0

I have two interfaces with one that is a shared internet usb connection from my android phone.

  • enp0s31f6: ethernet internet connection (default)
  • enp0s20f0u1: shared connection android

I would like to use enp0s20f0u1 interface to access through ssh to only one IP. I mean, everything that will be connected to A.B.C.D (external/internet ip) have to go through this interface. Nothing else.

I am using Centos 7.

  • How can I route every packets that have A.B.C.D as destination IP to use enp0s20f0u1 interface ?

  • Do I need to use ip route or iptables is enough ? Why ?

I am pretty new in "ip routing", please give me explanation with your answer.

Details:

enp0s20f0u1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.42.174  netmask 255.255.255.0  broadcast 192.168.42.255

enp0s31f6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.128.1.21  netmask 255.255.254.0  broadcast 10.128.1.255

What I did:

$ip route:

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
default via 192.168.42.129 dev enp0s20f0u1  proto static  metric 101 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
10.136.80.66 via 10.128.0.1 dev enp0s31f6  proto dhcp  metric 100 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1

My interface's ip is 192.168.42.174 and the gateway for this interface is 192.168.42.129.

I removed the second line as dirkt said : default via 192.168.42.129 dev enp0s20f0u1 proto static metric 101

$ ip route

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
10.136.80.66 via 10.128.0.1 dev enp0s31f6  proto dhcp  metric 100 
A.B.C.D via 192.168.42.129 dev enp0s20f0u1 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1

I don't want to use this interface for anything else that ABCD. Should I remove

192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100

too ? I guess no, looks like it's for the LAN network of my interface.

I made a mistake, I use the interface's ip for the via instead of the gateway.

Everything is working well now. It's more clear.

Subsidiary question just for the understanding, if now I want to redirect only the port 22 and block everything else. I guess I need iptables/firewallD, to reject everything with ABCD as dest IP and to allow only the port 22.

2

Routing works by picking the most specific destination. That means you need

  • one route for the segment behind each interface
  • one default route (and not several)
  • one special route for your A.B.C.D ssh destination.

So the output of ip route should look like:

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.65  metric 100 
A.B.C.D/32 dev enp0s20f0u1  ...

To add the last one, do

ip route add A.B.C.D/32 dev enp0s20f0u1 via 192.168.42.129

where 192.168.42.129 is the current gateway (need not be constant).

Use

ip route del default via 192.168.42.129 dev enp0s20f0u1

to delete the second default route manually, if you want to make sure nothing else besides A.B.C.D and link local packets goes through this interface. The way it is configured now, if the first interface goes down for some reason, all traffic will use this interface.

In your output, you had a 10.136.80.66 that was added via DHCP. I don't know why this was added, but very likely the infrastructure needs it for some reason.

There are various way to automate this setup, that depends on how exactly your system is configured (network manager? /etc/network/interfaces?)

Using iptables to mark packets as suggested in the comment is a stupid idea, routing works directly without having to set marks. That's what routing is for.

Using a /24 netmask as suggested in one answer instead of a /32 netmask for A.B.C.D will route more than one destination address (actually, 256 of them), so don't do that either.

  • 1
    Thanks for catching my /24 silly error. – Celada Jun 12 '17 at 7:33
  • Thank you for the explanation. Nevertheless, I still get Destination Host Unreachable if I ping. I receive ARP request from the interface enp0s20f0u1 asking who has the ABCD ip. Do I need to configure the ARP ? but A.B.C.D is not a LAN ip... – Alexis_FR_JP Jun 12 '17 at 8:50
  • No, ARP won't help. Test if the shared android connection works at all: Remove default route for normal internet connection, add it for the android one. Does that work? And is the gateway address correct? Can you ping the gateway? – dirkt Jun 12 '17 at 8:55
  • Yes it's working if I unplug the other interface. I replied with the result of the ping. I can ping the gateway. Why does it think it's LAN ip.. – Alexis_FR_JP Jun 12 '17 at 9:12
  • To clarify: you can ping 137.74.192.36 with a default route, but you can't ping it with the specific route? And the metric for the specific route is already smaller? It should work. :-) Is there anything in the local table for some reason that overrides it? (It's difficult to debug this remotely, I really should sit in front of the machine ...) – dirkt Jun 12 '17 at 9:32
0

I would like to use enp0s20f0u1 interface to access through ssh to only one IP. I mean, everything that will be connected to A.B.C.D (external/internet ip) have to go through this interface. Nothing else.

This seems straightforward enough... You want to route traffic toward enp0s20f0u1 to a particular next hip interface, which is exactly the job of the routing table.

ip route A.B.C.D/32 192.168.42.xx

where xx is the last octet of the IP address of the next hop you want to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.