Questions tagged [policy-routing]

Policy-Based-Routing is a more complex form of the ordinary routing table

Filter by
Sorted by
Tagged with
1
vote
1answer
212 views

Multiple wireguard tunnels to same server how to force different interfaces

I have multiple wan links on my router and I'd want a wireguard tunnel on each wan interface to the same server. I started different working tunnels to the server using different destination ports, ...
0
votes
0answers
19 views

Rule for policy based routing not applying

My ISP doesn't give me a static public IP, so I've setup an openvpn connection to get one on my homeserver, and that is working fine for services running directly there. I'd also like to have a few ...
0
votes
1answer
49 views

Diagnosing a Linux routing issue: multiple external IPs and several internal subnets with multiple routing tables

This is my first post on stack exchange. First, I'd like to thank this community for over my computer engineering journey I have learned many things here. :) With this post I am mainly looking for ...
0
votes
0answers
529 views

Ubuntu 18.04 policy based routing: netplan does not populate routing table

I have 2 network interfaces - 1 connected to internal network and 1 connected to external network, both interfaces acquire their IP from DHCP. By default traffic goes through internal network and ...
0
votes
0answers
33 views

VPN client IP masking

at our company we are facing a particular routing problem, for which I have found many related questions and answers for parts, but not for the whole. This is the scenario: our office has a fixed IP ...
2
votes
2answers
1k views

Why an iptables NAT does not happen in the network namespace separated transparent proxy setup?

I'm trying to setup transparent proxying networks on my host. Real Client and Proxy targets are containters but in this experiment I use netns (network namespace) separated envinroment. To redirect ...
1
vote
1answer
124 views

Rechability of different interfaces without having a route in a seperate routing table

We're currently trying to route all packets from our guest vlan's (eth1.251) subnet trough a wireguard tunnel into the internet. To accomplish this we're using policy based routing with a rule to use ...
1
vote
1answer
2k views

Response packet on the same interface as incoming in LAN

Currently, I'm struggling with the following scenario: I have a server with 2 interfaces in 2 separate LAN subnets. IF1, IF2 I have a laptop which has an IP address from the first subnet When I try ...
2
votes
1answer
2k views

Ping does not work on TAP interfaces with bridge

I am trying to understand the linux bridging and local ip rules, I have following topology on my linux laptop. br0 ___________|__________ | | |tap0 ...
0
votes
1answer
172 views

OpenVPN gateway does not reply on IPv6 ping, but does forward package

I am trying to debug my IPv6 network and ran into an issue that I can't understand. I am using OpenVPN as my VPN server and here is a short diagram of the setup: All packages are dropped, when I try ...
0
votes
2answers
712 views

VPN client doesn't have internet connection

I'm using Ubuntu 18.04 LTS on AWS and I'm trying to setup split tunneling using commercial VPN (PIA). I'm unable to use their .opvn configuration out of the box because when I do so my SSH connection ...
1
vote
0answers
239 views

How to group interfaces for the purpose of using ip-rule's suppress_ifgroup feature?

I found out about ip-rule's "suppress_ifgroup X" feature which seems to allow me to tell the kernel to ignore a route from the given table with an outgoing interface that belongs to that group X. But ...
1
vote
2answers
190 views

Routing packets based on which port client is connected to

I have a debian server with one incoming interface (eth1) and three modems (modem1, modem2, modem3). There's an instance of squid on this server, listening on three consecutive ports (3128, 3129, 3130 ...
1
vote
0answers
88 views

Setting up openVpn as an interface rather than routing all traffic from paid vpn

I have subscribed to a VPN provider that's provides openVpn config files. Now instead of routing all traffic through this VPN, I would like to simply set it up as another interface where the ...
1
vote
0answers
254 views

Use iptables to load balance between multiple AWS elastic network interfaces

Environment: Amazon EC2 m4.4xlarge, running Amazon Linux 2 AMI 2.0 I would like to use iptables to load balance https requests between a set of elastic IPs that are assigned to multiple Amazon ...
1
vote
1answer
652 views

Docker symmetric/policy-based routing

Background I have a debian server that has 3 network interfaces which are: eno1 (10.0.0.35/24) eno1.10 (10.0.10.65/24) eno1.40 (10.0.40.40/24) Between those interfaces is a firewall. The multiple ...
6
votes
1answer
2k views

ip rule and route doesn't get respected

I'm trying to route packets based on their source address, and have added the following: # ip rule add from 10.10.10.0/16 dev eth0 table foobar # ip route add default via 100.100.100.1 dev eth0 table ...
1
vote
1answer
1k views

