3 votes
Accepted

How to configure a WireGuard client to interact with two distinct servers?

This VPN is to access private resources, not a way to access Internet anonymously. So split tunneling should be used. Just replace on the client side: AllowedIPs = 0.0.0.0/0 by only the needed ...
A.B's user avatar
  • 36.7k
3 votes
Accepted

NAT router with 2 external WAN IPs A+B and multiple internal LANs: Let 1 LAN use external IP address B, all other A

Use SNAT instead of MASQUERADE ... in order to choose something else than the default. Instead of using MASQUERADE for the generic case (all other LANs), add a SNAT exception for LAN3 clients. This ...
A.B's user avatar
  • 36.7k
3 votes

Linux: prevent two default routes from being added

Adding nogateway for eth1 to /etc/dhcpcd.conf fixed my problem: interface eth1 nogateway Props to the dhcpcd.conf man page (and a +1 to ChatGPT for pointing me in the general direction): https://...
rob_7cc's user avatar
  • 381
3 votes
Accepted

How to configure port forwarding with nftables for a Minecraft server on Raspberry Pi?

As a reminder, nftables (just like iptables) sees only the first packet of a flow to be NAT-ed. When it comes to doing NAT, every other packet in the same flow will be handled directly by Netfilter/...
A.B's user avatar
  • 36.7k
2 votes

[Mininet/MiniEdit]: Routing doesn't seem to work in case of 2 routers

You've probably not enabled forwarding on r1 and r2 sysctl -w net.ipv4.ip_forward=1 Before you run this (or after) you can check the current state sysctl net.ipv4.ip_forward 0 indicates it's not ...
Chris Davies's user avatar
2 votes

[Mininet/MiniEdit]: Routing doesn't seem to work in case of 2 routers

There is a typo: # On the h1 terminal (xterm) [...] ip route add 192.168.1.0/24 via 192.168.1.1 What I guess you intended to type (consistent with h2) is ip route add 192.168.1.0/24 via 192.168.0.1 ...
Hauke Laging's user avatar
  • 90.3k
2 votes

Can Linux differentiate between HTTPS and OpenVPN traffic?

Take a look at sslh, a tool which is designed for this purpose: What is sslh? sslh is a protocol multiplexer. It accepts connections in HTTP, HTTPS, SSH, OpenVPN, tinc, XMPP, or any other protocol ...
George Murdocca's user avatar
2 votes
Accepted

Service only listens on 127.0.0.1 port 1025. How do you allow any computer on your local network to communicate with this service?

An alternative approach is to use an application forwarder. No iptables or kernel level forwarding is required. In this example I've used socat, but other possibilities may exist. Here the set of ...
Chris Davies's user avatar
2 votes
Accepted

Linux using wrong default gateway

I think what you're trying to do is set up "source based routing". Typically routing is destination based. To do this we need to make use of advanced ip functionality, by creating a second ...
Stephen Harris's user avatar
2 votes

Making a device accessible with SSH from another device over the internet

Getting a static private IP address is entirely between the RPi and its router. For example, you could configure the router to identify the RPi by MAC address (after ensuring any MAC address ...
telcoM's user avatar
  • 97k
2 votes

Redirecting locally originated traffic with DNAT in OUTPUT chain not working as expected

For that DNAT rule in the OUTPUT chain to work correctly, it looks like we need two things. We need to set the appropriate route_localnet sysctl: sysctl -w net.ipv4.conf.br0.route_localnet With just ...
larsks's user avatar
  • 34.8k
2 votes
Accepted

In which order is routing of packets defined if VRF and ip rules are defined?

The VRF has by default an associated routing rule with priority 1000 as described in VRF documentation below and as seen in OP's case: An l3mdev FIB rule directs lookups to the table associated with ...
A.B's user avatar
  • 36.7k
2 votes

How can a computer access the Internet through another?

TL;DR: use the built-in connection sharing tools of your Linux user desktop environment. There's different desktop environments (Gnome, KDE, …), so instructions differ a bit, but the idea and ...
Marcus Müller's user avatar
2 votes
Accepted

default gateway not set when using bond0 interface

Among multiple ifupdown implementations, I'll consider it's ifupdown (implementation "v1") and the interfaces(5) configuration as seen on Debian. The bond0 stanza should not use the keyword ...
A.B's user avatar
  • 36.7k
2 votes
Accepted

How exactly does Linux use the prefix length assigned to network interface?

That is, does the prefix length have no meaning and the real work is done by the route entries? The subnet mask defines your subnet, and thus also defines what the broadcast address is, and to which ...
Marcus Müller's user avatar
2 votes

Forwarding REST API requests and responses using iptables

You do not do it with IP tables, you do it with http-server configs. Setup two http servers. One visible to the public (your node-int), and another inside your LAN, unaccessible from outside world (...
White Owl's user avatar
  • 5,129
1 vote

configure raspberry pi as multicast server and host

End-hosts do not need to be configured for multicast; they can just use it. Multicast routing (PIM or DVMRP) is only needed between the routers. Usually, multicast group joins are done dynamically, ...
u1686_grawity's user avatar
1 vote
Accepted

Route all TCP traffic from port to another host:port

You haven't described if you have other tools running that may be controlling the tables; e.g. firewalld. These could block your rules from occuring. I also don't see you talking about FORWARD rules ...
Stephen Harris's user avatar
1 vote
Accepted

nft port forwarding not working on router

Let's look at a part of the Packet flow in Netfilter and General Networking schematic. It was made for iptables but most of it applies for nftables: It's documented that the nat table is consulted ...
A.B's user avatar
  • 36.7k
1 vote

ip route: no route to host

sudo ip route add 10.49.0.0/16 via 10.0.2.15 dev enp0s3 10.0.2.15 appears to be the IP address associated with enp0s3. You should be providing the address of the router on 10.0.2.0/24 which can ...
symcbean's user avatar
  • 5,557
1 vote
Accepted

iptables: Reroute incoming TCP traffic on port to IP inside VPN network

The SERVER_LOCAL_NETWORK_ADDRESS I read from ip addr command under eth0 interface. It had this string: inet 193.108.113.52/24 scope global eth0. As you intend the packet to be routed within the VPN, ...
A.B's user avatar
  • 36.7k
1 vote

OpenBSD and Wireguard hub and spoke: spoke to spoke communication

With many thanks to Justin Ludwig I found the answer. It was not where I expected it to be. Running tcpdump with a ping count of one showed that the ping requests were indeed leaving the wg0 interface,...
Christopher Causer's user avatar
1 vote
Accepted

ipset alternative or some kind of smart idea for wildcards

I won't limit my answer to a tiny part of an algorithm because OP is also hitting implementation limits. The answer has to work with them. The routing stack, part of Linux' network stack is limited ...
A.B's user avatar
  • 36.7k
1 vote

In addition to `ip rule`, `ip route`, `iptables`, is there anything else that could affect routing and packet filtering in linux?

I don't know Cloudflare WARP (so I cannot assess whether the following allpies here) but to answer your question: There is indeed something in Linux networking that not just affects "routing"...
Hauke Laging's user avatar
  • 90.3k
1 vote

NetworkManager changes default routing policy

If someone cannot fix the issue with other answers, you may also want to check if you don't have another network manager installed that is interfering. I had both ConnMan and NetworkManager installed ...
baptx's user avatar
  • 287
1 vote
Accepted

What is the file location for ip routes in RHEL9?

Even in RHEL 8, /etc/sysconfig/network-scripts was deprecated. Network configuration in RHEL 8 and later is managed using Network Manager. You will find the corresponding configuration files in the /...
larsks's user avatar
  • 34.8k
1 vote

IPv6 over PPPoE

I switched from radvd to bird, as I thought I needed a routing protocol. I asked on the mailing list, and Arnaud Houdelette-Langlois replied as follows: The ISP-side router needs to know that it ...
Ale's user avatar
  • 187
1 vote

How can I override systemd's choice of default route with two network interfaces?

Yes it's an old question but I came here looking for how the default routes worked for a systemd config I set up years ago that suddenly stopped working. To answer this question you could use the ...
m12lrpv's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible