Sponsored Content
Top Forums UNIX for Dummies Questions & Answers iptables / ip route packet routing with multiple gateways Post 302924716 by Bishi on Wednesday 12th of November 2014 04:35:31 AM
Old 11-12-2014
Router iptables / ip route packet routing with multiple gateways

Hi all. Linux noob here.
I was hoping someone could help me with configuring some routing rules on my router, an Asus AC68.

The router is connected to two gateways, wan0_gateway and wan1_gateway.

I have rules set up in the router gui that will push all traffic from every IP other than my own to wan1_gateway.
This works well so far. What I would also like to do is push specific port ranges from my machine (192.168.1.2) onto the wan1_gateway also. For instance HTTP so that downloads will not affect performance of the wan0_gateway.

This is the script I was messing with so far.. I might be way off base here so any assistance is appreciated!

Code:
#!/bin/sh

ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING

ip rule add fwmark 1 table 100 via $(nvram get wan1_gateway)
ip route flush cache

iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 80 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 443 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 8080 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 8443 -d 192.168.1.2 -j CONNMARK --set-mark 1

EDIT: Actually the following seems to be working... am I on the right track?
Code:
#!/bin/sh

ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING

ip rule add fwmark 1 table 100 via $(nvram get wan1_gateway)
ip route flush cache

iptables -t mangle -A PREROUTING -p tcp -i br0 -m multiport --sports 80,20,21,443,8080,8443 -d 192.168.1.2 -j MARK --set-mark 1


Last edited by Bishi; 11-12-2014 at 07:41 AM..
 

10 More Discussions You Might Find Interesting

1. IP Networking

Adding an extra route to the ip routing table

In my college dorm, there is a file sharing network in the entire building. Problem is, there is only a manual for windows with the settings on how to connect... :mad: They say that you have to give the following command in cmd in windows: route add 172.16.71.0 mask 255.255.255.0... (2 Replies)
Discussion started by: Japie89
2 Replies

2. IP Networking

Software/tool to route an IP packet to proxy server and capture the Proxy reply as an

Hi, I am involved in a project on Debian. One of my requirement is to route an IP packet in my application to a proxy server and receive the reply from the proxy server as an IP packet. My application handles data at the IP frame level. My application creates an IP packet(with all the necessary... (0 Replies)
Discussion started by: Rajesh_BK
0 Replies

3. Solaris

how do i make a route entry permanent in the routing table on solaris 8?

how do I make sure that the entry in the routing table on Solaris 8 stay permanent after rebooting the server. For example route add 172.20.1.60 -netmask 255.255.255.0 172.20.255.253 Each time the server reboots the entry disappears when using the command netstat -nr (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

4. UNIX for Dummies Questions & Answers

Routing or Iptables connections by hostname or ip address

edit; I found a solution that works, see thread #3 https://www.unix.com/302417065-post3.html Hi there, I have a small dedicated server that has four ip addresses and by default my httpd sends request using the servers main ip for all outbound connections. I'm quite amateur at routing and... (4 Replies)
Discussion started by: mooofa
4 Replies

5. IP Networking

iptables specific ip routing via tun

hi guys! I was searching few days for a solution to my problem but haven't found one or I'm too dumb to understand. Here's what happened: I have a linux server used as a router. It has an eth0 and eth1 (local interface). I just installed openvpn (I need it only as a client), I configured it and... (0 Replies)
Discussion started by: shamora
0 Replies

6. IP Networking

Nat and packet limits with iptables

Hi all, I have a following situation: - I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it: /usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12 --dport 1500 -j DNAT --to-destination 192.168.10.20:2000 ... (3 Replies)
Discussion started by: ahmerin
3 Replies

7. AIX

Packet loss coming with big packet size ping

(5 Replies)
Discussion started by: Vishal_dba
5 Replies

8. IP Networking

iptables - MAC routing

Hi all, I have a solution where a system can have multiple physical interfaces but a single IP address. I am looking to insert a Squid proxy (that will also perform source NAT), but the return packets must go back to the correct interface. client network is 10.x.x.x network between the... (4 Replies)
Discussion started by: wabbit02
4 Replies

9. IP Networking

Packet going out of wrong interface due to OS automatically added cache route with lower metric

RHEL 7.0, IPV6 Scenario: I have routed specific network using network scripts. 1. "ip -6 route show" shows that route has been added. ( with metric 1024) 2. Ping of the specific IP through that route is successful. 3. Now after few days, for some reason, we see that cache route appears for... (3 Replies)
Discussion started by: msr1981
3 Replies

10. Solaris

A little complex: why my packet don't route?

