Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Looking for some advice, I'm pulling my hair out trying to figure this out! Running Redhat (CentOS) with fairly normal configuration and I've disabled the firewall for now.

I have a web server which has worked wonderfully in the following setup:

Server IP:

I port forward our public facing IP address part 80/443, lets say, to the .10 internal IP and it works great.

However I recently had the need to add a second SSL site, so I needed a new external IP, which I have from the ISP. I added a second NIC to the system, eth1 with a "public" ip of The gateway for this external IP is now, which is the same as the firewall/router. Now the system wants to route everything through eth1, rendering the first website (and interface) disabled.

Now I need to set up static routes, but can't seem to get it to do what I want. Basically I want:

Incoming Traffic from to be forwarded to by the firewall/router (already done), return traffic to go through on eth0.

Incoming Traffic from to be served straight up, routed through on eth1.

Any tips on the correct setup?

Right now I have

cat ifcfg-eth0


cat ifroute-eth0

default dev eth0 via dev eth0

cat ifcfg-eth1


cat route-eth1

default dev eth1 via dev eth1

ip route via dev eth1 via dev eth0 dev eth0  proto kernel  scope link  src dev eth1  proto kernel  scope link  src dev eth1  scope link 
default via dev eth1 

This results in traffic working fine, but the other interface is knocked offline.

Any help is appreciated!

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Why are you making life so difficult for yourself? You don't need a second NIC for that. Just add another IP address to the first NIC, so that it picks up the traffic for the other IP address, too.
Then do a port forwarding in your firewall, using DNAT, for both addresses, and to separate internal IP addresses (because of the SSL certificate) on the web server (which also needs to use two IP addresses in the same ethernet interface), and Bob's your uncle.

In case this isn't clear, let me try and explain differently:

Public IP -> DNAT to (ports 80 and 443) -> DNAT to (ports 80 and 443)

Both the public IP addresses use the same physical interface on the firewall/router and both the internal addresses use the same physical interface on the web server.

share|improve this answer
Thank you, and yes, I ended up going this way! I forgot to KISS! –  Dave Drager Aug 15 '10 at 14:44

remove the default route on the eth1 network, then use iproute2 and firewall marks to ensure that the traffic that comes in via the eth1 interface gets sent out via that same interface.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.