Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using shorewall firewall and have successfuly configure multiple isp source.

Currently it balances all traffic to both ISP. What I want to achieve is to route ssh trafic to ISP1 and route www traffic to ISP2. How can I do this?

share|improve this question

I think you will need to create multiple route tables. One is your default meant for normal traffic, the next one is your special SSH table which contains route entries only for the ISP connection you want to use.

Next, setup iptables to mark packets which are from your IP and listening SSH port.

Finally, you can setup ip rule entries to route based off of the firewall mark.

Theres lots of info (but you might have already seen it seeing as your this far) in the LARTC documentation:

So, as an example:

  1. Add a new routing table with a name.

    echo SSH 500 >>/etc/iproute2/rt_tables
  2. Add a default route to another routing table that accomplishes the right thing.

    ip route add default via $ISP2_GW table SSH 
  3. Setup a rule to make fwmark use this new table.

    ip rule add fwmark 0x0001 table SSH
  4. Finally setup a iptables rule to mark your packets.

    iptables -I PREROUTING -t mangle -p tcp --sport 22 -j MARK --set-mark 0x0001
    iptables -I OUTPUT     -t mangle -p tcp --sport 22 -j MARK --set-mark 0x0001

That should hopefully setup what you want correctly. You'll need to also make sure that this configuration survives reboots! BUt I leave that as an exercise to you.

share|improve this answer
do you know how I can make it in shorewall config? – Ianpogi5 Nov 27 '11 at 23:12
Never used shorewall, sorry. I know you can do it but wouldn't want to suggest anything in shorewall when I probably have less experience in it than you! – Matthew Ife Nov 27 '11 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.