1

I have a Linux box with two NICs, each connected to a different LAN:

LAN A: 192.168.1.0 255.255.255.0
LAN B: 192.168.2.0 255.255.255.0

The routers are:

RouterA: 192.168.1.1
RouterB: 192.168.2.1

The wireless access points are:

WAP-B1: 192.168.2.3
WAP-B2: 192.168.2.4

Linux NICs are:

NIC A: 192.168.1.2 (eth0) default gateway 192.168.1.1, metric 100
NIC B: 192.168.2.2 (eth1) metric 101

Here's an ASCII diagram:

+-------+                                                           +-------+ 
| ISP A |                                                           | ISP B |
+-------+                                                           +-------+ 
    |                                                                   |
+---------+      +-------+      +-----------+      +-------+      +-----------+ 
| RouterA | <--> | LAN A | <--> | Linux Box | <--> | LAN B | <--> | RouterB-1 |
+---------+      +-------+      +-----------+      +-------+      +-----------+ 
                                                                    |        |
                                                            +--------+      +--------+
                                                            | WAP-B1 |      | WAP-B2 |
                                                            +--------+      +--------+ 

I want all Internet traffic to go through LAN A and ISP A. I only connect this Linux box to LAN B so I can perform administration on devices on LAN-B, particularly RouterB and WAP-B1, WAP-B2. Therefore, I want only addresses 192.168.2.0/24 to be routed through NIC B (eth1). I want all other traffic routed through NIC A. I do not want hosts in either LAN to be able to connect to each other (or ping each other, etc.). I want LAN A and LAN B to remain isolated.

I connected the network cables, and things seem to work. I assume the routing metrics were established by the order in which I connected the cables. However, I'd like to know the right way to set up routing rules to ensure I maintain a working configuration.

UPDATE: In response to a comment, here is the output of route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
0.0.0.0         192.168.2.1     0.0.0.0         UG    101    0        0 eth1
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     101    0        0 eth1

This is the routing table I would have guessed would be correct. (It's just a guess.)

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
192.168.2.0     192.168.2.1     255.255.255.0   UG    101    0        0 eth1
192.168.1.0     192.168.1.1     255.255.255.0   U     100    0        0 eth0

In NetworkManager > IPv4 > Routes, I checked "ignore automatically obtained routes" and I added this static route: 192.168.2.0, netmask: 255.255.255.0, gateway: 192.168.2.1, metric: 101

Here is the routing table that results from those changes.

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
192.168.2.0     192.168.2.1     255.255.255.0   UG    101    0        0 eth1
192.168.2.0     0.0.0.0         255.255.255.0   U     101    0        0 eth1
192.168.1.0     192.168.1.1     255.255.255.0   U     100    0        0 eth0

That doesn't look right to me, but today is the first day I have ever looked at routing tables.

UPDATE: I'm running Arch Linux and NetworkManager. However, I would prefer an answer based on commands like ip address and ip route.

UPDATE 2: Thanks to @vaha's answer, here is the desired routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     101    0        0 eth1

I have not figured out how to create a persistent configuration that assures this routing table upon a reboot.

However, I can establish those routes manually using these steps:

  1. In NetworkManager > IPv4 > Routes, check "ignore automatically obtained routes" for both interfaces.

  2. $ sudo ip route add default via 192.168.1.1 metric 100 dev eth0

  3. $ sudo ip route delete default via 192.168.2.1 dev eth1

Other variants on this, such as not checking "ignore automatically obtained routes" for eth0 have not worked. For example, when I only ignored automatically obtained routes for eth1, upon boot, my system used 192.168.2.1 as the default gw. That is an unexpected and confusing result.

My last question is how to configure my system so that these are the default routes after a reboot?

