Basically trying to bend bridging and NATing to my will with quite a unique project.

I've simplified what I'm doing below (VM=Kali virtual machine for testing):

Zones are network namespaces, vexxx's are virtual links created with ip link

ZoneX's are network namespaces, vexxx's are virtual links created with ip link

The premise is to create a gateway for the LAN which can divert traffic (based on what it is) to either ZoneX or ZoneY modify the traffic and forward it to ZoneZ and finally out to the real networks gateway.

I've tried quite a few different things, however the main problem is either from creating a layer2 storm... not nice in VM's... or the NAT net namespace (ZoneZ) forwards the return traffic via the first interface in the NAT table for the client VM (which is sometimes incorrect).

The main aim is to split the traffic to multiple zones but have the return traffic take the same route back, thats the clincher! The next stage is then to be able to chain multiple Zones together to modify the traffic in multiple ways.

*** EDIT

A connection example would be a DNS lookup to and an TCP request to, both from the VM.

Firstly the DNS request passes to eth0 over brA to ve001, to ZoneA where the packet is marked (using iptables) and passed to ve003 > ve004 etc. to ve006 where it is NAT'd and sent out to the internet. When the response returns to ZoneZ (the NAT zone) the lookup in the NAT table is done and the packet is routed to ve006 because the ARP entry for the VM machine points to that interface. The main trouble comes when I have other traffic I want to forward via the bottom route. Same as before until ZoneA, however this time it is routed down to ve007, through ZoneY and finally into ZoneZ, its then passed over the NAT gw and onto the internet. However, when a reply is received for this connection the packets go to ZoneZ the lookup is done in the NAT table, its translated and then the ARP table lookup is done, this is when it forwards it back via ve006 which is wrong, I want it to go back the way it came (in this case via ve010).

I guess my question should be, can I get the NAT table to record the interface it was presented from and forward it back via that?

  • What is lan.number, a VLAN ID? What do you mean by "the first interface in the NAT table"? You could give an example for such a connection and the resulting problem. Between what is the layer2 storm? – Hauke Laging Jan 10 '15 at 14:32
  • Sorry, I knew it was going to be a confusing! lan.number was just to indicate the IP address assigned to that interface. And the first interface on the NAT table referred to the first route found for that destination in the routing table. I.e. it doesn't take into account the interface it was received from (in this case either ve006 or ve010). – geekscrap Jan 12 '15 at 15:12
  • lan.51 appears twice, for ZoneX and ZoneY. Is that a typo? – Hauke Laging Jan 13 '15 at 5:28
  • No that was on purpose... Basically I wanted to make the route identical on both sides for testing – geekscrap Jan 14 '15 at 15:18

The solution is to mark new connections and use the mark for policy routing:

iptables -t mangle -A FORWARD -i ve006 -m connmark -j CONNMARK --set-mark  6
iptables -t mangle -A FORWARD -i ve010 -m connmark -j CONNMARK --set-mark 10

ip rule has a test for fwmark. Thus you create a routing table for ve006 and one for ve010.

ip route add default table ve006 via a.b.c.51 dev ve006
# .51 again, typo?
ip route add default table ve010 via a.b.c.51 dev ve010

ip rule add pref 100 iif ve998 fwmark  6 table ve006
ip rule add pref 101 iif ve998 fwmark 10 table ve010

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.