0

I have an ubuntu server I use to wget certain files from the internet via a VPN. I have set the VPN up using PPP0 and currently adjust the route like this:

 sudo route add default ppp0

Everything is working fine with the vpn connection, but now I would like to route FTP traffic via eth0 and not the VPN.

I tried

  sudo route add default eth0

for the period I was using FTP but lost the internet connection until

   ifdown eth0 ifup eth0

was called.

Clearly I am doing something wrong.

Ideal solution would be to always route all FTP via eth0 if that is easy, if not then what should I add to my bash script to route the traffic back to eth0 while the FTP upload completes (at which point I can go back to route add default ppp0).

Improve this question
2

What you want is called Policy Based Routing. Google will return you lots of information on this topic, and it is too complicated to answer completely in a ServerFault answer post.

The 10,000 foot view is that you:

  1. Create additional routing tables in the kernel.
  2. Configure each routing table to use a different default route (one for your normal connection, one for your VPN).
  3. Using iptables, identify and mark every packet according to your rules/policy.
  4. Assign the marks you used in step 3 to tell the kernel which routing table to use for each packet.

The very basic commands to achieve this:

echo 200 novpn >> /etc/iproute2/rt_tables
ip route add table 200 default via 192.0.2.1
iptables -t mangle -I OUTPUT -p tcp --dport 21 -d server.example.com -j MARK --set-mark 200
ip rule add fwmark 200 table novpn

Replace 192.0.2.1 with your default router on your local network.

Improve this answer
  • @andy NB. that it is complicated because "routing" and "FTP" exist at different networking layers ( en.wikipedia.org/wiki/OSI_model#Description_of_OSI_layers ). Being picky, fukawi2's example does not 'route FTP', it routes 'TCP traffic to server.example.com on TCP port 21, regardless of whether it is FTP or not', and it will ignore FTP traffic to other sites and other ports. Sometimes this doesn't matter, sometimes it does. – TessellatingHeckler Feb 25 '15 at 4:46
  • 1
    Good clarification @TessellatingHeckler -- a perfect example of why this is far too complicated a topic to explain fully in a SF post ;) – fukawi2 Feb 25 '15 at 4:48
  • Note that active FTP does not stay on Port 21 for very long. I'm not familiar with iptables so I don't know if it is smart enough to know to "expand" the rule to cover the new ports after the port negotiations. – Mark Henderson Feb 25 '15 at 5:17
  • @MarkHenderson Good point. iptables can mark the connection (rather than individual packets), and then the related connection type can maintain the PBR for the additional connection. But none of that is covered in my answer and requires further reading. – fukawi2 Feb 25 '15 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.