Suppose I have a small network, with a number of VLANs as follows:




VLAN routing is taken care of by the core switch, the switch doesn't do policy based routing (Dell PowerConnect 6224F), so it will only take a default route for all other traffic that falls outside of the VLANs above. (i.e.

Now suppose I have two internet connections, each with a NAT DSL modem on VLAN1 (say and, and I want devices on VLAN2 to use one internet connection and devices on VLAN3 to use the other, I was thinking of using a Linux box to achieve this.

Say I configure a Linux box (, and configure the default gateway on the core switch to point to, is it then possible to configure IPTables on the Linux box to do what I need?

Most how-to guides for setting up a Linux based router have two two network interfaces as a requirement, but I don't think this is needed in this scenario as this Linux box will simply sit on the same VLAN as the DSL modems. (plus I don't currently have any spare NICs to put in the server I have), so my question is, (assuming it is possible) can anyone provide me with some guidance to create some IP tables rules to take care of this?

I might also in the future like all HTTP connections to be transparently proxied, ideally via a shared squid instance, but still routing requests down the appropriate DSL connection.


I've no need to route between VLANs, as the core switch is already doing this fine. I'm perhaps not getting the terminology right, but if I configure the default route for on the core switch to be, can I configure the Linux box to redirect packets down the correct DSL gateway, depending upon the source of the packet?

An example of what I'm trying to achieve...

PC on VLAN3 ( sends a packet to The default gateway on the PC is (i.e. the routing interface on VLAN3), the switch then routes this packet via to (the switch is configured to use this IP as the next hop for The Linux box then routes/redirects that packet via the DSL modem, because the source IP was within VLAN 3 ( Had the packet have originated from, then the Linux box would route/redirect via

                      VLAN 1
                   ( (DSL1) ------+
                         | (DSL2) ------+
                         | (Linux) ------+
   VLAN 2  -------| Core Switch |-------  VLAN 3
(     +-------------+      (

Further Edit:

I guess I've not explained very well what I'm trying to achieve here, but please bear with me a bit here, as I'm not a network guru (just in case you haven't already detected this!).

I don't want to create multiple interfaces on the linux box, as I don't want it doing any routing between VLANs, I just want the box to sit on one of the VLANs (single interface) and forward (or route?) packets via DSL1 or DSL2, depending upon the source of the packet. If is the default route for on our network, surely this can be done?

  • A vLan interface in Linux is (simplified for practicality) a NIC and can be used like any other. What you're proposing could work, but why are the private side of the DSL routers on their own vLan? Why not just put them directly on the vLan that is going to be routing traffic over that connection? – Chris S May 4 '11 at 13:22
  • I don't want the Linux box to route between VLANs, the switch does a good enough job of that already. I've simplified the setup here for clarity. In reality, we will have many VLANs using one connection, and 4 VLANs sharing another. This is a requirement that we can't avoid for various reasons. – Bryan May 4 '11 at 13:24
  • Is there a reason why your edge router can't/isn't setup for multi-WAN? – gravyface May 4 '11 at 13:37
  • 2
    Please ... don't use VLAN 1 – Zypher May 4 '11 at 23:05
  • +1 for don't use VLAN1, which incidentally, I'm not. I was just using arbitrary numbers to try to illustrate the point – Bryan May 5 '11 at 6:08

What you're proposing is certainly possible, infact it's a very common network configuration to have a layer 3 switch doing the bulk of your internal routing and providing some basic access controls then offloading more complicated traffic to the edge/core.

Your Linux edge router will need to be aware of all the subnets behind the switch - you can do this with static routes, eg:

route add -net gw <switch IP>

Or the Dell switch (from a quick google) supports RIP and OSPF, so you could get it to advertise it's routes to the Linux box automatically if you used Quagga or similar to pick up the advertisements.

Your clients will only need to be configured with their default gateway (the switch interface on their VLAN) and have appropriate ACLs in place on the switch to allow their traffic out to the edge.

Unfortunately I've not done PBR on Linux so can't give you any magic rules and can only really point at an article Google found - looks relevant though. Don't get too hung up on the multiple interface thing though, it's easy to make one interface into multiple on Linux by either creating aliases (ifconfig eth0:25 <ipaddr>) or VLANs (ifconfig eth0.25 <ipaddr>).


I think you could create additional network addresses for your network card - one for each VLAN and then use route to create static routes.


For most purposes each vlan interface on the Linux box will work like a "real" interface, so when you read the tutorials, just mentally substitute "eth0" with "eth0.123" and "eth1" with "eth0.456".

I'd recommend you disable all the routing stuff in the switch. That seems like it'll just cause confusion and complexity.

As someone else was commenting, I agree with the recommendation not to use VLAN 1 for "real traffic". Using another VLAN ID (there are plenty ...) makes it clearer that the port has been explicitly and deliberately configured.

  • I don't want to create multiple interfaces on the Linux box, nor do I want to disable routing on the switch. I just want to set up packet forwarding/routing on the linux box to direct traffic down the correct internet gateway depending upon the source of the packet. – Bryan May 5 '11 at 6:09
  • The hardware I'm going to be using is an old piece of kit that was decommissioned a while ago. I expect it to fail sooner rather than later. When it does, I don't want my entire network collapsing as a result. If I lose off site connectivity for a while, that won't be a problem, but losing routing between VLANs will effectively shutdown our business until we recover. - This is a proof of concept for now, if it works, I will be purchasing some new hardware for the job. – Bryan May 5 '11 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.