2

In my setup I can redirect the default gateway based on the source address. Let's say a user is connected through tun0 (10.2.0.0/16) is redirect to another vpn. That works fine!

ip rule add from 10.2.0.10 lookup vpn1

In a second rule I redirect the default gateway to another gateway if the user access a certain ip adress:

ip rule add from 10.2.0.10 to 94.142.154.71 lookup vpn2

If I access the page on 94.142.154.71 (myip.is) the user is correctly routed and I can see the ip of the second vpn. On any other pages the ip address of vpn1 is shown.

But how do I tell iproute2 that all request at e. g. google.com should be redirected through vpn2?

Improve this question

3 Answers 3

Reset to default
3

There is a good chance that an A-Record resolves to multiple ip addresses:

% dig +short google.com
209.85.148.101
209.85.148.102
209.85.148.113
209.85.148.138
209.85.148.139
209.85.148.100

So you have to loop through them and add a rule for each of them like this

dig +short google.com | while read IP; do
  ip rule add from 10.2.0.10 to "$IP" lookup vpn2
done

Also you should think about a refresh cronjob.

Improve this answer
4
  • The problem is, some of the addresses change very often.
    – Oliver
    Jun 7, 2012 at 16:22
  • @Oliver, you could always figure out all of Google's address range by looking up what address space is allocated to them from the regional registrars.
    – Zoredache
    Jun 7, 2012 at 16:25
  • whois.arin.net/rest/org/GOGL/nets
    – Zoredache
    Jun 7, 2012 at 16:33
  • I think, I will have to set it up this way. Thank you guys. :-)
    – Oliver
    Jun 7, 2012 at 19:17
2

The short answer is that you cannot use DNS in iproute2. There is no facilities in the kernel to do any kind of name lookups during the route processing. It really wouldn't make sense for their to be a way to do this either. Pause for a second and consider, this rule is evaluated for every single packet that is either forwarded by or originated by the system. If that rule results in a DNS lookup, it generates packets, which couldn't be routed until a DNS lookup is complete.

You might be tempted to use the MARK facility of iptables, since it will let you create rules using DNS, but even this won't work. Iptables evaluates the name when the rule is added, and creates rules based on the IP addresses the DNS resolves to. The rules are never updated after the rule is added.

One solution, that isn't great, is to evaluate the names using some other that will tool perform DNS lookups and add rules based on the results. The problem with this, particularly for something the size of Google, is that the results you see in DNS have the potential to change frequently.

If the site/network is big enough that they actually have their own allocation of address space directly from a RIR, and aren't just using address space provided by a CDN/ISP, then you could lookup their network in whois, and create rules based on their subnets. This page should give the the addresses that account for a large portion of Google's services.

What you might have to seriously consider is setting up some kind of proxy, that do things at a higher level. Perhaps what you are trying to do could be accomplished with Squid or some other web proxy.

Improve this answer
1

google.com and other large webfarms have multiple IP's in a Round Robin DNS fashion as well as clustering.

You would have to create a rule for every RRDNS IP they use for that particular site.

Or you can update your local DNS/HOSTS file to only have one google.com address and apply a rule on that IP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .