Questions tagged [policy-routing]

Policy-Based-Routing is a more complex form of the ordinary routing table

Filter by
Sorted by
Tagged with
1
vote
2answers
823 views

Why an iptables NAT does not happen in the network namespace separated transparent proxy setup?

I'm trying to setup transparent proxying networks on my host. Real Client and Proxy targets are containters but in this experiment I use netns (network namespace) separated envinroment. To redirect ...
0
votes
0answers
46 views

CGroup per application routing with iptables not working

Usage scenario: Shadowsocks Client ---> Shadowsocks Server (running on VPS A) ---> Wireguard VPN (running on VPS A) ---> Wireguard VPN (running on VPS B) Basically, I'm trying to setup an encrypted ...
1
vote
1answer
97 views

Rechability of different interfaces without having a route in a seperate routing table

We're currently trying to route all packets from our guest vlan's (eth1.251) subnet trough a wireguard tunnel into the internet. To accomplish this we're using policy based routing with a rule to use ...
1
vote
1answer
221 views

Response packet on the same interface as incoming in LAN

Currently, I'm struggling with the following scenario: I have a server with 2 interfaces in 2 separate LAN subnets. IF1, IF2 I have a laptop which has an IP address from the first subnet When I try ...
0
votes
0answers
52 views

Source policy-based routing to couple of sit tunnels. Works only first one

At Ubuntu Server 18.04 I want to have this behavior: curl -6 --interface 2001:470:e09f::3 ifconfig.co/ip 2001:470:e09f::3 curl -6 --interface 2001:470:c160::4 ifconfig.co/ip 2001:470:c160::4 But,...
1
vote
1answer
366 views

Ping does not work on TAP interfaces with bridge

I am trying to understand the linux bridging and local ip rules, I have following topology on my linux laptop. br0 ___________|__________ | | |tap0 ...
0
votes
1answer
130 views

OpenVPN gateway does not reply on IPv6 ping, but does forward package

I am trying to debug my IPv6 network and ran into an issue that I can't understand. I am using OpenVPN as my VPN server and here is a short diagram of the setup: All packages are dropped, when I try ...
0
votes
2answers
355 views

VPN client doesn't have internet connection

I'm using Ubuntu 18.04 LTS on AWS and I'm trying to setup split tunneling using commercial VPN (PIA). I'm unable to use their .opvn configuration out of the box because when I do so my SSH connection ...
0
votes
0answers
36 views

Source address selection on policy based source specific routing

I understand that if you do not explicitly select a source address with bind or sendmsg, the source address is determined by an explicit source address hint from the chosen route or otherwise the ...
1
vote
0answers
95 views

How to group interfaces for the purpose of using ip-rule's suppress_ifgroup feature?

I found out about ip-rule's "suppress_ifgroup X" feature which seems to allow me to tell the kernel to ignore a route from the given table with an outgoing interface that belongs to that group X. But ...
1
vote
2answers
62 views

Routing packets based on which port client is connected to

I have a debian server with one incoming interface (eth1) and three modems (modem1, modem2, modem3). There's an instance of squid on this server, listening on three consecutive ports (3128, 3129, 3130 ...
1
vote
0answers
42 views

Setting up openVpn as an interface rather than routing all traffic from paid vpn

I have subscribed to a VPN provider that's provides openVpn config files. Now instead of routing all traffic through this VPN, I would like to simply set it up as another interface where the ...
1
vote
0answers
109 views

Use iptables to load balance between multiple AWS elastic network interfaces

Environment: Amazon EC2 m4.4xlarge, running Amazon Linux 2 AMI 2.0 I would like to use iptables to load balance https requests between a set of elastic IPs that are assigned to multiple Amazon ...
0
votes
0answers
41 views

GCP VPN Policy: First IP range taking effect only

I'm currently having some issues with the GCP VPN tunnel, details as follow: We are currently adding a new transactional service to our internal API, this company requires a IPSEC VPN tunnel to ...
1
vote
1answer
168 views

Docker symmetric/policy-based routing

Background I have a debian server that has 3 network interfaces which are: eno1 (10.0.0.35/24) eno1.10 (10.0.10.65/24) eno1.40 (10.0.40.40/24) Between those interfaces is a firewall. The multiple ...
6
votes
1answer
989 views

ip rule and route doesn't get respected

I'm trying to route packets based on their source address, and have added the following: # ip rule add from 10.10.10.0/16 dev eth0 table foobar # ip route add default via 100.100.100.1 dev eth0 table ...
1
vote
1answer
486 views

Policy-based routing - neither rules nor routes get picked-up by CentOS 7.6.1810

I have 2 VLANs over a bonded connection I can't get to work with policy-based-routing. Actually I can make them work manually, but I'm unable to persist the configuration in order to survive reboots. ...
0
votes
1answer
271 views

Implementing Segment Routing Traffic Engineering (SR-TE) in IOS XR 6.3.1

I'm trying to deploy SR-TE on XRv9000 routers IOS XR 6.3.1 version which are deployed in AWS according to the topology below. I have accomplished the configuration of SR on all routers which is ...
0
votes
1answer
34 views

Policy based routing priority behaviour

I have a quick question regarding the behaviour of priority when using policy based routing. I'm running Ubuntu 18.04 (kernel is 4.15.0-1021-aws). I'm using this machine as a gateway to forward ...
0
votes
2answers
1k views

Kubernetes Calico: Networking policy to block connecting to the port 10250 on nodes

I have a Kubernetes cluster with Calico network overlay installed in it. How do I configure a network policy object to prevent pods connecting to the port 10250 (kubelet API) on the nodes? I have ...
0
votes
1answer
66 views

Routing issues while setting up OpenVPN chaining

I am trying to setup openvpn chaining in the following configuration. Laptop --> server1 --> server2 --> Internet The VPN links individually work between laptop and server1 and server1 and server2. ...
0
votes
2answers
697 views

multiple macvlan devices and policy based routing confusion

I have a server (ubuntu/debian) with two ISP connections. Both of these WAN connections have multiple public IP addresses. (big pipe)----eth0-->\ > server ---eth2--(...
0
votes
2answers
896 views

Does each custom routing table (w/default gateway) need a link scope route?

My Centos machine has a custom routing table foo_table containing just a default gateway route: # ip route add default via 10.0.2.1 table foo_table # ip route show table foo_table default via 10.0....
1
vote
1answer
533 views

linux IPv6 policy based routing fails

I have a VPN server that act as my IPv6 connection to the Internet. The setup us like this: I have been assigned a /48 address pool, that I want to subnet to my VPN clients. For argument sake lets ...
-1
votes
1answer
639 views

Iptables round-robin through multiple virtual network interfaces

I have a server with two main network interfaces and 5 virtual interfaces like this. eth0 - 192.168.1.1 eth1 - 192.168.3.1 eth1:2 192.168.3.3 eth1:3 192.168.3.4 eth1:4 192.168.3.5 eth1:5 192.168.3.6 ...
0
votes
0answers
330 views

Ubuntu 16.10: source based routing: packets are not redirected

I'm trying to configure source based routing on my ubuntu-machine. As simplest example I'm trying to configure the only one interface on my machine. All configuration taken from here: https://www....
1
vote
1answer
999 views

Different gateways for different IPs on same interface on Linux

I have the following question: considering the attached image: I have a server (RHEL 7) with 3 IP addresses (on the same physical interface): 192.168.10.1 (eth0, server address on network 192.168....
3
votes
0answers
266 views

avoid packets being treated as “martians”: is this thinking correct?

I have a cable connection with a Linux-based router. The router has two physical interfaces: enp1s0 (dhcp from cable provider) enp2s0 (192.168.1.1) with masquerading on enp1s0. then, I have an ...
6
votes
1answer
1k views

Multi-homed OpenBSD system: Policy based routing vs. mpath default routes

TL;DR Will OpenBSD policy based routing help with a multi-homed server/gateway situation? If so, how do I configure it? Long Form I'm managing an OpenBSD with two ISP links and VPN tunnels to ...
0
votes
2answers
3k views

Azure how to connect Route-Based VPN with Policy-Based one

I've got Policy-Based VNET that is connected to Cisco ASA - there is no way to make it Route-Based. I need all of my app deployment (Azure Web App, Azure Cloud Services) to be connectable only from ...
-2
votes
1answer
591 views

How to redirect specific outgoing packet from one physical interface to another one in Linux?

