Static routes
U
SER
G
UIDE
149
Suppose you have two network interfaces, respectively called
atm0
and
atm1
: on the first one you
want to send TCP packets coming from the subnet
10.10.0.0/16
and on the second you want to
send all the others.
By using
set route
command, you can add two more routes on two different routing tables: the
default one and the
table 1
:
set route net 0.0.0.0 netmask 0.0.0.0 dev atm0
set route net 0.0.0.0 netmask 0.0.0.0 dev atm1 table 1
Under normal conditions, all the traffic insists on the default table. But using
set policy-based-routing from-source 10.10.0.0/16 lookup table 1
you determine that the traffic coming from the subnet
10.10.0.0/16
should consult the
table 1
and so use the
atm1
interface
.
In addition to the source address, you can also specify the destination of the packets:
The command
set policy-based-routing
have other options:
set policy-based-routing from-if <interface> lookup table N
is used to associate to
table N
the traffic that comes from the specified interface
set policy-based-routing packet-with-mark M lookup table N
is used to associate to
table N
the packets marked with
M
value.
To mark the packets, you can use the command
set mark
, for example:
set mark 4 protocol tcp from 10.10.0.0/16 from any source-port any to any dest-port 80 out-interface any in-interface any
marks all the TCP packets coming from the subnet
10.10.0.0/16
and headed to the port
80
with
0x04
value, while:
set mark 8 protocol udp from 10.10.0.0/16 to any out-interface any in-interface any
marks all the UDP packets with
0x08
value (you must remember that the marking is not made on
the packet that is sent on the network, but it is made on an internal descriptor of the packet itself).
To mark the packets you can use the command
iptables
. Thanks to the
mangle
option, you can
classify the traffic based on every combination of the IP packet (
iptables
has a specific chapter in
which is described in details).
For example:
set iptables -t mangle -A PREROUTING -p tcp --dport 80 -s 10.10.0.0/16 -j MARK --set-mark 0x04
marks all the TCP packets coming from the subnet
10.10.0.0/16
and headed to the port
80
with
0x04
value, while:
set iptables -t mangle -A PREROUTING -p udp -s 10.10.0.0/16 -j MARK --set-mark 0x08
marks all the UDP packets with
0x08
value (you must remember that the marking is not made on
the packet that is sent on the network, but it is made on an internal descriptor of the packet itself).