Policy-based routing - neither rules nor routes get picked-up by CentOS 7.6.1810

I have 2 VLANs over a bonded connection I can't get to work with policy-based-routing. Actually I can make them work manually, but I'm unable to persist the configuration in order to survive reboots. ...
0
votes
1answer
395 views

Implementing Segment Routing Traffic Engineering (SR-TE) in IOS XR 6.3.1

I'm trying to deploy SR-TE on XRv9000 routers IOS XR 6.3.1 version which are deployed in AWS according to the topology below. I have accomplished the configuration of SR on all routers which is ...
0
votes
1answer
50 views

Policy based routing priority behaviour

I have a quick question regarding the behaviour of priority when using policy based routing. I'm running Ubuntu 18.04 (kernel is 4.15.0-1021-aws). I'm using this machine as a gateway to forward ...
0
votes
2answers
1k views

Kubernetes Calico: Networking policy to block connecting to the port 10250 on nodes

I have a Kubernetes cluster with Calico network overlay installed in it. How do I configure a network policy object to prevent pods connecting to the port 10250 (kubelet API) on the nodes? I have ...
0
votes
1answer
71 views

Routing issues while setting up OpenVPN chaining

I am trying to setup openvpn chaining in the following configuration. Laptop --> server1 --> server2 --> Internet The VPN links individually work between laptop and server1 and server1 and server2. ...
0
votes
2answers
871 views

multiple macvlan devices and policy based routing confusion

I have a server (ubuntu/debian) with two ISP connections. Both of these WAN connections have multiple public IP addresses. (big pipe)----eth0-->\ > server ---eth2--(...
0
votes
2answers
1k views

Does each custom routing table (w/default gateway) need a link scope route?

My Centos machine has a custom routing table foo_table containing just a default gateway route: # ip route add default via 10.0.2.1 table foo_table # ip route show table foo_table default via 10.0....
1
vote
1answer
745 views

linux IPv6 policy based routing fails

I have a VPN server that act as my IPv6 connection to the Internet. The setup us like this: I have been assigned a /48 address pool, that I want to subnet to my VPN clients. For argument sake lets ...
-1
votes
1answer
908 views

Iptables round-robin through multiple virtual network interfaces

I have a server with two main network interfaces and 5 virtual interfaces like this. eth0 - 192.168.1.1 eth1 - 192.168.3.1 eth1:2 192.168.3.3 eth1:3 192.168.3.4 eth1:4 192.168.3.5 eth1:5 192.168.3.6 ...
0
votes
0answers
370 views

Ubuntu 16.10: source based routing: packets are not redirected

I'm trying to configure source based routing on my ubuntu-machine. As simplest example I'm trying to configure the only one interface on my machine. All configuration taken from here: https://www....
1
vote
1answer
1k views

Different gateways for different IPs on same interface on Linux

I have the following question: considering the attached image: I have a server (RHEL 7) with 3 IP addresses (on the same physical interface): 192.168.10.1 (eth0, server address on network 192.168....
3
votes
0answers
343 views

avoid packets being treated as “martians”: is this thinking correct?

I have a cable connection with a Linux-based router. The router has two physical interfaces: enp1s0 (dhcp from cable provider) enp2s0 (192.168.1.1) with masquerading on enp1s0. then, I have an ...
6
votes
1answer
1k views

Multi-homed OpenBSD system: Policy based routing vs. mpath default routes

TL;DR Will OpenBSD policy based routing help with a multi-homed server/gateway situation? If so, how do I configure it? Long Form I'm managing an OpenBSD with two ISP links and VPN tunnels to ...
0
votes
2answers
3k views

Azure how to connect Route-Based VPN with Policy-Based one

I've got Policy-Based VNET that is connected to Cisco ASA - there is no way to make it Route-Based. I need all of my app deployment (Azure Web App, Azure Cloud Services) to be connectable only from ...
-2
votes
1answer
670 views

How to redirect specific outgoing packet from one physical interface to another one in Linux?

