I am trying to use shorewall on Arch to manage a setup with 2 local networks and 2 ISP connections. Ultimately I want traffic from local network 1 ( interface enp5s0) to use ISP 1 (76. ... interface enp6s0) and traffic from local 2 ( interface enp7s0) to use ISP 2 (99. ... interface enp3s0). Currently, I can make one or the other work, but not both, depending on which default route comes first:

output of `ip route ls` with sensitive information redacted:
default via 76.[rd].1 dev enp6s0  src 76.[rd].78  metric 203  mtu 576
default via 99.[rd].1 dev enp3s0  src 99.[rd].190  metric 205
76.[rd].0/24 dev enp6s0  proto kernel  scope link  src 76.[rd].78  metric 203  mtu 576
76.[rd].78 dev enp6s0  scope link  src 76.[rd].78 dev enp3s0  proto kernel  scope link  src 99.[rd].190  metric 205
99.[rd].190 dev enp3s0  scope link  src 99.[rd].190 dev enp7s0  proto kernel  scope link  src  metric 204 dev enp5s0  proto kernel  scope link  src  metric 202

With the above output, local 1 would be able to reach the outside, but local 2 would not. Vice-versa if the first line were gone. I'm pretty sure multiple default routes is a no-no, even with multiple ISPs, but this is how shorewall did it.

Since there was no example for this anywhere, I based it off of shorewall's three-interface example. To avoid making this post insanely long, here are links to pastes of each relevant shorewall configs:

Shorewall's pages on the matter are unhelpful because the goal in their example is very different from my goal. Any pointers in the right direction would be much appreciated.


Make sure you don't set the default gateway in the netctl files or in any other files. If using DHCP to get IP addresses make sure to disable getting the default gateway (dhcpcd -G). Running "ip route ls" should not show any default gateways. Only "ip route show table all" would list the default gateways for each ISP table. Something like this:

default via dev enp3s0  table ITC1  src dev enp3s0  table ITC1  scope link  src
default via dev enp4s0  table ITC2  src dev enp4s0  table ITC2  scope link  src
default via X.X.X.X dev enp5s0  table MPLS  src X.X.X.X
X.X.X.X dev enp5s0  table MPLS  scope link  src X.X.X.X
default  table balance
    nexthop via X.X.X.X  dev enp5s0 weight 1
    nexthop via  dev enp3s0 weight 2
    nexthop via  dev enp4s0 weight 2

Also you can remove the entries from the mangle file since rtrules entries should be enough for what you need

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.