2

I'm a newbie to IPtables, but am looking to do send traffic to a specific card based on the source. Here's what I would like:

eth0 - all traffic comes in on this NIC

Depending on the source IP, I want to direct traffic out to the Internet on either eth1 or eth2.

I've tried adding the following to the nat iptable but its not working.

iptables -t nat -A POSTROUTING -s 10.0.0.100 -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.0.200 -o eth2 -j MASQUERADE

What steps am I missing?

2
  • 1
    You should investigate policy based routing.
    – HBruijn
    Nov 7, 2014 at 20:00
  • thank you, thats exactly what I needed. Here's what I used to make this work:
    – Ryan
    Nov 7, 2014 at 20:28

2 Answers 2

2

I was able to make this work using Custom route tables

Create a custom route table: echo 2000 CustomTable >> /etc/iproute2/rt_tables

Add rule: ip rule add from 10.0.0.100 lookup CustomTable

Add route: ip route add default via 10.0.0.254 dev eth1 table CustomTable

This will send any traffic from 10.0.0.100 out on dev eth1

Keep in mind these settings will be lost on reboot or restart of the network services.

1

I'd be cautious, as IP was designed to route based on destination IP address, and you will be better off if you can make that happen. For instance, if what you really want is all traffic from a particular virtual server to be sent out a particular interface then use bridging instead.

That being said, you can use multiple routing tables along with routing rules. First you'll probably want to give names to the new tables you will create:

echo 2001 default-via-eth1 >> /dev/iproute2/rt_tables
echo 2002 default-via-eth2 >> /dev/iproute2/rt_tables

Then you need to create your special routing tables, which is easy -- just add the name of the table when you create the route (and 1.2.3.4 and 5.6.7.8 are examples -- use the right IP addresses of your gateways here):

ip route add default via 1.2.3.4 dev eth1 table default-via-eth1
ip route add default via 5.6.7.8 dev eth2 table default-via-eth2

And lastly, you link the two together with "rules":

ip rule add pref 30000 from 10.0.0.100 table default-via-eth1
ip rule add pref 30001 from 10.0.0.200 table default-via-eth2

You can see the rules that are in place with this command:

ip rule

You can see what is in a particular routing table with this command:

ip route show table via-eth1

CAUTION There are problems with this if you use a "containers" type of virtual server, like openvz or lxc, and it is because most programs are written using the "unspecified" IP address as the source address. Therefore the kernel must determine what source IP address to use, and it will pick it based on the route used. And I hope you can see the irony there -- the source address is based on the route which is based on the source address! What seems to happen is that the ip rules are ignored and it uses a built-in list of tables to find the route.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .