In a Linux system, which acts as a gateway on my lan, I would like to route traffic based on source IP addresses.
I have 2 network cards and one of these cards has 2 different default gateways.
I know I can only have one default gateway on one system, and that route selection is based on the destination address.
I would like to make sure that the pc with ip 192.168.3.5 can access and be reachable through the gateway 172.16.62.254
Behind eth0 there is a vpn that allows me to access the internet
The setting of the network interfaces is :
DEVICE=eth0
TYPE=Ethernet
IPADDR=172.16.61.2
PREFIX=24
IPADDR2=172.16.61.3
PREFIX2=24
GATEWAY=172.16.61.1
DEVICE=eth0:1
TYPE=Ethernet
DEFROUTE=no
IPADDR=172.16.62.100
PREFIX=24
#GATEWAY=172.16.62.254
DEVICE=eth1
TYPE=Ethernet
IPADDR=192.168.3.1
NETMASK=255.255.255.0
The routing table is:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
172.16.62.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.16.61.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 172.16.61.1 0.0.0.0 UG 0 0 0 eth0
The ip addresses of the two gateways are:
172.16.61.1
172.16.62.254
The pc with IP address 192.168.3.2 must reach GW 172.16.61.1,
the pc with IP address 192.168.3.5 must reach GW 172.16.62.254
To allow access to the 2 gateways, I perform a translation of ip addresses via iptables :
iptables -t nat -A POSTROUTING -s 192.168.3.2 -j SNAT --to-source 172.16.61.3
and viceversa
iptables -t nat -A PREROUTING -d 172.16.61.3 -j DNAT --to-destination 192.168.3.2
The idea to route packets through gateway 172.16.62.254 is to use iptables to mark packets whose source ip address is 192.168.3.5 or 172.16.62.100 and then route them using iproute2 for which I performed the following steps:
In /etc/iproute2/rt_tables I have added the line
200 route254I have marked the packets with:
iptables -t mangle -A OUTPUT -s 192.168.3.5 -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -s 172.16.62.100 -j MARK --set-mark 0x1I have configured routing with:
ip route add default via 172.16.62.254 dev eth0:1 table route254
ip route add 172.16.62.0/24 dev eth0:1 src 172.16.62.100 table route254
ip rule add from 172.16.62.100/32 table route254
ip rule add to 172.16.62.100/32 table route254
ip rule add prio 199 fwmark 0x1 lookup route254
What I got is that the reachability to the pc with address 192.168.3.2 works, the pc is reachable from the outside, while the pc with address 192.168.3.5 is not.
The output of tcpdump in the case of the pc with address 192.168.3.2 is
18:38:31.317553 IP x.x.x.x.45053 > 172.16.61.3.ftp: S 3190836796:3190836796(0) win 5840 <mss 1380,sackOK,timestamp 2834368503 0,nop,wscale 7>
18:38:31.317832 IP x.x.x.x.45053 > 192.168.3.2.ftp: S 3190836796:3190836796(0) win 5840 <mss 1380,sackOK,timestamp 2834368503 0,nop,wscale 7>
18:38:31.317732 IP 192.168.3.2.ftp > x.x.x.x.45053: S 1998545683:1998545683(0) ack 3190836797 win 28960 <mss 1460,sackOK,timestamp 1123125 2834368503,nop,wscale 7>
18:38:31.317778 IP 172.16.61.3.ftp > x.x.x.x.45053: S 1998545683:1998545683(0) ack 3190836797 win 28960 <mss 1460,sackOK,timestamp 1123125 2834368503,nop,wscale 7>
18:38:31.368562 IP x.x.x.x.45053 > 172.16.61.3.ftp: . ack 1 win 46 <nop,nop,timestamp 2834368531 1123125>
18:38:31.368580 IP x.x.x.x.45053 > 192.168.3.2.ftp: . ack 1 win 46 <nop,nop,timestamp 2834368531 1123125>
18:38:33.257206 IP x.x.x.x.45053 > 172.16.61.3.ftp: P 1:3(2) ack 1 win 46 <nop,nop,timestamp 2834370444 1123125>
The output of tcpdump in the case of the pc with address 192.168.3.5 is
12:49:04.047809 IP x.x.x.x.60804 > 172.16.62.100.ftp: S 790746700:790746700(0) win 5840 <mss 1380,sackOK,timestamp 2986198269 0,nop,wscale 7>
12:49:04.048069 IP x.x.x.x.60804 > 192.168.3.5.ftp: S 790746700:790746700(0) win 5840 <mss 1380,sackOK,timestamp 2986198269 0,nop,wscale 7>
12:49:04.047884 IP 192.168.3.5.ftp > x.x.x.x.60804: S 3787612501:3787612501(0) ack 790746701 win 28960 <mss 1460,sackOK,timestamp 922143 2986198269,nop,wscale 7>
12:49:04.047909 IP 172.16.62.100.ftp > x.x.x.x.60804: S 3787612501:3787612501(0) ack 790746701 win 28960 <mss 1460,sackOK,timestamp 922143 2986198269,nop,wscale 7>
12:49:05.448336 IP 192.168.3.5.ftp > x.x.x.x.60804: S 3787612501:3787612501(0) ack 790746701 win 28960 <mss 1460,sackOK,timestamp 923544 2986198269,nop,wscale 7>
12:49:05.448351 IP 172.16.62.100.ftp > x.x.x.x.60804: S 3787612501:3787612501(0) ack 790746701 win 28960 <mss 1460,sackOK,timestamp 923544 2986198269,nop,wscale 7>
12:49:07.048100 IP x.x.x.x.60804 > 172.16.62.100.ftp: S 790746700:790746700(0) win 5840 <mss 1380,sackOK,timestamp 2986201269 0,nop,wscale 7>
12:49:07.048128 IP x.x.x.x.60804 > 192.168.3.5.ftp: S 790746700:790746700(0) win 5840 <mss 1380,sackOK,timestamp 2986201269 0,nop,wscale 7>
In order to check if the packages were actually marked I used :
iptables -A INPUT -m mark ! --mark 0 -m limit --limit 8/min --limit-burst 12 -j LOG --log-prefix "IPTables-Marks: "
but I have no entry in the log file
How can i allow the pc with ip address 192.168.3.5 to access and be reachable through the gateway 172.16.62.254 ?
