Sponsored Content
Top Forums UNIX for Dummies Questions & Answers iptables / ip route packet routing with multiple gateways Post 302924716 by Bishi on Wednesday 12th of November 2014 04:35:31 AM
Old 11-12-2014
Router iptables / ip route packet routing with multiple gateways

Hi all. Linux noob here.
I was hoping someone could help me with configuring some routing rules on my router, an Asus AC68.

The router is connected to two gateways, wan0_gateway and wan1_gateway.

I have rules set up in the router gui that will push all traffic from every IP other than my own to wan1_gateway.
This works well so far. What I would also like to do is push specific port ranges from my machine (192.168.1.2) onto the wan1_gateway also. For instance HTTP so that downloads will not affect performance of the wan0_gateway.

This is the script I was messing with so far.. I might be way off base here so any assistance is appreciated!

Code:
#!/bin/sh

ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING

ip rule add fwmark 1 table 100 via $(nvram get wan1_gateway)
ip route flush cache

iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 80 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 443 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 8080 -d 192.168.1.2 -j CONNMARK --set-mark 1
iptables -t mangle -A PREROUTING -m state --state NEW -p tcp --dport 8443 -d 192.168.1.2 -j CONNMARK --set-mark 1

EDIT: Actually the following seems to be working... am I on the right track?
Code:
#!/bin/sh

ip route flush table 100
ip route del default table 100
ip rule del fwmark 1 table 100
ip route flush cache
iptables -t mangle -F PREROUTING

ip rule add fwmark 1 table 100 via $(nvram get wan1_gateway)
ip route flush cache

iptables -t mangle -A PREROUTING -p tcp -i br0 -m multiport --sports 80,20,21,443,8080,8443 -d 192.168.1.2 -j MARK --set-mark 1


Last edited by Bishi; 11-12-2014 at 07:41 AM..
 

10 More Discussions You Might Find Interesting

1. IP Networking

Adding an extra route to the ip routing table

In my college dorm, there is a file sharing network in the entire building. Problem is, there is only a manual for windows with the settings on how to connect... :mad: They say that you have to give the following command in cmd in windows: route add 172.16.71.0 mask 255.255.255.0... (2 Replies)
Discussion started by: Japie89
2 Replies

2. IP Networking

Software/tool to route an IP packet to proxy server and capture the Proxy reply as an

Hi, I am involved in a project on Debian. One of my requirement is to route an IP packet in my application to a proxy server and receive the reply from the proxy server as an IP packet. My application handles data at the IP frame level. My application creates an IP packet(with all the necessary... (0 Replies)
Discussion started by: Rajesh_BK
0 Replies

3. Solaris

how do i make a route entry permanent in the routing table on solaris 8?

how do I make sure that the entry in the routing table on Solaris 8 stay permanent after rebooting the server. For example route add 172.20.1.60 -netmask 255.255.255.0 172.20.255.253 Each time the server reboots the entry disappears when using the command netstat -nr (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

4. UNIX for Dummies Questions & Answers

Routing or Iptables connections by hostname or ip address

edit; I found a solution that works, see thread #3 https://www.unix.com/302417065-post3.html Hi there, I have a small dedicated server that has four ip addresses and by default my httpd sends request using the servers main ip for all outbound connections. I'm quite amateur at routing and... (4 Replies)
Discussion started by: mooofa
4 Replies

5. IP Networking

iptables specific ip routing via tun

hi guys! I was searching few days for a solution to my problem but haven't found one or I'm too dumb to understand. Here's what happened: I have a linux server used as a router. It has an eth0 and eth1 (local interface). I just installed openvpn (I need it only as a client), I configured it and... (0 Replies)
Discussion started by: shamora
0 Replies

6. IP Networking

Nat and packet limits with iptables

Hi all, I have a following situation: - I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it: /usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12 --dport 1500 -j DNAT --to-destination 192.168.10.20:2000 ... (3 Replies)
Discussion started by: ahmerin
3 Replies

7. AIX

Packet loss coming with big packet size ping

(5 Replies)
Discussion started by: Vishal_dba
5 Replies

8. IP Networking

iptables - MAC routing

Hi all, I have a solution where a system can have multiple physical interfaces but a single IP address. I am looking to insert a Squid proxy (that will also perform source NAT), but the return packets must go back to the correct interface. client network is 10.x.x.x network between the... (4 Replies)
Discussion started by: wabbit02
4 Replies

9. IP Networking

Packet going out of wrong interface due to OS automatically added cache route with lower metric

RHEL 7.0, IPV6 Scenario: I have routed specific network using network scripts. 1. "ip -6 route show" shows that route has been added. ( with metric 1024) 2. Ping of the specific IP through that route is successful. 3. Now after few days, for some reason, we see that cache route appears for... (3 Replies)
Discussion started by: msr1981
3 Replies

10. Solaris

A little complex: why my packet don't route?

