Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a main server (Centos 6.2) which serves as router/firewall and has virtual machines. Virtual machines are in the network and everyone else (there is DHCP server) is at

I have two interfaces facing the internet, ppp0 with a variable IP and ppp1 with a static IP. What I need to do is to make all outgoing traffic from go through ppp1 so the virtual machines will be seen as the static IP. Machines in must be able to communicate directly to machines in

...basically, make all traffic that is to go to internet, go through ppp1 if it originates from Retaining the ability to the different networks to talk to each other.

I have tried several examples of source based routing with no luck, I end up with no access from the main server to the virtual machines. Nothing with iptables seems to work either.

My whole schema looks like:

    ppp0:  facing internet variable ip
    ppp1:  facing internet static ip
    vnet0: bridge with ips:,
        eth1:  facing the local network
        vnet1: interface to the first virtual server
        vnet2: interface to the second virtual server

Virtual server 1:
    eth0:  interface connected to main server, with ip:

Virtual server 2:
    eth0:  interface connected to main server, with ip:

Local Machine *: (All the computers of people working in the office)
    eth*:  interface connected to main server, with ip: 192.168.0.*.

The output of ip route show in the server is: dev ppp1  proto kernel  scope link  src dev ppp0  proto kernel  scope link  src dev vnet0  proto kernel  scope link  src dev eth0  scope link  metric 1002 dev eth2  scope link  metric 1004 dev vnet0  scope link  metric 1005 dev vnet0  proto kernel  scope link  src 
default dev ppp0  scope link

The output of ip link show is:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:21:5e:c2:af:20 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:14:78:7c:47:87 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether ac:f1:df:69:5c:70 brd ff:ff:ff:ff:ff:ff
5: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 00:14:78:7c:47:87 brd ff:ff:ff:ff:ff:ff
7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 3
8: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state    UNKNOWN qlen 3
9: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
    link/ether fe:54:00:54:f8:48 brd ff:ff:ff:ff:ff:ff
10: vnet2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN    qlen 500
    link/ether fe:54:00:d0:14:24 brd ff:ff:ff:ff:ff:ff
share|improve this question
Have you tried policy based routing? – NickW Apr 22 '13 at 14:14
@NickW I have not and I am in an emergency, I cannot read all that. Thanks though. – Mario Apr 22 '13 at 14:17
Well, I can give you a few examples that might work for you, but you should take time to read through it sooner than later, as it can create some very odd problems if misconfigured.. – NickW Apr 22 '13 at 14:20
@NickW I would appreciate it certainly. I hope you can help me. And sure I will have to eventually learn all that. – Mario Apr 22 '13 at 14:22
up vote 4 down vote accepted

You should have the iproute package installed to do policy routing.

# create a new ip routing table entry
echo "66 static-ip" >> /etc/iproute2/rt_tables
# add the rule entry to have packets with source routed through the 
# alternate "static-ip" routing table
ip rule add from lookup static-ip
# add the routes to the "static-ip" table
ip route add default dev ppp1 table static-ip
ip route add dev vnet0 table static-ip
ip route add dev vnet0 table static-ip

This would be it basically, but you would need to figure out how to make the entries reboot-persistent (which would typically be done by placing them into a startup script and parametrizing them a little to suit your needs). Take a look at this mailing list post for an example how it could be done in CentOS-style.

Note that using a bridged interface with two IP aliases is probably not what you want as you would not be able to filter traffic securely - the bridged connection always would pass traffic from one net segment to another, no matter how you configure your IP filters. You should use two separate interfaces connected to and networks respectively (eth0 and eth2 in your configuration if you would not be using a bridge AFAICS). Also the APIPA network ( should be removed from the routes - add NOZEROCONF=yes to /etc/sysconfig/network and restart networking (or the host).

share|improve this answer
What should I exactly put in <static-gateway>, <internal-router> and <internal-int>. The last I imagine should be the name of the interface to my network. – Mario Apr 22 '13 at 18:26
@user1598585 <static-gateway> would be the next hop at your public interface - as this is a point-to-point interface, you should be able to omit the via <static-gateway> entirely. internal-router would be the router with a route to if not connected locally. Otherwise omit the via <internal-router> as well. <internal-int> indeed would be the interface pointing towards your internal network – the-wabbit Apr 22 '13 at 18:59
I tried this but I lose access to my virtual machine Maybe it is worth to note that I have vnet0, a bridge with two ips, and – Mario Apr 22 '13 at 19:08
@user1598585 this seems exotic at best. Care to post your current interface and routing setup (ip route show, ip link show) as an update to your question? It is incredibly hard to predict the outcome of route changes for non-.straightforward setups without further info – the-wabbit Apr 22 '13 at 22:15
I have updated my question with the information you asked for. Thanks for your help. – Mario Apr 22 '13 at 23:39

You want to do Policy Based Routing, something along these lines:

echo 200 Static >> /etc/iproute2/rt_tables
ip rule add from table Static
ip route add default via <ppp1 IP> dev ppp1 table Static
ip route flush cache

This will route any traffic from through ppp1, any other traffic should obey the regular routing rules. You may need to add a rule to tell the networks how to talk to one another, this should do what you asked though..

Some further reading, this is a very good introduction to the concepts:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.