I have solaris11 running in a kvm virtual machine,network works fine. I can configure it with dhcp or static. Of course packet forward in kvm machine is enabled The solaris11 machine can ping external network. I have setup a solaris10 zone inside the vm the solaris 10 zone use exclusive ip... (3 Replies)
Discussion started by: Linusolaradm1
3 Replies
in.ripngd(1M)						  System Administration Commands					     in.ripngd(1M)

NAME
in.ripngd - network routing daemon for IPv6 SYNOPSIS
/usr/sbin/in.ripngd [-s] [-q] [-t] [-p n] [-P] [-v ] [logfile] DESCRIPTION
in.ripngd is the IPv6 equivalent of in.routed(1M). It is invoked at boot time to manage the network routing tables. The routing daemon uses the Routing Information Protocol for IPv6. In normal operation, in.ripngd listens on the udp(7P) socket port 521 for routing information packets. If the host is an internetwork router, it periodically supplies copies of its routing tables to any directly connected hosts and networks. When in.ripngd is started, it uses the SIOCGLIFCONF ioctl(2) to find those directly connected IPv6 interfaces configured into the system and marked "up"; the software loopback interface is ignored. If multiple interfaces are present, it is assumed the host will forward pack- ets between networks. in.ripngd then multicasts a request packet on each IPv6 interface and enters a loop, listening for request and response packets from other hosts. When a request packet is received, in.ripngd formulates a reply based on the information maintained in its internal tables. The response packet contains a list of known routes. With each route is a number specifying the number of bits in the prefix. The prefix is the number of bits in the high order part of an address that indicate the subnet or network that the route describes. Each route reported also has a "hop count" metric. A count of 16 or greater is considered "infinity." The metric associated with each route returned provides a metric relative to the sender. The request packets received by in.ripngd are used to update the routing tables if one of the following conditions is satisfied: o No routing table entry exists for the destination network or host, and the metric indicates the destination is "reachable", that is, the hop count is not infinite. o The source host of the packet is the same as the router in the existing routing table entry. That is, updated information is being received from the very internetwork router through which packets for the destination are being routed. o The existing entry in the routing table has not been updated for a period of time, defined to be 90 seconds, and the route is at least as cost-effective as the current route. o The new route describes a shorter route to the destination than the one currently stored in the routing tables; this is determined by comparing the metric of the new route against the one stored in the table. When an update is applied, in.ripngd records the change in its internal tables and generates a response packet to all directly connected hosts and networks. To allow possible unstable situations to settle, in.ripngd waits a short period of time (no more than 30 seconds) before modifying the kernel's routing tables. In addition to processing incoming packets, in.ripngd also periodically checks the routing table entries. If an entry has not been updated for 3 minutes, the entry's metric is set to infinity and marked for deletion. Deletions are delayed an additional 60 seconds to insure the invalidation is propagated throughout the internet. Hosts acting as internetwork routers gratuitously supply their routing tables every 30 seconds to all directly connected hosts and net- works. OPTIONS
in.ripngd supports the following options: -q Do not supply routing information. -s Force in.ripngd to supply routing information whether it is acting as an internetwork router or not. -p n Send and receive the routing packets from other routers using the UDP port number n. -P Do not use poison reverse. -t Print all packets sent or received to standard output. in.ripngd will not divorce itself from the controlling terminal. Accordingly, interrupts from the keyboard will kill the process. -v Print all changes made to the routing tables to standard output with a timestamp. Any other argument supplied is interpreted as the name of the file in which the actions of in.ripngd, as specified by this option or by -t, should be logged versus being sent to standard output. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWroute | +-----------------------------+-----------------------------+ SEE ALSO
in.routed(1M), ioctl(2), attributes(5), udp(7P) Malkin, G., Minnear, R., RFC 2080, RIPng for IPv6, January 1997. NOTES
The kernel's routing tables may not correspond to those of in.ripngd for short periods of time while processes that utilize existing routes exit; the only remedy for this is to place the routing process in the kernel. in.ripngd currently does not support all of the functionality of in.routed(1M). Future releases may support more if appropriate. in.ripngd initially obtains a routing table by examining the interfaces configured on a machine. It then sends a request on all directly connected networks for more routing information. in.ripngd does not recognize or use any routing information already established on the machine prior to startup. With the exception of interface changes, in.ripngd does not see any routing table changes that have been done by other programs on the machine, for example, routes added, deleted or flushed by way of the route(1M) command. Therefore, these types of changes should not be done while in.ripngd is running. Rather, shut down in.ripngd, make the changes required, and then restart in.ripngd. SunOS 5.10 6 Nov 2000 in.ripngd(1M)
All times are GMT -4. The time now is 07:50 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy