Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using shorewall firewall and have successfuly configure multiple isp source.

Currently it balances all traffic to both ISP. What I want to achieve is to route ssh trafic to ISP1 and route www traffic to ISP2. How can I do this?

share|improve this question

1 Answer 1

I think you will need to create multiple route tables. One is your default meant for normal traffic, the next one is your special SSH table which contains route entries only for the ISP connection you want to use.

Next, setup iptables to mark packets which are from your IP and listening SSH port.

Finally, you can setup ip rule entries to route based off of the firewall mark.

Theres lots of info (but you might have already seen it seeing as your this far) in the LARTC documentation: http://lartc.org/howto/lartc.rpdb.html

So, as an example:

  1. Add a new routing table with a name.

    echo SSH 500 >>/etc/iproute2/rt_tables
    
  2. Add a default route to another routing table that accomplishes the right thing.

    ip route add default via $ISP2_GW table SSH 
    
  3. Setup a rule to make fwmark use this new table.

    ip rule add fwmark 0x0001 table SSH
    
  4. Finally setup a iptables rule to mark your packets.

    iptables -I PREROUTING -t mangle -p tcp --sport 22 -j MARK --set-mark 0x0001
    iptables -I OUTPUT     -t mangle -p tcp --sport 22 -j MARK --set-mark 0x0001
    

That should hopefully setup what you want correctly. You'll need to also make sure that this configuration survives reboots! BUt I leave that as an exercise to you.

share|improve this answer
    
do you know how I can make it in shorewall config? –  Ianpogi5 Nov 27 '11 at 23:12
    
Never used shorewall, sorry. I know you can do it but wouldn't want to suggest anything in shorewall when I probably have less experience in it than you! –  Matthew Ife Nov 27 '11 at 23:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.