In the linux bridge br100 of 1 linux host, vnet0 is the interface connecting 1 internal linux VM. br100 is 1 linux bridge, which has 3 IP addresses: 10.11.13.1/24 is the GW of linux VM (the VM has ...
3
votes
0answers
1k views

policy routing for local outcoming connections

I have a multihomed setup with two upstream providers. And I want to confine some connections to use only one provider — local outgoing connections that is. So, I've made a custom routing table, which ...
0
votes
1answer
952 views

Except some IPs from rule to not allow internet through openwrt + openvpn when vpn is disconnected

I have the following working setup on my network: A. ISP-Router (connected to inet, internal ip 192.168.0.1 ) <----> B. eth0 - OpenWrt Router (OpenVPN client running) br-lan (bridge eth1 + wlan0, ...
-1
votes
1answer
93 views

Problems with routing

I have issue achieving this: A-->B-->C-->internet (doing A--C-->internet is working) A: client lan: 192.168.57.0/24 (example 192.168.57.50) B: ubuntu GW eth0: 172.10.0.1 (/24, default gw:172.10.0....
0
votes
2answers
368 views

Is this the proper way to utilize route-maps for intervlan routing?

screenshot of network map The network is pretty simple. Router-on-a-stick for nat/WAN access, Layer 3 switch for intervlan routing. Router: ip nat inside source list nated-nets interface ...
1
vote
2answers
5k views

PFSENSE: routing packets based on source IP address

I am trying to route packets (actually, trying to change DEFAULT GATEWAY) depending on source IP address with PFSENSE. ONE-SPECIFIC-IP ---> SPECIAL GATEWAY ANY-IP ---> DEFAULT GATEWAY ...
5
votes
1answer
361 views

Overcome asymmetric routing while migrating between sets of ISPs

We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
1
vote
0answers
1k views

overlapping subnets - how to give one precedence?

I have Linux devices with a single ethernet interface and two IP adresses. The first (eth0) is statically configured to 10.1.1.146/24. The second (eth0:1) is configured via DHCP and it may happen ...
0
votes
1answer
2k views

Pfsense multi site-to-site wan with policy based routing

We want to create a Hybrid multi WAN site to site connection between two (and more?) remote offices. The office has two WAN connections to the HQ. One MPLS and one ordinary Internet connection. In ...
7
votes
1answer
3k views

How do policy based routing tables actually work?

My understanding of Policy Based Routing in Linux is that there are three main components, the routing tables, the routes and the rules. I've followed many guides and in each of them this seems to be ...
1
vote
2answers
772 views

firewalld: match which zone by policy

I have the following zones that are relevant for this question. SemiTrusted and Public I want to treat IPSEC-encrypted traffic (that is coming from some specific IP addresses) as belonging to ...
0
votes
2answers
732 views

CentOS Multi Nic and Policy Routing?

I'm not familiar with CentOS and I need help doing the routing for this. I have a CentOS box with 3 NICs. eth0 Link encap:Ethernet inet addr:10.50.121.16 Bcast:10.50.121.255 Mask:...
1
vote
0answers
176 views

IP-rules don't seem to be working on CentOS-6.6

I faced a bit odd difficulty with policy-based routing on CentOS-6.6 server. I have a setup where I need to enroute all packets originated from 172.25.0.0/16 destinated to 172.24.0.0/16 and some XXX....
0
votes
1answer
132 views

Change source IP for specific target host

This is a follow up to this question of me. (Still on Debian 7.8) The problem isn't really IPSec related or anything, because I can't even ping the remote host with the "correct" source IP (...
2
votes
2answers
1k views

Use OpenVPN tun device for specific request

I have setup an OpenVPN connection with the route-nopull configuration. So now no special routes have been added to the client's configuration and only a TUN device is created, like so: tun0 ...
0
votes
1answer
103 views

Fortinet as intermediate router

I have the next scenario: FG1(LAN A) <--IPSEC--> FG2(LAN B) <--IPSEC--> FG3(LAN C) Basically I need that "LAN A" reach "LAN C" through FG2, I've tried with "router policy" and "router ...
3
votes
1answer
1k views

Change source IP address based on the system user

I would like to make a certain user have a specific source IP address. For this purpose, I added a secondary IP address to the network interface and tried to enforce the source IP using ip6tables and ...
0
votes
1answer
150 views

load balancing multiple connections over multiple links

As I understand it (based on the kernel docs) the setting of "arp_filter=1" necessitates the use of a source based routing policy to allow multiple interfaces to route traffic, potentially (but not ...
1
vote
2answers
930 views

Set default gateway based on protocol using pfSense

I have a pfSense configured with two Internet links for broadband load balancing. One of these links block outgoing traffic on 25 port (WAN1). I have a mail server (IP 10.6.9.2) that should use the ...