Questions tagged [policy-routing]
Policy-Based-Routing is a more complex form of the ordinary routing table
91
questions
0
votes
0
answers
16
views
packet goes up input chain instead of being forwarded
I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
- 21
2
votes
1
answer
172
views
Why is Linux policy-based routing (PBR) not working for ping?
First of all, it seems as if this question is about Linux, but it seems to me that it is about basic routing concepts.
I happen to have the following configuration:
What I am trying to do is to ...
- 21
0
votes
0
answers
81
views
With iptables, is it possible to route only certain domains?
I'm routing specific devices through a separate gateway device that connects to a Tailscale VPN exit node.
I'm using this command so my device can act as NAT router to Tailscale:
sudo iptables -t nat -...
- 133
0
votes
1
answer
632
views
How to route a reply packet to the device it coming from?
I have an ipip tunnel, I want all the reply packets coming from ipip device also going through ipip. I have tried the following iptables rules
sysctl -w net.ipv4.ip_forward=1
ip rule add fwmark 1 ...
1
vote
1
answer
901
views
WireGuard policy-based routing
This question is about configuring a WireGuard relay that routes all its peer's traffic to another WireGuard server, but the relay itself does not use that WireGuard server as the default gateway.
I ...
- 23
1
vote
0
answers
309
views
DHCP pushed route to custom table on Linux
Is there a way I can direct routes that I receive from DHCP to a specific routing table depending on what interface it was received on?
E.g. eth0 and eth1 are both configured by DHCP. I would like the ...
- 11
0
votes
0
answers
289
views
Linux Gateway Policy Routing and TCP MSS Issue(maybe)?
I have an Ubuntu 20 machine as an internet gateway with two WANs ens160 and ens192. I switch the default route on the gateway like ip r re 0/0 dev160(or ens192) and the clients on the LAN access the ...
- 689
0
votes
1
answer
74
views
How to deal with DNS requests when using multiple OpenVPN connection and policy based route?
I have 2 subnets in my local network (192.168.4.0/24, 192.168.5.0/24), but only 1 gateway server (192.168.4.223) which has 2 OpenVPN connections (10.100.2.6/24, 10.100.3.6/24). The topology is like:
...
- 1
1
vote
1
answer
389
views
Where does the configuration for routing rules come from on boot?
I am on RHEL7 with NetworkManager disabled and no additional legacy scripts installed.
Meaning, that I still use:
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/sysconfig/network-scripts/route-eth0
/...
- 13
2
votes
1
answer
4k
views
Wireguard use one client as gateway of another
I have a Wireguard VPN setup that basically looks like this:
P1 ---- S ---- P2 --- Internet
IP addreses:
P1 = 10.200.1.5
S = 10.200.1.1
P2 = 10.200.1.3
I am redirecting all traffic of P1 to S by ...
- 177
0
votes
0
answers
1k
views
EdgeRouter Policy Based Routing not working for second LAN
I have an EdgeRouter ER-8 with the following setup: 3 WANs (eth0 is ISP1, eth1 is ISP2, eth2 is a wireless link to another campus with its own ISP, and it is used to access the remote LAN and as a ...
- 241
1
vote
0
answers
152
views
How to whitelist egress traffic with a NetworkPolicy that doesn't prevent Apache Ignite from starting up?
I have some more or less complex microservice architecture, where Apache Ignite is used as a stateless database / cache. The Ignite Pod is the only Pod in its Namespace and the architecture has to ...
- 131
1
vote
0
answers
340
views
Mac OS built-in VPN client Routing Table issues (Cisco IPSEC)
I have a Macbook Big Sur 11.5.2 and I’ve spent now quite some on this particular issue but I cannot figure it out. I need some help from people that are more expert than me on the matter.
Background ...
- 41
1
vote
2
answers
3k
views
Multiple wireguard tunnels to same server how to force different interfaces
I have multiple wan links on my router and I'd want a wireguard tunnel on each wan interface to the same server.
I started different working tunnels to the server using different destination ports, ...
- 133
0
votes
1
answer
203
views
Diagnosing a Linux routing issue: multiple external IPs and several internal subnets with multiple routing tables
This is my first post on stack exchange. First, I'd like to thank this community for over my computer engineering journey I have learned many things here. :)
With this post I am mainly looking for ...
4
votes
2
answers
2k
views
Ubuntu 18.04 policy based routing: netplan does not populate routing table
I have 2 network interfaces - 1 connected to internal network and 1 connected to external network, both interfaces acquire their IP from DHCP.
By default traffic goes through internal network and ...
- 41
0
votes
0
answers
54
views
VPN client IP masking
at our company we are facing a particular routing problem, for which I have found many related questions and answers for parts, but not for the whole.
This is the scenario:
our office has a fixed IP ...
- 101
3
votes
2
answers
3k
views
Why an iptables NAT does not happen in the network namespace separated transparent proxy setup?
I'm trying to setup transparent proxying networks on my host.
Real Client and Proxy targets are containters but in this experiment
I use netns (network namespace) separated envinroment.
To redirect ...
- 133
2
votes
1
answer
416
views
Rechability of different interfaces without having a route in a seperate routing table
We're currently trying to route all packets from our guest vlan's (eth1.251) subnet trough a wireguard tunnel into the internet. To accomplish this we're using policy based routing with a rule to use ...
- 145
2
votes
1
answer
8k
views
Response packet on the same interface as incoming in LAN
Currently, I'm struggling with the following scenario:
I have a server with 2 interfaces in 2 separate LAN subnets. IF1, IF2
I have a laptop which has an IP address from the first subnet
When I try ...
- 151
1
vote
1
answer
5k
views
Ping does not work on TAP interfaces with bridge
I am trying to understand the linux bridging and local ip rules,
I have following topology on my linux laptop.
br0
___________|__________
| |
|tap0 ...
- 113
0
votes
1
answer
348
views
OpenVPN gateway does not reply on IPv6 ping, but does forward package
I am trying to debug my IPv6 network and ran into an issue that I can't understand.
I am using OpenVPN as my VPN server and here is a short diagram of the setup:
All packages are dropped, when I try ...
1
vote
2
answers
2k
views
VPN client doesn't have internet connection
I'm using Ubuntu 18.04 LTS on AWS and I'm trying to setup split tunneling using commercial VPN (PIA).
I'm unable to use their .opvn configuration out of the box because when I do so my SSH connection ...
- 41
3
votes
1
answer
725
views
How to group interfaces for the purpose of using ip-rule's suppress_ifgroup feature?
I found out about ip-rule's "suppress_ifgroup X" feature which seems to allow me to tell the kernel to ignore a route from the given table with an outgoing interface that belongs to that group X. But ...
- 131
1
vote
2
answers
716
views
Routing packets based on which port client is connected to
I have a debian server with one incoming interface (eth1) and three modems (modem1, modem2, modem3). There's an instance of squid on this server, listening on three consecutive ports (3128, 3129, 3130 ...
- 11
1
vote
0
answers
169
views
Setting up openVpn as an interface rather than routing all traffic from paid vpn
I have subscribed to a VPN provider that's provides openVpn config files.
Now instead of routing all traffic through this VPN, I would like to simply set it up as another interface where the ...
- 111
1
vote
0
answers
529
views
Use iptables to load balance between multiple AWS elastic network interfaces
Environment: Amazon EC2 m4.4xlarge, running Amazon Linux 2 AMI 2.0
I would like to use iptables to load balance https requests between a set of elastic IPs that are assigned to multiple Amazon ...
1
vote
1
answer
2k
views
Docker symmetric/policy-based routing
Background
I have a debian server that has 3 network interfaces which are:
eno1 (10.0.0.35/24)
eno1.10 (10.0.10.65/24)
eno1.40 (10.0.40.40/24)
Between those interfaces is a firewall. The multiple ...
- 13
8
votes
1
answer
5k
views
ip rule and route doesn't get respected
I'm trying to route packets based on their source address, and have added the following:
# ip rule add from 10.10.10.0/16 dev eth0 table foobar
# ip route add default via 100.100.100.1 dev eth0 table ...
- 409
1
vote
1
answer
2k
views
Policy-based routing - neither rules nor routes get picked-up by CentOS 7.6.1810
I have 2 VLANs over a bonded connection I can't get to work with policy-based-routing. Actually I can make them work manually, but I'm unable to persist the configuration in order to survive reboots. ...
- 125
0
votes
1
answer
659
views
Implementing Segment Routing Traffic Engineering (SR-TE) in IOS XR 6.3.1
I'm trying to deploy SR-TE on XRv9000 routers IOS XR 6.3.1 version which are deployed in AWS according to the topology below.
I have accomplished the configuration of SR on all routers which is ...
- 139
0
votes
1
answer
198
views
Policy based routing priority behaviour
I have a quick question regarding the behaviour of priority when using policy based routing. I'm running Ubuntu 18.04 (kernel is 4.15.0-1021-aws).
I'm using this machine as a gateway to forward ...
- 201
0
votes
2
answers
2k
views
Kubernetes Calico: Networking policy to block connecting to the port 10250 on nodes
I have a Kubernetes cluster with Calico network overlay installed in it. How do I configure a network policy object to prevent pods connecting to the port 10250 (kubelet API) on the nodes? I have ...
- 220
0
votes
1
answer
84
views
Routing issues while setting up OpenVPN chaining
I am trying to setup openvpn chaining in the following configuration.
Laptop --> server1 --> server2 --> Internet
The VPN links individually work between laptop and server1 and server1 and server2. ...
- 125
0
votes
2
answers
1k
views
multiple macvlan devices and policy based routing confusion
I have a server (ubuntu/debian) with two ISP connections. Both of these WAN connections have multiple public IP addresses.
(big pipe)----eth0-->\
> server ---eth2--(...
0
votes
2
answers
2k
views
Does each custom routing table (w/default gateway) need a link scope route?
My Centos machine has a custom routing table foo_table containing just a default gateway route:
# ip route add default via 10.0.2.1 table foo_table
# ip route show table foo_table
default via 10.0....
- 103
2
votes
1
answer
1k
views
linux IPv6 policy based routing fails
I have a VPN server that act as my IPv6 connection to the Internet. The setup us like this:
I have been assigned a /48 address pool, that I want to subnet to my VPN clients. For argument sake lets ...
-1
votes
1
answer
1k
views
Iptables round-robin through multiple virtual network interfaces
I have a server with two main network interfaces and 5 virtual interfaces like this.
eth0 - 192.168.1.1
eth1 - 192.168.3.1
eth1:2 192.168.3.3
eth1:3 192.168.3.4
eth1:4 192.168.3.5
eth1:5 192.168.3.6
...
- 101
0
votes
0
answers
511
views
Ubuntu 16.10: source based routing: packets are not redirected
I'm trying to configure source based routing on my ubuntu-machine.
As simplest example I'm trying to configure the only one interface on my machine.
All configuration taken from here: https://www....
- 11
1
vote
1
answer
2k
views
Different gateways for different IPs on same interface on Linux
I have the following question:
considering the attached image:
I have a server (RHEL 7) with 3 IP addresses (on the same physical interface):
192.168.10.1 (eth0, server address on network 192.168....
- 150
3
votes
0
answers
584
views
avoid packets being treated as "martians": is this thinking correct?
I have a cable connection with a Linux-based router. The router has two physical interfaces:
enp1s0 (dhcp from cable provider)
enp2s0 (192.168.1.1)
with masquerading on enp1s0. then, I have an ...
- 176
7
votes
1
answer
2k
views
Multi-homed OpenBSD system: Policy based routing vs. mpath default routes
TL;DR Will OpenBSD policy based routing help with a multi-homed server/gateway situation? If so, how do I configure it?
Long Form
I'm managing an OpenBSD with two ISP links and VPN tunnels to ...
- 807
0
votes
2
answers
4k
views
Azure how to connect Route-Based VPN with Policy-Based one
I've got Policy-Based VNET that is connected to Cisco ASA - there is no way to make it Route-Based.
I need all of my app deployment (Azure Web App, Azure Cloud Services) to be connectable only from ...
- 3
-2
votes
1
answer
913
views
How to redirect specific outgoing packet from one physical interface to another one in Linux?
In the linux bridge br100 of 1 linux host, vnet0 is the interface connecting 1 internal linux VM.
br100 is 1 linux bridge, which has 3 IP addresses:
10.11.13.1/24 is the GW of linux VM (the VM has ...
- 31
3
votes
0
answers
2k
views
policy routing for local outcoming connections
I have a multihomed setup with two upstream providers. And I want to confine some connections to use only one provider — local outgoing connections that is. So, I've made a custom routing table, which ...
0
votes
1
answer
1k
views
Except some IPs from rule to not allow internet through openwrt + openvpn when vpn is disconnected
I have the following working setup on my network:
A. ISP-Router (connected to inet, internal ip 192.168.0.1 ) <----> B. eth0 - OpenWrt Router (OpenVPN client running) br-lan (bridge eth1 + wlan0, ...
- 121
-1
votes
1
answer
100
views
Problems with routing
I have issue achieving this: A-->B-->C-->internet (doing A--C-->internet is working)
A: client lan: 192.168.57.0/24 (example 192.168.57.50)
B: ubuntu GW eth0: 172.10.0.1 (/24, default gw:172.10.0....
0
votes
2
answers
596
views
Is this the proper way to utilize route-maps for intervlan routing?
screenshot of network map
The network is pretty simple. Router-on-a-stick for nat/WAN access, Layer 3 switch for intervlan routing.
Router:
ip nat inside source list nated-nets interface ...
- 385
1
vote
2
answers
6k
views
PFSENSE: routing packets based on source IP address
I am trying to route packets (actually, trying to change DEFAULT GATEWAY) depending on source IP address with PFSENSE.
ONE-SPECIFIC-IP ---> SPECIAL GATEWAY
ANY-IP ---> DEFAULT GATEWAY
...
- 1,134
5
votes
1
answer
401
views
Overcome asymmetric routing while migrating between sets of ISPs
We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
- 51