Policy based routing
For certain network setups one routing table is simply not enough.
For example some network configurations can include two or more gateways exist to an uplink provider so that load balancing can be performed between the two uplinks. For example, a network administrator may choose to send all SSH traffic over one uplink gateway and all HTTP over the other.
Network configurations with just one gateway will send all traffic over one uplink while the other(s) remain unused.
With policy based routing, system administrators can choose by various parameters which packets should use which routing table and therefore perhaps take another route.
Networking options CONFIG_IP_ADVANCED_ROUTER IP_MULTIPLE_TABLES Network packet filtering framework (Netfilter) Core Netfilter Configuration CONFIG_NETFILTER_XT_MARK (only if you intend to use fwmarks as indicators for ip rule) IP_NF_MANGLE (only if you intend to use fwmarks as indicators for ip rule)
Create new routing table
- Edit the /etc/iproute2/rt_tables file.
- Append [ID of the table] [Name of the table]
- Add rules with ip rule but with table [Table name or table ID]
- Check with
ip route show table [Table name or table ID]
Decide which packets takes what routing table
By default every packets takes the routing table main (ID 254). You can now specify rules for packets to take different routing tables (which will need created first), every packet which is not matching any rule still takes the default routing table (main).
A full list of the possible parameters you can get here If this is not sufficient for you (i.e. an source port), you can use fwmark. These fwmark you can set with iptables, so can create an ip rule with every match iptables is capable of.
-j MARK --set-mark <marknumber in decimal form>. The target MARK only works in mangle. For incoming packets I use
-t mangle -A PREROUTING, for outgoing packets
-t mangle -A OUTPUT. Please be aware that the mark gets lost when the packet is processed by a process (i.e. apache), so if your packet arrives your network card and the way home doesn't work properly it's of no use if you mark the incoming packet, you have to mark the new generated outgoing packet.
Packet seems to disappear
Most likely the packet gets dropped because of it was considered "martian". In the actual kernel these packets get dropped silently. You can enable logging by:
net.ipv4.conf.default.log_martians = 1 net.ipv4.conf.all.log_martians = 1
If you now see messages with indicated when packets are considered martian, disable dropping them by:
# Enables source route verification net.ipv4.conf.default.rp_filter=0 # Enable reverse path net.ipv4.conf.all.rp_filter=0
- Static routing — covers routing of the IP protocol in the Linux kernel.