0

Right now, in my ubuntu there are two network cards installed. One connects to a local area network (NIC 1) and the other is connected to internet (NIC2) . We have configured iptables to forward all incoming connections to NIC1 to NIC2. We would like to setup another NIC (say NIC3) which will be connected to the internet through another separate broadband connection.

Is it possible to direct all incoming connections from NIC1 for say www.google.com only to NIC3 and others say for www.a.com, www.b.com, www.c.com to NIC2?

Can I do it by changing iptables only or should I look for other options?

This http://www.cyberciti.biz/faq/linux-route-add/ solved my problem.

Improve this question
3
  • 1
    This isn't a programming question so I voted to move your question to ServerFault. But as a teaser, Google "Linux routing table" and look at using iproute.
    – Conrad Shultz
    Jul 14, 2012 at 7:32
  • Can you clarify your question, does someone on lan1 want to speak to google on lan3?
    – Matthew Ife
    Jul 14, 2012 at 11:00
  • By "forward" do you mean routing or DNAT?
    – mgorven
    Jul 15, 2012 at 7:09

3 Answers 3

Reset to default
0

What you're looking for can be found in the Linux Advanced Routing and Traffic Control document. It's not easy to understand though.

Improve this answer
2

It can be managed by iproute2 not iptables or iptables just for marking packets. Go through Linux Advanced Routing & Traffic Control, notably multiple routing tables. Create separate routing table per routing case, thus outgoing interface. Then add rules to point packets to particular routing tables. Rule can be created based on iptables packet marking.

Can't provide detail setup, I'm doing routers on OpenBSD for years. Linux is too complicated on that task and loosing performance quickly with growing count of entries in iptables.

Improve this answer
1

Is it possible to direct all incoming connections from NIC1 for say www.google.com only to NIC3 and others say for www.a.com, www.b.com, www.c.com to NIC2?

The answer is sort of, but it's a bad idea. Iptables lives at Layer-3/Layer-4 and thus isn't really designed to deal with DNS names. If I recall correctly if you specify redirect or forwarding rules using DNS names instead of IP addresses or netblocks, iptables will accept that information and dutifully try to resolve those names appropriately.

There are a couple of problems with this approach:

  • It's a security issue. Hosts can manipulate how your firewall handles traffic by manipulating DNS. This is easier to do than you think. Your introducing complexity that isn't needed. Complexity that is unnecessary will eventually bite you.
  • iptables will need to do the DNS lookups at some point to determine what IPs those domain name's resolve to. I'm not sure when iptables does the DNS lookups but if it's at load time then you can expect the IP addresses to go stale over time, especially for big domains like google. Furthermore iptables will load before the name service in the boot order and I'm not sure how that will effect things. If it's on-the-fly, you are adding quite a bit of overhead as each packet will require a DNS lookup.

What you're really looking for is a load balancing solution that is conversant in Layer-7 protocols, namely HTTP. I think Squid could probably be configured to do this - it at the very least it is a good place to start.

EDIT: Doesn't look like Squid will do what you want (it does reverse proxy load balancing for HTTP). I'm not sure why you'd want to Layer-7 aware outbound load balancing anyway - what problem are you actually trying to solve?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .