0

I would like to route the outbound traffic to a particular interface for ssh port. We have a routing table like this:

default via gw_ip dev eth0
default via gw_ip dev eth1 metric 10001
10.x.y.z/23 dev eth0 proto kernel scope link src eth0_ip
10.x.y.z/23 dev eth1 proto kernel scope link src eth1_ip

As you can see since both the interfaces are in the same subnet all the outbound traffic will go by default via eth0_ip because it has a lower metric value. My use case is to use eth1 for all inbound and outbound communications. I can achieve this by modifying the metric value and or by only defining the default rule for eth1.

However, the problem is there are some automated health checks on the system which test the system health by telnet to ssh port(22). This health check will always happen on eth0 and fails if we modify the IP table by setting the default interface to eth1. I think this is because the test will try to connect at eth0 ip but the response it will get would be from eth1 ip.

As a workaround I thought if we could have the outbound traffic set to eth0 only for port 22. So when the health check tries to connect to eth0 on port 22 it gets response from eth0 only.

  • A simpler workaround would be to use (via ip rule/policy routing) eth0 for eth0's IP and eth1 for eth1's IP (which as you said is not what happens now). Would that be fine then? Your way would need this kind of workaround anyway, and then in addition special adjustments for port 22 involving, with kernels older than 4.17, iptables, marks and awkward adjustments. – A.B May 1 at 15:46
  • Difficult to judge with the information given, but several network interfaces with an identical IP address (or even different IP addresses for the same LAN segment) will always give you a headache. You didn't explain why you need a specific interface for outgoing ssh, but consider using a network namespace (or several network namespaces), configure them differently, and run processes (like outgoing ssh) that needs different treatment in different network namespaces. It will be usually much simple than a policy routing/iptables solution. – dirkt May 2 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.