I'm currently setting up an Ubuntu 12.04 with 2 net interfaces. eth0 is on LAN_USERS (192.168.5.0/24) intended for user and eth1 is on LAN_INFRA (10.0.4.0) intended for management. Additionally, I've setup a bridge on eth1.
auto eth0 iface eth0 inet static address 192.168.5.180 netmask 255.255.255.0 network 192.168.5.0 broadcast 192.168.5.255 gateway 192.168.5.1 auto eth1 iface eth1 inet manual auto br1 iface br1 inet static address 10.0.4.5 netmask 255.255.255.0 network 10.0.4.0 broadcast 10.0.4.255 gateway 10.0.4.1 bridge_ports eth1 bridge_stp on bridge_fd 0 bridge_waitport 0
- As of Ubuntu 12.04, reverse path filtering is enabled (rp_filter=1)
- The output of
# route -nis:
Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.5.1 0.0.0.0 UG 100 0 0 eth0 10.0.4.0 0.0.0.0 255.255.255.0 U 0 0 0 br1 192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Because of reverse path filtering, br1 isn't visible to networks other than 10.0.4.0. I could disable reverse path filtering, but I decided to setup policy based routing.
Policy based Routing
echo "250 infra >> /etc/iproute2/rt_tables
ip rule add iif br1 table infra
ip route add to default dev br1 table infra
- Kernel conf vars: CONFIG_IP_ADVANCED_ROUTER=y and CONFIG_IP_MULTIPLE_TABLES=y
- net.ipv4.ip_forward = 0
- net.ipv4.conf.eth1.rp_filter = 1
- net.ipv4.conf.br1.rp_filter = 1
- net.ipv4.conf.all.log_martians = 1
And it's not working....
How can i debug my PBR rules? Any obvious mistakes with my setup?
UPDATE: What I need is to route answers to packets coming from br1 back out via br1 again and not eth0. My simplest use case is: pings from 192.168.5.10 to 10.0.4.5 do not return cause of the default route and rp_filter=1. They are dropped as martian packets.