Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As a follow-up to this question which is still unresolved. I have two ADSL routers with different providers connected to different phone lines to the internet. As shown in the diagram. These routers have addresses 192.168.0.1 and 192.168.1.1 on my local network.

enter image description here

I want the computer on my home LAN with address 10.0.0.50 (and others) to be routed through the 192.168.1.1 gateway, and the computer with address 10.0.0.60 (and others) to be routed through the 192.168.0.1 gateway. I also want to let 10.0.0.50 to communicate with 10.0.0.60 (file sharing, remote desktop, etc)

I am using shorewall to configure iptables and squid as a transparent proxy. Is my configuration possible? How should I do it?

share|improve this question

3 Answers 3

Yes, it can be done. However, it is a relatively complex task. A router always needs to make a descision yielding one next hop at once. This mean you cannot have two default routes, that's what an internet uplink for computers mostly is. You need is called "policy routing". The idea is that you define multiple routing tables, which differ only in the default route. Then you define your router should use the one RT for home computers and the other RT for office machines.

You can find the most important instructions here.

First you set up two RTs. For convenience and documentation purposes, you should create 2 new lines in /etc/iproute2/rt_realms along these lines:

123 home
124 office

The numbers must be unused, i.e. not in the file already and should be below 256 (b/c I don't know what upper bound your kernel imposes on you).

Then you basically need to copy your main RT. You can show it with ip route show. Then you basically copy each route, once for your home table and once for your office table. For instance if there was a line

    192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1

the resulting statements were

ip route add 192.168.0.0/24 dev eth0 table home
ip route add 192.168.0.0/24 dev eth0 table office

Do that for each route of your router. When it comes to the default route, it literally says default on the screen, you only add the default route via 192.168.1.1 to table home and the default route via 192.168.0.1 to the table office.

Then you need to tell your route when to use which routing table

ip rule add from 10.0.0.50/32 table home
ip rule add from 10.0.0.60/32 table office

If you did some sensible subnetting you only need one rule for home and one for office. That's about it. You have 2 new routing tables now which are similar, except for their default route. Each table has exactly one default route, via one of your two routers. You have set up rules wich tell your CentOS router when it should look at which table, based on the origin of the packet to be forwarded. It should do exactly what you want ...

I forgot, I don't know what you use your proxy for, but you either create an individual proxy for each kind of machines (office vs. home) or all proxied traffic will use the same internet connection.

share|improve this answer
    
I've had an idea. I omitted the fact that the CentOS machine is a VM on an ESXi host. Perhaps I could create two virtual NICs one for home and one for office in the LAN. Would that make it easier for the routing part? I have never looked at routing tables before so it all looks a bit daunting to me. –  Mark Allison Aug 21 '13 at 8:53
1  
The additional NIC will make it more complicated. 1. it adds (at least) an entry to the RTs, 2. the home and office machines won't be able to interact directly anymore and therefore the CentOS machine must perform more routing. Just give all your office machines an IP address within 10.0.0.128/25 and all your home machines an IP address withing 10.0.0.0/25. DON'T ASSIGN THEM THAT SUBNETMASK, JUST USE IT IN YOUR HEAD to think up ip addresses. Then you can use this for the ip rules, but you won't make your network more complicated. –  user1129682 Aug 21 '13 at 9:11

It's certainly possible. Though I'd use a http://routerboard.com/RB751U-2HnD instead. Connect both to the DSL modems, configure the modems to work in bridge mode and the router as the pppoe client, and have it preferentially nat the traffic from various source IPs out through the preferred pppoe interface by marking the traffic and making default routes that operate on markings.

share|improve this answer
up vote 0 down vote accepted

I solved this my installing pfSense in a VM and using that as the default gateway. I set up some DHCP reservations and routed traffic according to IP. Easy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.