PBR (Policy Base Routing) on Linux

I think that Cisco and YAMAHA routers can use policy-based routing using filters. I would like to do it on Linux as well.

Policy-based routing is a routing method that is completed within the host, unlike normal routing. Use a specific route table for a specific operation. It's like that. (Difficult to explain ...) For example ...

Kimo is a multi-homed environment.

Example) I want to change the gateway when accessing a specific port

What kind of situation can be considered? ・ Normally, I use the A line, but I want to use the B line for http access.

The environment this time is -Suppose that the host has three external lines (192.168.0.2, 192.168.1.2, 192.168.2.2) and the gateway (192.168.0.1, 192.168.1.1, 192.168.2.1) is ahead of them. -Http access of 12.34.56.78 from the host is from gateway A. The https access of 12.34.56.78 is from gateway B. 12.34.56.78 ssh access from gateway C. I want to access each one.

図面.png

What Linux features are needed to make this happen?

Use iptables to mark packets destined for a particular port (iptables), and use the specified routing table for marked packets (iproute2).

1. Mark iptables

Use the iptables mangle table to mark packets.

# iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 1 ← Mark "1" for packets going out toward tcp 80
# iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 2 ← Mark "2" for packets going out toward tcp 443
# iptables -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --set-mark 3 ← Mark "3" for packets going out toward tcp 22

2. Add a rule to iproute2

Specify rules for marked packets.

# ip rule add fwmark 1 table 10 ← Refer to "table 10" for packets marked with "1"
# ip rule add fwmark 2 table 20 ← Refer to "table 20" for packets marked with "2"
# ip rule add fwmark 3 table 30 ← Refer to "table 30" for packets marked with "3"

Furthermore, since there are multiple interfaces addressed to the gateway, specify the return packet as well.

# ip rule add from 192.168.0.2 table 10 ← Refer to "table 10" for packets entering "192.168.0.2"
# ip rule add from 192.168.1.2 table 20 ← Refer to "table 20" for packets entering "192.168.1.2"
# ip rule add from 192.168.2.2 table 30 ← Refer to "table 30" for packets entering "192.168.2.2"

3. Add a route to iproute2

Create a root table to be referenced.

# ip route add default dev eth1 via 192.168.0.1 table 10 ← The default gateway of "table10" is 192.168.0.1 ahead of eth1.
# ip route add default dev eth2 via 192.168.1.1 table 20 ← The default gateway of "table20" is 192.168.1.1 ahead of eth2.
# ip route add default dev eth3 via 192.168.2.1 table 30 ← The default gateway of "table30" is 192.168.2.1 ahead of eth3.

It is better to add a local link to each table, so let's deal with it as appropriate. How to write a local link

 ip route show table main

Please refer to and apply the default unexpected!

It looks like this with one liner

#  ip route show table main | grep -Ev ^default | while read ROUTE ; do ip route add table "table name" $ROUTE; done

This completes the settings. Let's actually verify it. If all is well, you may want to add /etc/rc.local or something to your startup script.

Recommended Posts

PBR (Policy Base Routing) on Linux
Linux Policy Base Routing
Re-examined Linux PBR
Start a process with a scheduling policy on Linux
jblas on Arch Linux
NAT router on Linux
Develop .NET on Linux
Wake on lan on Linux
Monitor traffic on Linux
Update vscode on linux
Try NeosVR on Linux
Check capacity on Linux
LiveUSB creation on Linux
Linux operation on Win10
NTP configuration memo on Linux
Install Linux on your Chromebox
Monitor disk usage on Linux
Use Github Desktop on Linux
Elixir = Comfortable on Linux Mint
Read core voltage on Linux
Put jenv on Amazon Linux
Easy df command on Linux
Linux on Windows -1-: debian introduction
Install tomcat 5.5 on Amazon Linux.
Introducing Elixir on Linux Mint
Use sshpass on Amazon linux2
Install Homebrew on Amazon Linux 2
Install strongSwan 5.9.1 on Amazon Linux 2
Linux environment construction (on WSL environment)
Run FreeBSD on Linux + qemu
Use Linux on Windows 10 (WSL2)