In the linux bridge br100 of 1 linux host, vnet0 is the interface connecting 1 internal linux VM. br100 is 1 linux bridge, which has 3 IP addresses: 10.11.13.1/24 is the GW of linux VM (the VM has ...
3
votes
0answers
893 views

policy routing for local outcoming connections

I have a multihomed setup with two upstream providers. And I want to confine some connections to use only one provider — local outgoing connections that is. So, I've made a custom routing table, which ...
0
votes
1answer
894 views

Except some IPs from rule to not allow internet through openwrt + openvpn when vpn is disconnected

I have the following working setup on my network: A. ISP-Router (connected to inet, internal ip 192.168.0.1 ) <----> B. eth0 - OpenWrt Router (OpenVPN client running) br-lan (bridge eth1 + wlan0, ...
-1
votes
1answer
90 views

Problems with routing

I have issue achieving this: A-->B-->C-->internet (doing A--C-->internet is working) A: client lan: 192.168.57.0/24 (example 192.168.57.50) B: ubuntu GW eth0: 172.10.0.1 (/24, default gw:172.10.0....
0
votes
2answers
327 views

Is this the proper way to utilize route-maps for intervlan routing?

screenshot of network map The network is pretty simple. Router-on-a-stick for nat/WAN access, Layer 3 switch for intervlan routing. Router: ip nat inside source list nated-nets interface ...
1
vote
2answers
4k views

PFSENSE: routing packets based on source IP address

I am trying to route packets (actually, trying to change DEFAULT GATEWAY) depending on source IP address with PFSENSE. ONE-SPECIFIC-IP ---> SPECIAL GATEWAY ANY-IP ---> DEFAULT GATEWAY ...
5
votes
1answer
320 views

Overcome asymmetric routing while migrating between sets of ISPs

We are migrating from one set of addresses to another set, both /24, and trying to minimize any down time during the migration. Ideally we'd run both for a period of time as we shut down the old ...
1
vote
0answers
955 views

overlapping subnets - how to give one precedence?

I have Linux devices with a single ethernet interface and two IP adresses. The first (eth0) is statically configured to 10.1.1.146/24. The second (eth0:1) is configured via DHCP and it may happen ...
0
votes
1answer
1k views

Pfsense multi site-to-site wan with policy based routing

We want to create a Hybrid multi WAN site to site connection between two (and more?) remote offices. The office has two WAN connections to the HQ. One MPLS and one ordinary Internet connection. In ...
7
votes
1answer
3k views

How do policy based routing tables actually work?

My understanding of Policy Based Routing in Linux is that there are three main components, the routing tables, the routes and the rules. I've followed many guides and in each of them this seems to be ...
1
vote
2answers
646 views

firewalld: match which zone by policy

I have the following zones that are relevant for this question. SemiTrusted and Public I want to treat IPSEC-encrypted traffic (that is coming from some specific IP addresses) as belonging to ...
0
votes
2answers
693 views

CentOS Multi Nic and Policy Routing?

I'm not familiar with CentOS and I need help doing the routing for this. I have a CentOS box with 3 NICs. eth0 Link encap:Ethernet inet addr:10.50.121.16 Bcast:10.50.121.255 Mask:...
1
vote
0answers
174 views

IP-rules don't seem to be working on CentOS-6.6

I faced a bit odd difficulty with policy-based routing on CentOS-6.6 server. I have a setup where I need to enroute all packets originated from 172.25.0.0/16 destinated to 172.24.0.0/16 and some XXX....
0
votes
1answer
132 views

Change source IP for specific target host

This is a follow up to this question of me. (Still on Debian 7.8) The problem isn't really IPSec related or anything, because I can't even ping the remote host with the "correct" source IP (through ...
2
votes
2answers
980 views

Use OpenVPN tun device for specific request

I have setup an OpenVPN connection with the route-nopull configuration. So now no special routes have been added to the client's configuration and only a TUN device is created, like so: tun0 ...
0
votes
1answer
103 views

Fortinet as intermediate router

I have the next scenario: FG1(LAN A) <--IPSEC--> FG2(LAN B) <--IPSEC--> FG3(LAN C) Basically I need that "LAN A" reach "LAN C" through FG2, I've tried with "router policy" and "router ...
3
votes
1answer
1k views

Change source IP address based on the system user

I would like to make a certain user have a specific source IP address. For this purpose, I added a secondary IP address to the network interface and tried to enforce the source IP using ip6tables and ...
0
votes
1answer
142 views

load balancing multiple connections over multiple links

As I understand it (based on the kernel docs) the setting of "arp_filter=1" necessitates the use of a source based routing policy to allow multiple interfaces to route traffic, potentially (but not ...
1
vote
2answers
832 views

Set default gateway based on protocol using pfSense

I have a pfSense configured with two Internet links for broadband load balancing. One of these links block outgoing traffic on 25 port (WAN1). I have a mail server (IP 10.6.9.2) that should use the ...
0
votes
0answers
1k views

puppetlabs/firewall nat policy issue

I'm using puppetlabs/firewall. I need to create following iptable rules: iptables -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 My manifests is firewall { '001 default ...