Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to route web browsing through the wlan0 interface and the rest through eth1. Can you please help me with the iptables commands to achieve this. Below is my configuration. Thank you :)

Edit: This is about desktop configuration not a web server set up. Basically I want to use one of my connections to browse the web and the other one for everything else.

ifconfig:

eth1      Link encap:Ethernet  HWaddr 00:1d:09:59:80:70  
          inet addr:192.168.2.164  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::21d:9ff:fe59:8070/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:33 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4771 (4.7 KB)  TX bytes:7081 (7.0 KB)
          Interrupt:17



wlan0     Link encap:Ethernet  HWaddr 00:1c:bf:90:8a:6d  
          inet addr:192.168.1.70  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21c:bfff:fe90:8a6d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77 errors:0 dropped:0 overruns:0 frame:0
          TX packets:102 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14256 (14.2 KB)  TX bytes:14764 (14.7 KB)

route:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     1      0        0 eth1
192.168.1.0     *               255.255.255.0   U     2      0        0 wlan0
link-local      *               255.255.0.0     U     1000   0        0 wlan0
default         adsl            0.0.0.0         UG    0      0        0 eth1
share|improve this question
    
I don't think it's possible to split outgoing traffic based on TCP ports, but you can do it for routed traffic as demonstrated by another question on Server Fault. So if you put a router between your desktop and eth0 and wlan0, it's possible to do what you want. –  Cristian Ciupitu Jun 7 '12 at 14:30
    
I found the following posts to be helpful also: 1, 2 –  tkane Jun 7 '12 at 16:05
    
iptables is meant for layer 3 filtering. You may need a layer 4 tool for application level filtering. –  Dragos Jun 8 '12 at 10:42
add comment

4 Answers 4

You cannot control web versus other types of traffic using iptables. Why not? The only way to determine what is or is not "web" traffic is by which port is being used. Web traffic uses primarily port 80 for http and 443 for https, I believe.

To route web traffic to a specific interface here's what you need to do at a high level.

You must setup the domain name servers (DNS) so that the domain name points to your router IP address and then setup your router do port forwarding of port 80 to wlan0 address which is 192.168.1.70.

You can also configure your web server to only listen to the wlan0 interface specifically although that won't likely be necessary after you properly route all web ports to wlan0.

(I assume that you must have a router because the IP addresses that you give begin with 192.168. So they are local network addresses which cannot be used in a DNS server or accessed via the web. That means that you must have a router which is visible to the internet and then forwards the ports to where you want them.)

Additionally, you said that you want "all other traffic" to go to eth1. What other traffic? If you refer to email then you can setup port forwarding for those ports to point to the eth1 interface.

In fact, you can probably configure port forward to send "all other ports" to eth1. However, that is considered very insecure and can allow hackers a chance to get into your server. General practice is to only port forward specific ports for select traffic that you want to allow into your server.

share|improve this answer
    
Sorry maybe I didn't make myself clear. What I meant to say is I want to use wlan0 to browse web and eth1 for everything else. Ports 80 and 443 should cover most of it and I'm happy even if it's not 100% of the web traffic. –  tkane Jun 7 '12 at 9:23
    
Okay. I corrected the answer to show eth1 instead of eth0. Does that solve it? Is that all you need to understand? Or was something unclear or incorrect? –  Wayne Jun 7 '12 at 9:33
add comment

It is possible to write iptables rules which match on port numbers but that wouldn't be my recommendation simply because iptables rules are an easy thing to get wrong. Tkane might be referring to outgoing requests for web pages from his or her LAN, as opposed to incoming access to a public-facing web server - in which case a proxy server could be the answer. Squid is an excellent package for that purpose in my experience and can be used to enforce acceptable use policies as well. If you go that route don't forget to implement Web Proxy Auto Detection to go with it. If on the other hand this is for the purpose of providing services to external users on the internet, then creating a DMZ would be the right approach in my view. You might still want to write some simple iptables rules on the web server itself to drop traffic other than that destined for ports 80 and 443, but blocking unwanted traffic on an off-the-shelf router or firewall with a web-based management interface is likely to be more straightforward.

share|improve this answer
    
Yes, I'm referring to the outgoing web traffic. I believe it's a trivial task for someone who's familiar with iptables and my situation requires to use them. I just don't have the time at the moment to get re-familiar with iptables. –  tkane Jun 7 '12 at 10:04
    
Totally trivial. Regular web is port 80 and 443 (https) . Brtually speaking, whoever is using Linux and an admin doing network and can not sort ouf the syntax for something THAT simple rather should work in another profession. This is the similar complexity like filling up the tank of a car - really simple. –  TomTom Jun 7 '12 at 14:37
    
@TomTom I can't figure if you're being sarcastic or serious... –  tkane Jun 7 '12 at 16:15
    
Serious. I maintain a couple of routers with complex IpTable setups - pages long of rules, QOS, firewalling, routing by IP address-. If those 2 are too complex for a "pro" admin that KNOWS IpTables then we are back to the 1999 requirements for programmers: you have seen a computer. –  TomTom Jun 7 '12 at 16:23
add comment

A couple of iptables rules along the lines of:

-A MY_OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A MY_OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT 

will prevent anything other than web browsing requests leaving your linux server, but as has already been pointed out, you do need to know how to drive iptables, otherwise you risk making mistakes.

In any case the web browsing requests presumably come from client PC's on your LAN? Perhaps you are using the Linux server as a router/gateway, otherwise how would it intercept traffic from your client PC's? If so I would really recommend using an off-the shelf router instead; e.g. for a small network a standard Netgear device will provide an easy web-based management interface by which you can implement firewall rules, whereas a Linux server exposed to the internet without sound iptables expertise really is asking for trouble.

share|improve this answer
add comment

You need to use policy routing with firewall marking in order to accomplish this, because you're wanting to route based on something other than the source and destination IP addresses.

First you need to setup a separate routing table which will sends packets out wlan0.

echo 1 wlan0 >> /etc/iproute2/rt_tables
ip route add 192.168.1.0/24 dev wlan0 table wlan0
ip route add default via 192.168.1.1 table wlan0

(The first command only needs to be run once ever.)

Then we tell the routing engine to use this new table for packets with a mark of "1".

ip rule add fwmark 1 lookup wlan0

And finally, we use iptables to mark the packets we're interested in.

iptables --table mangle --append PREROUTING --protocol tcp --dport http --jump MARK --set-mark 1
iptables --table mangle --append PREROUTING --protocol tcp --dport https --jump MARK --set-mark 1
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.