Category Archives: Non classé

iproute2 multiple gateway

Workstation has ip 172.16.11.12 and gateway 172.16.11.254

Linux router has 4 nics with the following IP:
172.16.11.254 eth1
172.16.22.254 eth2
100.64.0.254 eth3
195.101.99.99 eth0
The default gw to reach internet is 195.101.99.99
Internet can also be reache through 100.64.0.254

All the traffic coming to the linux router uses the default gw 195.101.99.99 eth0 to reach internet.

Now we want to make an exception for workstation 172.16.11.12.
Instead of using 195.101.99.99 eth0 to go on internet we want to use now 100.64.0.254 eth3.

Add routing table 4G with priority 200:

echo 200 4G >> /etc/iproute2/rt_tables

Specify routes in this table, next hop of interface 100.64.0.254 wich is 100.64.0.1

ip route add 172.16.11.0/24 dev eth1 table 4G
ip route add 172.16.22.0/24 dev eth2 table 4G
ip route add default via 100.64.0.1 table 4G

Now specify the client (here 172.16.11.12) that will use these settings:

ip rule add from 172.16.11.12 table 4G

iptables FORWARD with and without NAT

Simple forward from network 192.168.0.0/24 to network 172.16.0.0/24. GW 192.168.0.1 and 172.16.0.1

iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -d 172.16.0.0/24 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -s 172.16.0.0/24 -d 192.168.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT

On the gateway tcpdump will show:

05:58:48.316239 IP 192.168.0.22 > 172.16.0.33: ICMP echo request, id 1, seq 2193, length 40
05:58:48.349553 IP 172.16.0.33 > 192.168.0.22: ICMP echo reply, id 1, seq 2193, length 40

Forward from network 192.168.0.0/24 to network 172.16.0.0/2 and source nating:

iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -d 172.16.0.0/24 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -s 172.16.0.0/24 -d 192.168.0.0/42 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -d 172.16.0.0/2 -j MASQUERADE

On the gateway tcpdump will show:

05:58:48.316239 IP 172.16.0.1 > 172.16.0.33: ICMP echo request, id 1, seq 2193, length 40
05:58:48.349553 IP 172.16.0.33 > 172.16.0.1: ICMP echo reply, id 1, seq 2193, length 40