Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a main server (Centos 6.2) which serves as router/firewall and has virtual machines. Virtual machines are in the network 10.0.0.0/8 and everyone else (there is DHCP server) is at 192.168.0.0/16.

I have two interfaces facing the internet, ppp0 with a variable IP and ppp1 with a static IP. What I need to do is to make all outgoing traffic from 10.0.0.0/8 go through ppp1 so the virtual machines will be seen as the static IP. Machines in 192.168.0.0/16 must be able to communicate directly to machines in 10.0.0.0/8.

...basically, make all traffic that is to go to internet, go through ppp1 if it originates from 10.0.0.0/8. Retaining the ability to the different networks to talk to each other.

I have tried several examples of source based routing with no luck, I end up with no access from the main server to the virtual machines. Nothing with iptables seems to work either.

My whole schema looks like:

Server:
    ppp0:  facing internet variable ip
    ppp1:  facing internet static ip
    vnet0: bridge with ips: 192.168.0.1, 10.0.0.1
        eth1:  facing the local network
        vnet1: interface to the first virtual server
        vnet2: interface to the second virtual server

Virtual server 1:
    eth0:  interface connected to main server, with ip: 10.0.0.10.


Virtual server 2:
    eth0:  interface connected to main server, with ip: 10.0.0.11.


Local Machine *: (All the computers of people working in the office)
    eth*:  interface connected to main server, with ip: 192.168.0.*.

The output of ip route show in the server is:

10.9.100.1 dev ppp1  proto kernel  scope link  src 190.196.26.245 
10.52.173.3 dev ppp0  proto kernel  scope link  src 190.21.97.109 
192.168.0.0/24 dev vnet0  proto kernel  scope link  src 192.168.0.1 
169.254.0.0/16 dev eth0  scope link  metric 1002 
169.254.0.0/16 dev eth2  scope link  metric 1004 
169.254.0.0/16 dev vnet0  scope link  metric 1005 
10.0.0.0/8 dev vnet0  proto kernel  scope link  src 10.0.0.1 
default dev ppp0  scope link

The output of ip link show is:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 00:21:5e:c2:af:20 brd ff:ff:ff:ff:ff:ff
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:14:78:7c:47:87 brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether ac:f1:df:69:5c:70 brd ff:ff:ff:ff:ff:ff
5: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 00:14:78:7c:47:87 brd ff:ff:ff:ff:ff:ff
7: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 3
    link/ppp 
8: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state    UNKNOWN qlen 3
    link/ppp 
9: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
    link/ether fe:54:00:54:f8:48 brd ff:ff:ff:ff:ff:ff
10: vnet2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN    qlen 500
    link/ether fe:54:00:d0:14:24 brd ff:ff:ff:ff:ff:ff
share|improve this question
    
Have you tried policy based routing? policyrouting.org/PolicyRoutingBook/ONLINE/TOC.html –  NickW Apr 22 '13 at 14:14
    
@NickW I have not and I am in an emergency, I cannot read all that. Thanks though. –  user1598585 Apr 22 '13 at 14:17
    
Well, I can give you a few examples that might work for you, but you should take time to read through it sooner than later, as it can create some very odd problems if misconfigured.. –  NickW Apr 22 '13 at 14:20
    
@NickW I would appreciate it certainly. I hope you can help me. And sure I will have to eventually learn all that. –  user1598585 Apr 22 '13 at 14:22

2 Answers 2

up vote 4 down vote accepted

You should have the iproute package installed to do policy routing.

# create a new ip routing table entry
echo "66 static-ip" >> /etc/iproute2/rt_tables
# add the rule entry to have packets with source 10.0.0.0/8 routed through the 
# alternate "static-ip" routing table
ip rule add from 10.0.0.0/8 lookup static-ip
# add the routes to the "static-ip" table
ip route add default dev ppp1 table static-ip
ip route add 192.168.0.0/16 dev vnet0 table static-ip
ip route add 10.0.0.0/8 dev vnet0 table static-ip

This would be it basically, but you would need to figure out how to make the entries reboot-persistent (which would typically be done by placing them into a startup script and parametrizing them a little to suit your needs). Take a look at this mailing list post for an example how it could be done in CentOS-style.

Note that using a bridged interface with two IP aliases is probably not what you want as you would not be able to filter traffic securely - the bridged connection always would pass traffic from one net segment to another, no matter how you configure your IP filters. You should use two separate interfaces connected to 10.0.0.0/8 and 192.168.0.0/16 networks respectively (eth0 and eth2 in your configuration if you would not be using a bridge AFAICS). Also the APIPA network (169.254.0.0/16) should be removed from the routes - add NOZEROCONF=yes to /etc/sysconfig/network and restart networking (or the host).

share|improve this answer
    
What should I exactly put in <static-gateway>, <internal-router> and <internal-int>. The last I imagine should be the name of the interface to my network. –  user1598585 Apr 22 '13 at 18:26
    
@user1598585 <static-gateway> would be the next hop at your public interface - as this is a point-to-point interface, you should be able to omit the via <static-gateway> entirely. internal-router would be the router with a route to 192.168.0.0/16 if not connected locally. Otherwise omit the via <internal-router> as well. <internal-int> indeed would be the interface pointing towards your internal network 192.168.0.0/16. –  the-wabbit Apr 22 '13 at 18:59
    
I tried this but I lose access to my virtual machine 10.0.0.11. Maybe it is worth to note that I have vnet0, a bridge with two ips, 192.168.0.1 and 10.0.0.1. –  user1598585 Apr 22 '13 at 19:08
    
@user1598585 this seems exotic at best. Care to post your current interface and routing setup (ip route show, ip link show) as an update to your question? It is incredibly hard to predict the outcome of route changes for non-.straightforward setups without further info –  the-wabbit Apr 22 '13 at 22:15
    
I have updated my question with the information you asked for. Thanks for your help. –  user1598585 Apr 22 '13 at 23:39

You want to do Policy Based Routing, something along these lines:

echo 200 Static >> /etc/iproute2/rt_tables
ip rule add from 10.0.0.0/8 table Static
ip route add default via <ppp1 IP> dev ppp1 table Static
ip route flush cache

This will route any traffic from 10.0.0.0 through ppp1, any other traffic should obey the regular routing rules. You may need to add a rule to tell the networks how to talk to one another, this should do what you asked though..

Some further reading, this is a very good introduction to the concepts: http://lartc.org/howto/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.