  • Can you share output of route command? – vaha Oct 14 '18 at 9:16
  • @vaha the question has been updated. Thanks for looking at it. – MountainX Oct 14 '18 at 19:35
  • 1
    You shouldn't be relying on the order in which the interfaces are brought up to decide which gateway will be used. Instead you should change the configuration for eth1 in such a way that no default route will be created when that interface is brought up. How to do that will depend on distribution. – kasperd Oct 14 '18 at 19:44
  • @MountainX I don't know how to configure NetworkManager on a server as I have only seen that used on client machines. When configured through the UI the setting to look for would be Ignore automatically obtained routes. – kasperd Oct 14 '18 at 20:48
  • @kasperd - I did choose that option. See bottom of my question. If you can give me an answer based on commands using just ip address and ip route I'll accept it. Thanks. – MountainX Oct 14 '18 at 21:35
2

Let's clear your concerns in two steps:

STEP 1

Therefore, I want only addresses 192.168.2.0/24 to be routed through NIC B (eth1). I want all other traffic routed through NIC A.

The default routing table (the table before you manually configured) provides the routing rules you are looking for.

Here is the detailed explanation:

192.168.2.0     0.0.0.0         255.255.255.0   U     101    0        0 eth1

says that the subnet 192.168.2.0/24 is a local network and there is no need for a gateway. Any packet targeting an address in that network will be delivered to destination directly without a hop.

192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0

says the same thing for the subnet 192.168.1.0/24.

0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
0.0.0.0         192.168.2.1     0.0.0.0         UG    101    0        0 eth1

says that the remaining traffic will be routed through eth0 and eth1 where the routing decision depends on metric values. Lower metric value has a higher priority. BUT if eth0 is down then all traffic will be routed through eth1 and vice versa. By the way, I'm not sure but my best guess for eth0 having a higher priority than eth1 is the alphabetical order of the interface names.

As conclusion, the following table is what you are looking for. I'm not familiar with NetworkManager but I think you can ignore automatically obtained routes for both interfaces and manually set your owns to achieve this routing table.

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     101    0        0 eth1

STEP 2

I do not want hosts in either LAN to be able to connect to each other (or ping each other, etc.). I want LAN A and LAN B to remain isolated.

Simply connecting your linux box to two different networks has no effect on their isolation unless there is a NAT rule defined on the box's firewall or the box's interfaces are bridged.

You can check NAT rules via iptables or nftables which are tools to manage firewall on Arch Linux. Also see Arch Linux wiki - Firewalls.

Example command to list NAT rules: iptables -t nat -L -v -n

No bridge is seen on your routing table but you can check bridges in details by using one of the ways described at Arch Linux wiki - Network bridge.

  • In NetworkManager > IPv4 > Routes, I checked "ignore automatically obtained routes" for both interfaces. Then I used these commands: $ sudo ip route add default via 192.168.1.1 metric 100 dev eth0 $ sudo ip route delete default via 192.168.2.1 dev eth1 The result is the routing table you recommended. How would I make this permanent (persistent across reboots)? – MountainX Oct 15 '18 at 1:12
  • @MountainX, there is a folder named /etc/network/if-up.d in Debian where you can put your custom scripts for networking, but don't know what the corresponding way for it in Arch Linux is. I recommend you searching for that. – vaha Oct 15 '18 at 9:59
  • @MountainX The automatically generated routing table entries for eth0 are already what you need, so there is no need to check Ignore automatically obtained routes on eth0. – kasperd Oct 15 '18 at 10:06
  • @kasperd I am still having to manually configure routing and I have not found out how to make it persistent. The automatically generated routing table entries are not correct. – MountainX Oct 18 '18 at 20:00
  • @vaha - I appreciate your answer. I accepted it and upvoted it. Your comment would have been more appreciated if you hadn't started it with a snarky "with a 5-sec search..." I'll respond to that part by saying that in your 5-sec search you apparently forgot that I am using NetworkManager, not dhcpcd (as mentioned in my question). Adding a static route for dhcpcd would do nothing for me. But I do appreciate your original answer, which was completely non-abrasive and very helpful. – MountainX Oct 19 '18 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.