Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route interface, the reply is sent back through the default route interface. Is there a way to use iptables (or something else) to track the connection and send the reply back through the interface it came from?

share|improve this question
up vote 26 down vote accepted
echo 200 isp2 >> /etc/iproute2/rt_tables
ip rule add from <interface_IP> dev ppp0 table isp2
ip route add default via <gateway_IP> dev ppp0 table isp2

The above doesn't require any packet marking with ipfilter. It works because the outgoing (reply) packets will have the IP address that was originally used to connect to the 2nd interface as the source (from) address on the outgoing packet.

share|improve this answer
Wow, this is exactly what I was looking for. In case anyone is looking, for RH-based distros, you can put the relevant rule and route commands in files named 'rule-eth0' or 'route-eth0' (for example) which will be added or removed on ifup/ifdown. Place these files alongside the ifcfg-eth0 file. For IPv6, there is 'route6-eth0' functionality built in, but no 'rule6-eth0' built in (yet). – Kyle Brantley Dec 30 '11 at 3:58
For me it worked only when I left out the dev param in the ip rule command, so running ip rule add from <interface_IP> table isp2 – cdauth Dec 13 '15 at 17:09
You can make these be created when the interface goes up by adding up ip rule add from <interface_IP> table isp2 and up ip route add default via <gateway_IP> dev ppp0 table isp2 to your /etc/network/interfaces under the relevant interface. – g.rocket Apr 5 at 4:59

The following commands create an alternate routing table via eth1 for packets that have the mark 1 (except packets to localhost). The ip command is from the iproute2 suite (Ubuntu: iproute Install iproute, iproute-doc Install iproute-doc).

ip rule add fwmark 1 table 1
ip route add table 1 dev lo
ip route add table 1 dev eth1

The other half of the job is recognizing packets that must get the mark 1; then use iptables -t mangle -A OUTPUT … -j MARK --set-mark 1 on these packets to have them routed through routing table 1. I think the following should do it (replace by the address of the non-default-route interface):

iptables -t mangle -A OUTPUT -m conntrack --ctorigdst -j MARK --set-mark 1

I'm not sure if that's enough, maybe another rule is needed on the incoming packets to tell the conntrack module to track them.

share|improve this answer
Nice. I forgot all about marking. That should get me there. – Shawn J. Goff Nov 30 '10 at 2:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.