Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've got a Linux webserver with 192.168.0.2/24 assigned to eth0 and 172.16.0.2/24 assigned to eth1. I must not change this. Here's the routing so far:

172.16.0.0/24 dev eth1 proto kernel scope link src 172.16.0.2
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.2
172.16.0.0/16 via 172.16.0.1 dev eth1
default via 192.168.0.1 dev eth0

The default route leads to the Internet which the machine needs access to for downloading stuff. Now there are also packets (requests) coming in from the Internet via 172.16.0.254. How do I have to set up routing tables and rules in order to answer those requests? iptables is not possible here.

Update: Seems like this works, but it doesn't look elegant to me:

ip r a 172.16.0.0/24 dev eth1 table 10
ip r a 172.16.0.0/16 via 10.16.0.1 t 10
ip r a default via 172.16.0.254 t 10
ip rule add from 172.16.0.2 t 10
share|improve this question
    
What doesn't look elegant about it? You create a second table, and select it based on source address. –  derobert Jan 4 '13 at 18:43
    
I would also add selection according to specified output interface (e.g. ip rule add oif eth1 t 10). –  BatchyX Feb 3 '13 at 20:35
add comment

1 Answer

I think you can't.

When applications (web servers) reply, these are new packets for the kernel and it will just follow a routing table. You can't have multiple default gateways and choose one depending on what interface a packet arrived that triggered the application to send this response.

Please, just use one default gateway. Don't do NAT on multiple subnets like this. Your network design is faulty here. Really.

And if you do, then don't expect that port forwarding can do magic here.

share|improve this answer
    
"You can't have multiple default gateways and choose one depending on what interface a packet arrived that triggered the application to send this response." Sure you can. Linux routing can consider source address. And even without that, if OP didn't have the "no iptables" restriction, connection tracking lets you do it. And this isn't necessarily a faulty network design, depends on what the restrictions are that led to it. –  derobert Jan 4 '13 at 18:25
    
@ downvoter: instead of downvoting, please post an answer. –  gertvdijk Feb 3 '13 at 21:32
    
@gertvdijk: The solution is in the question already. –  BatchyX Feb 10 '13 at 21:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.