Route web browsing through a separate iterface

Question

I'd like to route web browsing through the wlan0 interface and the rest through eth1. Can you please help me with the iptables commands to achieve this. Below is my configuration. Thank you :)

Edit: This is about desktop configuration not a web server set up. Basically I want to use one of my connections to browse the web and the other one for everything else.

ifconfig:

eth1      Link encap:Ethernet  HWaddr 00:1d:09:59:80:70  
          inet addr:192.168.2.164  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::21d:9ff:fe59:8070/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:33 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4771 (4.7 KB)  TX bytes:7081 (7.0 KB)
          Interrupt:17



wlan0     Link encap:Ethernet  HWaddr 00:1c:bf:90:8a:6d  
          inet addr:192.168.1.70  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21c:bfff:fe90:8a6d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77 errors:0 dropped:0 overruns:0 frame:0
          TX packets:102 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14256 (14.2 KB)  TX bytes:14764 (14.7 KB)

route:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     1      0        0 eth1
192.168.1.0     *               255.255.255.0   U     2      0        0 wlan0
link-local      *               255.255.0.0     U     1000   0        0 wlan0
default         adsl            0.0.0.0         UG    0      0        0 eth1

Answer 1

You cannot control web versus other types of traffic using iptables. Why not? The only way to determine what is or is not "web" traffic is by which port is being used. Web traffic uses primarily port 80 for http and 443 for https, I believe.

To route web traffic to a specific interface here's what you need to do at a high level.

You must setup the domain name servers (DNS) so that the domain name points to your router IP address and then setup your router do port forwarding of port 80 to wlan0 address which is 192.168.1.70.

You can also configure your web server to only listen to the wlan0 interface specifically although that won't likely be necessary after you properly route all web ports to wlan0.

(I assume that you must have a router because the IP addresses that you give begin with 192.168. So they are local network addresses which cannot be used in a DNS server or accessed via the web. That means that you must have a router which is visible to the internet and then forwards the ports to where you want them.)

Additionally, you said that you want "all other traffic" to go to eth1. What other traffic? If you refer to email then you can setup port forwarding for those ports to point to the eth1 interface.

In fact, you can probably configure port forward to send "all other ports" to eth1. However, that is considered very insecure and can allow hackers a chance to get into your server. General practice is to only port forward specific ports for select traffic that you want to allow into your server.

Answer 2

It is possible to write iptables rules which match on port numbers but that wouldn't be my recommendation simply because iptables rules are an easy thing to get wrong. Tkane might be referring to outgoing requests for web pages from his or her LAN, as opposed to incoming access to a public-facing web server - in which case a proxy server could be the answer. Squid is an excellent package for that purpose in my experience and can be used to enforce acceptable use policies as well. If you go that route don't forget to implement Web Proxy Auto Detection to go with it. If on the other hand this is for the purpose of providing services to external users on the internet, then creating a DMZ would be the right approach in my view. You might still want to write some simple iptables rules on the web server itself to drop traffic other than that destined for ports 80 and 443, but blocking unwanted traffic on an off-the-shelf router or firewall with a web-based management interface is likely to be more straightforward.

Answer 3

A couple of iptables rules along the lines of:

-A MY_OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A MY_OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT 

will prevent anything other than web browsing requests leaving your linux server, but as has already been pointed out, you do need to know how to drive iptables, otherwise you risk making mistakes.

In any case the web browsing requests presumably come from client PC's on your LAN? Perhaps you are using the Linux server as a router/gateway, otherwise how would it intercept traffic from your client PC's? If so I would really recommend using an off-the shelf router instead; e.g. for a small network a standard Netgear device will provide an easy web-based management interface by which you can implement firewall rules, whereas a Linux server exposed to the internet without sound iptables expertise really is asking for trouble.

Answer 4

You need to use policy routing with firewall marking in order to accomplish this, because you're wanting to route based on something other than the source and destination IP addresses.

First you need to setup a separate routing table which will sends packets out wlan0.

echo 1 wlan0 >> /etc/iproute2/rt_tables
ip route add 192.168.1.0/24 dev wlan0 table wlan0
ip route add default via 192.168.1.1 table wlan0

(The first command only needs to be run once ever.)

Then we tell the routing engine to use this new table for packets with a mark of "1".

ip rule add fwmark 1 lookup wlan0

And finally, we use iptables to mark the packets we're interested in.

iptables --table mangle --append PREROUTING --protocol tcp --dport http --jump MARK --set-mark 1
iptables --table mangle --append PREROUTING --protocol tcp --dport https --jump MARK --set-mark 1