Focus on Linux
Back to list
Oct 03 2005 09:41AM
kucserak post sk
Oct 05 2005 05:18PM
Artur Szczotka (artis ae katowice pl)
A long time ago I was forced to solve very similar problem based on Linux
First of all the thing you're trying to do is called "Policy Routing". In
Linux (2.4.x) you have a lot of options you may use to accomplish your
task. I suggest using Linux kernel 2.4.x, compiled to support Advanced
Routing feature. You may need to upgrade your iptables and iproute2
package as well. Generally you'll need proper kernel, iproute2 and
Step 1. You mark a traffic you are interested in. e,g dst ports 25,80 ...
iptables is your friend at this stage.
Step 2. You create an additional routing table to use with certain uplink
eg. You have 2 links to providers lets say eth0, eth1.
It is nice to name an additional table you will use:
echo 200 table02 >> /etc/iproute2/rt_tables
Then you need to add a default gw to table table02:
ip route add default via x.x.x.x dev eth1 table table02
next you should do:
ip rule add fwmark xx table table02.
So packets having proper fwmark will be directed to table02 instead of
table main, and then will be routed according to rules entered to
In linux you have 3 predefined routing tables:
local, main, default. Command ip route ls table_name shows you each one.
It's important do add all local routes to table local:
E.G If you have on your local iface (eth2) many IP classess, 10.10.10.1,
10.10.10.2 you have two options. You have to add them to every additional
routing table in your system or you may add these classes only once to
local routing table. This is important because otherwise computers
from different local subnets will have no chance to see each other.
When using fw mark in the ip rule add command, you have to turn off
echo 0 > /proc/net/ipv4/conf/eth1/rp_filter
If you don't It won't be working and you'll be unable to diagnose the
source of problem. What's interesting when you use the form:
ip rule add from ip_class table table_name everything will be working
fine. More info about this problem you can find at:
section 10.1. Caveats.
So enjoy, tcpdump is helpfull for debugging purposes.
"Unix jest prosty i logiczny, ale dostrzec i zobaczyæ
jego prostotê mo¿e tylko geniusz (a przynajmniej programista)"
- Dennis M. Ritchie
artis (at) linux.bielsko (dot) pl [email concealed]
reg. Linux User no 207289
On Mon, 3 Oct 2005 kucserak (at) post (dot) sk [email concealed] wrote:
> Dear List!
> I just want to ask you a question.I have a linux(Secure platform) gateway server with 2 external ip address to the internet (one S/0 ADSl, second S/1 Point to Point) and one internal ip eth0 for my LAN. I need to split up the outgoing traffic.HTTP/HTTPS want to route through the ADSL and the rest of traffic (SMTP,POP3,FTP) through the Point to Point.Can i solve this with Linux iptables or whatever else. Any suggestion help..
[ reply ]
Oct 05 2005 12:55PM
Vladimir Mitiouchev (vovcia irc pl)
Oct 05 2005 09:43AM
David Ballester - Kern Pharma (dballester kernpharma com)
Oct 04 2005 07:46PM
Jose Luis Domingo Lopez (focus-linux 24x7linux com)
Oct 04 2005 04:55PM
Frank Burkhardt (fbo2 gmx net)
Oct 04 2005 04:48PM
Joachim Schipper (j schipper math uu nl)
Oct 04 2005 04:12PM
Martin Benda (bendis bendis cz)
Copyright 2010, SecurityFocus