I have solaris11 running in a kvm virtual machine,network works fine. I can configure it with dhcp or static. Of course packet forward in kvm machine is enabled The solaris11 machine can ping external network. I have setup a solaris10 zone inside the vm the solaris 10 zone use exclusive ip... (3 Replies)
Discussion started by: Linusolaradm1
3 Replies
ROUTED(8)						    BSD System Manager's Manual 						 ROUTED(8)

NAME
routed -- network routing daemon SYNOPSIS
routed [-d] [-g] [-q] [-s] [-t] [logfile] DESCRIPTION
Routed is invoked at boot time to manage the network routing tables. The routing daemon uses a variant of the Xerox NS Routing Information Protocol in maintaining up to date kernel routing table entries. It used a generalized protocol capable of use with multiple address types, but is currently used only for Internet routing within a cluster of networks. In normal operation routed listens on the udp(4) socket for the route(8) service (see services(5)) for routing information packets. If the host is an internetwork router, it periodically supplies copies of its routing tables to any directly connected hosts and networks. When routed is started, it uses the SIOCGIFCONF ioctl(2) to find those directly connected interfaces configured into the system and marked ``up'' (the software loopback interface is ignored). If multiple interfaces are present, it is assumed that the host will forward packets between networks. Routed then transmits a request packet on each interface (using a broadcast packet if the interface supports it) and enters a loop, listening for request and response packets from other hosts. When a request packet is received, routed formulates a reply based on the information maintained in its internal tables. The response packet generated contains a list of known routes, each marked with a ``hop count'' metric (a count of 16, or greater, is considered ``infinite''). The metric associated with each route returned provides a metric relative to the sender. Response packets received by routed are used to update the routing tables if one of the following conditions is satisfied: 1. No routing table entry exists for the destination network or host, and the metric indicates the destination is ``reachable'' (i.e. the hop count is not infinite). 2. The source host of the packet is the same as the router in the existing routing table entry. That is, updated information is being received from the very internetwork router through which packets for the destination are being routed. 3. The existing entry in the routing table has not been updated for some time (defined to be 90 seconds) and the route is at least as cost effective as the current route. 4. The new route describes a shorter route to the destination than the one currently stored in the routing tables; the metric of the new route is compared against the one stored in the table to decide this. When an update is applied, routed records the change in its internal tables and updates the kernel routing table. The change is reflected in the next response packet sent. In addition to processing incoming packets, routed also periodically checks the routing table entries. If an entry has not been updated for 3 minutes, the entry's metric is set to infinity and marked for deletion. Deletions are delayed an additional 60 seconds to insure the invalidation is propagated throughout the local internet. Hosts acting as internetwork routers gratuitously supply their routing tables every 30 seconds to all directly connected hosts and networks. The response is sent to the broadcast address on nets capable of that function, to the destination address on point-to-point links, and to the router's own address on other networks. The normal routing tables are bypassed when sending gratuitous responses. The reception of responses on each network is used to determine that the network and interface are functioning correctly. If no response is received on an interface, another route may be chosen to route around the interface, or the route may be dropped if no alternative is available. Options supported by routed: -d Enable additional debugging information to be logged, such as bad packets received. -g This flag is used on internetwork routers to offer a route to the ``default'' destination. This is typically used on a gateway to the Internet, or on a gateway that uses another routing protocol whose routes are not reported to other local routers. -s Supplying this option forces routed to supply routing information whether it is acting as an internetwork router or not. This is the default if multiple network interfaces are present, or if a point-to-point link is in use. -q This is the opposite of the -s option. -t If the -t option is specified, all packets sent or received are printed on the standard output. In addition, routed will not divorce itself from the controlling terminal so that interrupts from the keyboard will kill the process. Any other argument supplied is interpreted as the name of file in which routed's actions should be logged. This log contains information about any changes to the routing tables and, if not tracing all packets, a history of recent messages sent and received which are related to the changed route. In addition to the facilities described above, routed supports the notion of ``distant'' passive and active gateways. When routed is started up, it reads the file /etc/gateways to find gateways which may not be located using only information from the SIOGIFCONF ioctl(2). Gateways specified in this manner should be marked passive if they are not expected to exchange routing information, while gateways marked active should be willing to exchange routing information (i.e. they should have a routed process running on the machine). Routes through passive gateways are installed in the kernel's routing tables once upon startup. Such routes are not included in any routing information transmit- ted. Active gateways are treated equally to network interfaces. Routing information is distributed to the gateway and if no routing infor- mation is received for a period of time, the associated route is deleted. Gateways marked external are also passive, but are not placed in the kernel routing table nor are they included in routing updates. The function of external entries is to inform routed that another routing process will install such a route, and that alternate routes to that destination should not be installed. Such entries are only required when both routers may learn of routes to the same destination. The /etc/gateways is comprised of a series of lines, each in the following format: <net | host> name1 gateway name2 metric value <passive | active | external> The net or host keyword indicates if the route is to a network or specific host. Name1 is the name of the destination network or host. This may be a symbolic name located in /etc/networks or /etc/hosts (or, if started after named(8), known to the name server), or an Internet address specified in ``dot'' notation; see inet(3). Name2 is the name or address of the gateway to which messages should be forwarded. Value is a metric indicating the hop count to the destination host or network. One of the keywords passive, active or external indicates if the gateway should be treated as passive or active (as described above), or whether the gateway is external to the scope of the routed protocol. Internetwork routers that are directly attached to the Arpanet or Milnet should use the Exterior Gateway Protocol (EGP) to gather routing information rather then using a static routing table of passive gateways. EGP is required in order to provide routes for local networks to the rest of the Internet system. FILES
/etc/gateways for distant gateways SEE ALSO
udp(7), icmp(7) Internet Transport Protocols, XSIS 028112, Xerox System Integration Standard. BUGS
routed is of dubious value. Consider using gated(8) or zebra(8). The kernel's routing tables may not correspond to those of routed when redirects change or add routes. Routed should note any redirects received by reading the ICMP packets received via a raw socket. Routed should incorporate other routing protocols. Using separate processes for each requires configuration options to avoid redundant or competing routes. Routed should listen to intelligent interfaces, such as an IMP, to gather more information. It does not always detect unidirectional fail- ures in network interfaces (e.g., when the output side fails). HISTORY
The routed command appeared in 4.2BSD. Linux NetKit (0.17) December 11, 1993 Linux NetKit (0.17)
All times are GMT -4. The time now is 01:05 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy