Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux box with two interfaces: one for data and the other for management purpose. If both are on the same network, I have a route added for both interfaces.

Imagine the routing table is: eth0 eth1 ( management interface)

The problem is that even if a connection is initiated to mgmt IP (eth1), return traffic will be on eth0.

How can I ensure that return traffic on a connection uses the same interface as that of forwardeded traffic?

share|improve this question
If both NICs are on the same network, why is it a problem which NIC the packets come out of? – womble Aug 19 '11 at 7:25
Because I want to use eth1 only for management purpose and eth0 for data. I am just wondering if at all it is possible to do this! – kumar Aug 19 '11 at 7:36
How does making a packet come from a particular interface make it more "managementy"? I know it certainly makes it terribly Enterprisey, but that's not a good thing. – womble Aug 19 '11 at 7:40
Why not use different subnets? – symcbean Aug 19 '11 at 12:12

You can do this using a combination of iptables/netfilter with the conntrack and (conn-)mark modules, and policy-routing.

in the iptables MANGLE table:

-A PREROUTING          -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
-A OUTPUT              -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
-A PREROUTING -i eth0  -m state --state NEW                 -j CONNMARK --set-mark 1
-A PREROUTING -i eth1  -m state --state NEW                 -j CONNMARK --set-mark 2
-A PREROUTING -m connmark --mark 1                          -j MARK --set-mark 1
-A PREROUTING -m connmark --mark 2                          -j MARK --set-mark 2
-A PREROUTING -m state --state NEW -m connmark ! --mark 0   -j CONNMARK --save-mark

I assume you have a default route on eth0 so we only need to set up a "magic" route for those pakets coming in via eth1.

Using the iproute2 package:

ip rule add fwmark 2 table eth1
ip route add default via table eth1

What this does is: Every connection coming in via eth1 will be marked by iptables with a "2", so every paket in that connection has a mark in it, that can be read outside the iptables code. Then a policy route is added, that routes every paket having a mark of "2" via the routing table "eth1" which has a default route to your router, but sends out the pakets via eth1.


That setup above assumes you have the same IP on both interfaces. If you have different IPs on both, you can simplify the setup by only using a policy-route on the source ip (i assume on eth1):

ip rule add from table eth1
ip route add default via table eth1

There is no need for connmarking via iptables then.

share|improve this answer

If you are trying to keep your management traffic separate from other traffic, you will not achieve this simply by having your management leaving a different port on your server. You need to keep the traffic separate after it leaves the server too - which you will not achieve by having it travel on the same subnet.

So to separate your traffic you really need to split your network up into multiple subnets, using separate switching, or VLANs, and use routing to route traffic between the different subnets. Then on your server you have a separate management interface that is only connected to the management subnet. Ideally you do your management tasks from hosts connected only to this subnet too.

That will enable you to really get what you want, and will be simpler to configure and understand - although not necessarily cheaper to setup. I'm assuming you have a clear business case for separating your management traffic.

If all you want to do is limit management tasks on your server to specific hosts on your network you would achieve this more simply by setting up iptables to only allow management type traffic (e.g. identified by port such as ssh) from those specific hosts IP addresses.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.