The situation I'm in is where we have three separate interfaces on a particular machine. Each connected network only allows servers (by network-based routing/firewalling) to only offer particular services. Obviously, clients could be connecting from a wide variety of subnets and I'm relying on network firewalls for access controls on that.
The management interface allows ssh traffic, but in order for clients to be able to connect the default route must be set to the gateway on the management network. This resolves SSH but it breaks HTTP services which are only allowed over the Production interface. The third interface is a backup interface but all traffic for that one is on the same subnet.
The routing table looks something like this:
[root@xxxcpr2 ~]# ip route 10.19.1.0/24 dev eth0 proto kernel scope link src 10.19.1.10 10.18.29.0/24 dev eth1 proto kernel scope link src 10.18.29.25 192.168.5.0/24 dev eth2 proto kernel scope link src 192.168.5.35 default via 10.18.29.1 dev eth1
In the above, eth0 is the management interface, eth1 is the production interface, and eth2 is the backup interface.
Essentially, the condition I'm trying to get to is where the default gateway for any and all port 22 traffic is routed out the management interface but all other traffic outside a directly connected subnet should be routed out the production interface. Essentially, I'm 90% where I'm wanting to be, I just want to add an exception for SSH traffic.
I found this but I wasn't able to get it to work. Maybe it's my lack of understanding or some difference between RHEL and Ubuntu. Since the
main table's default gateway was already set to go out the production interface, what I did was:
# echo 1 > /proc/sys/net/ipv4/ip_forward # ip route add table 22 default via 10.19.1.1 # iptables -t mangle -A PREROUTING -p tcp --dport 22 -j MARK --set-mark 22 # ip rule add fwmark 22 table 22 # iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 10.18.29.25 # iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 10.19.1.10
To my way of thinking (maybe someone can point out how this is wrong) marking the packet and creating a rule to use table 22 should work (not sure why the original post mentioned
SNAT but I tried to copy it as best I could for completeness) but connections still time out unless I change the
main table's default route.
Basically, at this point I need someone to point out what I'm not understanding or that I'm overlooking.