How to add ip route to route traffic through interface when destination is also that interface

Question

I have been testing keepalived and preparing to roll out on my vps.

My setup is:

(...)
2: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel  state UP group default qlen 1000
    link/ether ab:cd:ef:ab:cd:ef brd ff:ff:ff:ff:ff:ff
    inet xxx.xxx.xxx.xxx/24 brd xxx.xxx.xxx.xxx scope global ens4
       valid_lft forever preferred_lft forever
    inet 192.168.1.2/24 scope global ens4:1
       valid_lft forever preferred_lft forever
    inet 192.168.1.3/24 scope global secondary ens4:2
       valid_lft forever preferred_lft forever

192.168.1.2 is the private IP address "looking" into private network (assigned by my hosting provider) 192.168.1.3 is the floating IP, also on private network (assigned by my hosting provider)

I have a separate host, 192.168.1.99, which I would like to route traffic through my floating IP. So on keepalived, when host is becoming master, I am adding those routes:

ip route add 192.168.1.3/32 via 192.168.1.3 dev ens4 src 192.168.1.3
ip route add 192.168.1.99/32 via 192.168.1.3 dev ens4 src 192.168.1.3

And everything works great, when I ping 192.168.1.99 and running tcp dump on that host I can see traffic is being routed correctly.

My problem is that I'm running postgresql on that host with floating IP which I would like to be only available through 192.168.1.3 (not even through 127.0.0.1). And it works great as long as database is accessed from the outside. When I try to make connection from 192.168.1.3 via 192.168.1.3 I get an error:

FATAL:  no pg_hba.conf entry for host "192.168.1.2", user "postgres", database "postgres", SSL off

This tells me that my routing is not working when exercising it from the keepalived host itself.

I'm wondering how do I modify my routing so traffic goes through 192.168.1.3 even when originating from that same host.

Answer 1

You have access deny error which means that the routing works well.

Routing doesn't change source or destination ip addresses in ip packets. Use firewall to disallow access to postgres database on 192.168.1.2 ip address. When postgress client connect to your server's 192.168.1.3 ip address it use first ip address 192.168.1.2 on server's interface. This address doesn't allowed in pg_hba.conf config file.

Also this network scenario isn't good because postgres and other software will answer from first ip address (which are in one network) on ens4 interface.

You don't need to add such routing rules, because all ip address in them are in one network 192.168.1.0/24.