Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two gateways with different ISP, one of them defined as default for the LAN user and the other ISP used as the default for the Servers and VPN traffic. This is done using regular routing tables configured with the DHCP.

Now I want Google drive and some other software traffic installed in the LAN users laptops that uses a lot of upload to always use the other ISP that is not defined as their default gw. How can I accomplish that??

My initial thoughts are use IPTABLES or squid.

I have been trying with this

iptables -t nat -A PREROUTING -d GOOGLE_IP -j DNAT --to-destination MY_SECOND_ISP
iptables -t nat -A POSTROUTING -s MY_SECOND_ISP -j SNAT --to-source GOOGLE_IP

but it does not work. When I test it the traffic goes to the default gw

Any idea how to do it using iptables, shorewall or squid??

share|improve this question
You need to do policy routing for this, not NAT. – Michael Hampton Jan 10 '14 at 15:22
I've tried this ""; and is not working for me. When I do "ip route add default via dev ppp0 table mail.out" and then a route to print the routing tables that line don't show up – Santi Jan 10 '14 at 18:43

Assuming LAN Default GW (GW1) LAN IP is and Server Default GW (GW2) LAN IP is, i.e. the LAN sees both routers on same segment.

You can configure a static route on GW1 that points traffic whose destination is GOOGLE_IP to next hop GW2 LAN IP Address.

If the GW1 is Cisco: ip route GOOGLE_IP GW2_LAN_IP

If the GW1 is Linux: ip route add GOOGLE_IP/32 gw GW2_LAN_IP

In this way, when any host on the LAN send traffic to GOOGLE_IP, the traffic will go to GW1.

Then the static route on GW1 will forward the traffic to GW2.

Then, GW2 will forward the traffic out of its WAN interface.

The return traffic coming from internet to GW2 will be forwarded out to the LAN, and will reach the hosts.

This way you create the route once on GW1, so that it works for all LAN hosts.

share|improve this answer

Since services like Google drive are in the Cloud and their IPs might change at any time I believe your approach sooner or later will stop working.

There is another method to differentiate the traffic of those applications you want by doing DSCP marking on the guest OS level.

The DSCP marks will be 'attached' on the packets themselves so then you will be able to match those packets with iptables on your router and route them via the VPN or any other gateway you like.

That way you are saying that for example googledrive.exe (or whatever application you want) will always be routed via the VPN no matter where it tries to connect to.

Here are some instructions on how to set custom DSCP marks using windows

You can match the dscp marks with the --dscp match option of iptables.

Of course all of the above do not answer your original question. You will still need to make policy routing work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.