Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following simple situation: two internet connections via two distinct ethernet NICs, eth0 and eth1, and two APs (I use hostapd, of course) on two distinct wireless cards, wlan0 and wlan1. The two wifi cards have different subnets (,, and the two ethernet cards are on different subnets (,

I would like to keep forwarding completely separate, in other words:

   wlan0 --> eth0
   wlan1 --> eth1

I know how to bind applications to different interfaces, and how to use policy routing. What I do not know is whether I can use iptables to forward as above, or I absolutely need to use Policy Routing to achieve this.

share|improve this question
up vote 3 down vote accepted

You need policy routing.

Ordinary routing will choose the next-hop address or interface based on the destination address and nothing else. That is, all packets to the same address will use the same route.

Once you use other factors like the inbound interface to influence the routing decision, you are by definition performing policy routing.

netfilter/iptables do have an addon providing a "ROUTE" target to do PBR with netfilter alone, but its adoption, maintenance and testing are poor relative to the typical iproute2 rule-based approach. As even the netfilter maintainers say there,

"Whenever possible, you should use the MARK target together with iproute2 instead of this [iptables] ROUTE target."

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.