help from iptables.
- iptables know about TCP layer, so it can check the source/dest port for each packet. To work with route, iptables will mark the necessary packet with special "tag".
- route see packet with special "tag", send them to correct interface (eg: wan2).
Notes:
- iptables know nothing about application layer. So if you want up to application control(eg: http only, not port 80 tcp), then you'll need another piece of software. (Eg: snort-inline). But remember, the higher TCP layer you use, the higher processing overhead would occur. So, for this example i'll just use tcp port 80 which should be adequate.
QUOTE(sunmaster @ Nov 3 2006, 10:32 AM)
BTW, is it possible to wifi with this DIY router? Maybe something like this,
CODE
[Internet] -> [DIY router PC] -> [wifi adapter] -> [client pc]
or something like that??
(or maybe the 2nd NIC in the DIY router is the wifi adapter,which means DIY router + wifi adapter is in 1 box)
I'm noob in this networking stuff?? But I'm very interested in networking my home...

If your card support hostap, it can be converted to Access Point.
http://hostap.epitest.fi/QUOTE(xenothrix @ Nov 3 2006, 10:32 AM)
actually i m interested to set up a kind of failover dual-wan setup as traffics r mainly HTTP, POP3/SMTP, IM n once in while VPN/RDC/VNC to desktops at customer sites. the main concern is, HTTP as our job deals with web-based developments. double the speed is not quite an issue as current 1mbps HTTP connection will b more than enough to cater the clients. Only thing is the current router modem seems to die off when number of clients increase.
thanks for clarifying the issue!
will try to set up a terminal when i get the access to a free desktop unit.
I see, so what you want is High-Availability(HA) not High Performance(HP). If i recall correctly, you'll need a daemon to monitor line status. If fail, then failover.. maybe this site could help you:
http://www.linux-ha.org/