Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've been trying for almost a week to make it work but without success. I'm starting to feel hopeless.

I have 4 Ethernet adapters :

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 30:85:a9:ad:54:1e brd ff:ff:ff:ff:ff:ff
    inet 10.100.36.2/29 brd 10.100.36.7 scope global eth0
    inet6 fe80::3285:a9ff:fead:541e/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether a0:f3:c1:04:64:40 brd ff:ff:ff:ff:ff:ff
    inet 69.70.164.242/30 brd 69.70.164.243 scope global eth1
    inet6 fe80::a2f3:c1ff:fe04:6440/64 scope link
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether a0:f3:c1:04:a0:2f brd ff:ff:ff:ff:ff:ff
    inet 10.45.13.1/24 brd 10.45.13.255 scope global eth2
    inet6 fe80::a2f3:c1ff:fe04:a02f/64 scope link
       valid_lft forever preferred_lft forever
5: eth3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 28:10:7b:c9:58:76 brd ff:ff:ff:ff:ff:ff
    inet 10.45.15.1/24 brd 10.45.15.255 scope global eth3
    inet6 fe80::2a10:7bff:fec9:5876/64 scope link
       valid_lft forever preferred_lft forever

This is the default route my linux server (Debian) give me at startup :

69.70.164.240/30 dev eth1  proto kernel  scope link  src 69.70.164.242
10.100.36.0/29 dev eth0  proto kernel  scope link  src 10.100.36.2
10.45.15.0/24 dev eth3  proto kernel  scope link  src 10.45.15.1
10.45.13.0/24 dev eth2  proto kernel  scope link  src 10.45.13.1
default via 10.45.15.254 dev eth3
default via 10.45.13.254 dev eth2
default via 69.70.164.241 dev eth1
default via 10.100.36.1 dev eth0

Here's what I want to do. eth0 is my VDSL line and eth1 is my cable line. I want to:

  • Forward all traffic from 10.45.13.0 (eth2) to the gateway 10.100.36.1 (eth0)
  • Forward all traffic from 10.45.15.0 (eth3) to the gateway 69.70.164.241 (eth1)

If I make this work, I would be happy enough but I would also like to make 10.45.13.0 invisible from 10.45.15.0 and vice-versa.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You can only have one default route ... per routing table. So at first you need to remove all default routes but one. The one route you would like your debian server to use.

For your other stuff, what you want is called "source routing", which means you perform different routing, based on the origin (source) of the currently handled packet.

This is an example for actually precicely what you want to do with source routing. Your question is formulated a little bit wobbly, so I will assume you want your debian server to use your VDSL line as well.

This means you want to remove all default routes from your routing table, but the one via eth0. Your main/locat RT should look like this then:

69.70.164.240/30 dev eth1  proto kernel  scope link  src 69.70.164.242
10.100.36.0/29 dev eth0  proto kernel  scope link  src 10.100.36.2
10.45.15.0/24 dev eth3  proto kernel  scope link  src 10.45.15.1
10.45.13.0/24 dev eth2  proto kernel  scope link  src 10.45.13.1
default via 10.100.36.1 dev eth0

Then you create another routing table following the linked example. You probably rather want to call that table UseCable instead of John. So you could go

echo 200 UseCable >> /etc/iproute2/rt_tables

And then you tell your kernel to use that table when packet originate from 10.45.13.0 like this:

ip rule add from 10.45.15.0 table UseCable

Then you need to populate UseCable. The following is a start:

ip route add 10.45.15.0/24 dev eth3 table UseCable
ip route add 69.70.164.240/30 dev eth1 table UseCable
ip route add default via 69.70.164.241 table UseCable #that's the default route via cable

Well, then you are done in terms of routing. I think you want NAT as well. So you need something along the lines of

#for everything from eth3 leaving through eth1
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE 

#for everything from eth2 leaving through eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 

Done. It is not the most clean of ways but communication between 10.45.13.0/24 and 10.45.15.0/24 is not possible because when originating from 10.45.15.0/24 the routing table does not contain an entry for 10.45.13.0/24.

I leave the refinement as an exercise for you.

share|improve this answer
    
Thanks you for your answer. It's a bit more clear to me now. Yes, VDSL line is the default used by the server, you are right. I will try this today. When you say "remove all default route", I do ip route del X where X is all my route except eth0. After, I add my rule to the table and I do the NAT using iptables ? –  David Bélanger May 14 '13 at 12:54
    
you need to specify the whole "default via xxx" for route del. –  Bananguin May 14 '13 at 13:01
    
Ok. I only have 10.100.36.0/29 dev eth0 proto kernel scope link src 10.100.36.2 and default via 10.100.36.1 dev eth0 in my main table. I also have the UseCable you made me do. I added the command to iptables (I removed -I because you cannot use -I with POSTROUTING). However, it doesn't work yet. I am trying other stuff from what you gave me now. –  David Bélanger May 14 '13 at 13:19
    
When I try to ping from my client machine (either 45.13 or 15.15), my client is unable to ping. –  David Bélanger May 14 '13 at 13:30
    
I edited my answer to include the RTs you need. You were supposed to only delete all DEFAULT routes but one. Not all the routes. –  Bananguin May 14 '13 at 15:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.