How to use a specific interface for a particular destination ip?

Question

I have two interfaces with one that is a shared internet usb connection from my android phone.

• enp0s31f6: ethernet internet connection (default)
• enp0s20f0u1: shared connection android

I would like to use enp0s20f0u1 interface to access through ssh to only one IP. I mean, everything that will be connected to A.B.C.D (external/internet ip) have to go through this interface. Nothing else.

I am using Centos 7.

• How can I route every packets that have A.B.C.D as destination IP to use enp0s20f0u1 interface ?

• Do I need to use ip route or iptables is enough ? Why ?

I am pretty new in "ip routing", please give me explanation with your answer.

Details:

enp0s20f0u1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.42.174  netmask 255.255.255.0  broadcast 192.168.42.255

enp0s31f6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.128.1.21  netmask 255.255.254.0  broadcast 10.128.1.255

What I did:

$ip route:

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
default via 192.168.42.129 dev enp0s20f0u1  proto static  metric 101 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
10.136.80.66 via 10.128.0.1 dev enp0s31f6  proto dhcp  metric 100 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1

My interface's ip is 192.168.42.174 and the gateway for this interface is 192.168.42.129.

I removed the second line as dirkt said : default via 192.168.42.129 dev enp0s20f0u1 proto static metric 101

$ ip route

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
10.136.80.66 via 10.128.0.1 dev enp0s31f6  proto dhcp  metric 100 
A.B.C.D via 192.168.42.129 dev enp0s20f0u1 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1

I don't want to use this interface for anything else that ABCD. Should I remove

192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.174  metric 100

too ? I guess no, looks like it's for the LAN network of my interface.

I made a mistake, I use the interface's ip for the via instead of the gateway.

Everything is working well now. It's more clear.

Subsidiary question just for the understanding, if now I want to redirect only the port 22 and block everything else. I guess I need iptables/firewallD, to reject everything with ABCD as dest IP and to allow only the port 22.

Answer 1

Routing works by picking the most specific destination. That means you need

• one route for the segment behind each interface
• one default route (and not several)
• one special route for your A.B.C.D ssh destination.

So the output of ip route should look like:

default via 10.128.0.1 dev enp0s31f6  proto static  metric 100 
10.128.0.0/23 dev enp0s31f6  proto kernel  scope link  src 10.128.1.21  metric 100 
192.168.42.0/24 dev enp0s20f0u1  proto kernel  scope link  src 192.168.42.65  metric 100 
A.B.C.D/32 dev enp0s20f0u1  ...

To add the last one, do

ip route add A.B.C.D/32 dev enp0s20f0u1 via 192.168.42.129

where 192.168.42.129 is the current gateway (need not be constant).

Use

ip route del default via 192.168.42.129 dev enp0s20f0u1

to delete the second default route manually, if you want to make sure nothing else besides A.B.C.D and link local packets goes through this interface. The way it is configured now, if the first interface goes down for some reason, all traffic will use this interface.

In your output, you had a 10.136.80.66 that was added via DHCP. I don't know why this was added, but very likely the infrastructure needs it for some reason.

There are various way to automate this setup, that depends on how exactly your system is configured (network manager? /etc/network/interfaces?)

Using iptables to mark packets as suggested in the comment is a stupid idea, routing works directly without having to set marks. That's what routing is for.

Using a /24 netmask as suggested in one answer instead of a /32 netmask for A.B.C.D will route more than one destination address (actually, 256 of them), so don't do that either.

Answer 2

I would like to use enp0s20f0u1 interface to access through ssh to only one IP. I mean, everything that will be connected to A.B.C.D (external/internet ip) have to go through this interface. Nothing else.

This seems straightforward enough... You want to route traffic toward enp0s20f0u1 to a particular next hip interface, which is exactly the job of the routing table.

ip route A.B.C.D/32 192.168.42.xx

where xx is the last octet of the IP address of the next hop you want to use.