Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my setup I can redirect the default gateway based on the source address. Let's say a user is connected through tun0 ( is redirect to another vpn. That works fine!

ip rule add from lookup vpn1

In a second rule I redirect the default gateway to another gateway if the user access a certain ip adress:

ip rule add from to lookup vpn2

If I access the page on ( the user is correctly routed and I can see the ip of the second vpn. On any other pages the ip address of vpn1 is shown.

But how do I tell iproute2 that all request at e. g. should be redirected through vpn2?

share|improve this question
up vote 3 down vote accepted

There is a good chance that an A-Record resolves to multiple ip addresses:

% dig +short

So you have to loop through them and add a rule for each of them like this

dig +short | while read IP; do
  ip rule add from to "$IP" lookup vpn2

Also you should think about a refresh cronjob.

share|improve this answer
The problem is, some of the addresses change very often. – Oliver Jun 7 '12 at 16:22
@Oliver, you could always figure out all of Google's address range by looking up what address space is allocated to them from the regional registrars. – Zoredache Jun 7 '12 at 16:25
I think, I will have to set it up this way. Thank you guys. :-) – Oliver Jun 7 '12 at 19:17 and other large webfarms have multiple IP's in a Round Robin DNS fashion as well as clustering.

You would have to create a rule for every RRDNS IP they use for that particular site.

Or you can update your local DNS/HOSTS file to only have one address and apply a rule on that IP.

share|improve this answer

The short answer is that you cannot use DNS in iproute2. There is no facilities in the kernel to do any kind of name lookups during the route processing. It really wouldn't make sense for their to be a way to do this either. Pause for a second and consider, this rule is evaluated for every single packet that is either forwarded by or originated by the system. If that rule results in a DNS lookup, it generates packets, which couldn't be routed until a DNS lookup is complete.

You might be tempted to use the MARK facility of iptables, since it will let you create rules using DNS, but even this won't work. Iptables evaluates the name when the rule is added, and creates rules based on the IP addresses the DNS resolves to. The rules are never updated after the rule is added.

One solution, that isn't great, is to evaluate the names using some other that will tool perform DNS lookups and add rules based on the results. The problem with this, particularly for something the size of Google, is that the results you see in DNS have the potential to change frequently.

If the site/network is big enough that they actually have their own allocation of address space directly from a RIR, and aren't just using address space provided by a CDN/ISP, then you could lookup their network in whois, and create rules based on their subnets. This page should give the the addresses that account for a large portion of Google's services.

What you might have to seriously consider is setting up some kind of proxy, that do things at a higher level. Perhaps what you are trying to do could be accomplished with Squid or some other web proxy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.