Re: Recognizing traffic from multiple gateways
Michael Tinsay <tinsami1-/[email protected]> Mon, 4 Jul 2016 08:17:43 +0000 (UTC)
| Newsgroups | gmane.org.user-groups.linux.philippine |
|---|---|
| Message-ID | <[email protected]> |
--===============7647366382584402339==
Content-Type: multipart/alternative;
boundary="----=_Part_1408477_950162613.1467620263267"
------=_Part_1408477_950162613.1467620263267
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hi fooler,
I understand multiple routing tables for multi-NIC setup. =C2=A0However, My=
setup is more like both routers and my server is connected to a network sw=
itch, to put it simply. =C2=A0To illustrate:
=C2=A0DSL A <=3D=3D> Router/FW A <=3D=3D=3D=3D\=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 (10.20.30.40/8) =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 LAN Switch <=3D=3D> Server (10.9.8.7=
/8)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0DSL B <=3D=3D> Router/FW B <=3D=3D=3D=3D/=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 (10.11.12.13/8)
Until a couple of weeks ago, Router B was non-existent and both DSL lines w=
ere connected to Router A. =C2=A0Circumstances forced me to setup router B =
and connect DSL B to it. =C2=A0So now, previous traffic that flowed through=
DSL B to the server aren't routed properly, but they have been rerouted th=
rough DSL A, so it is not a big concern right now. =C2=A0I'm just wondering=
if there's a way to get traffic in DSL B bound for the server flowing back=
again with the new setup. =C2=A0If not, I can live with it.
--- mike t.
From: fooler mail <[email protected]>
To: Michael Tinsay <tinsami1-/[email protected]>; Philippine Linux Users' Group (PL=
UG) Technical Discussion List <[email protected]>=20
Sent: Sunday, 3 July 2016, 19:56
Subject: Re: [plug] Recognizing traffic from multiple gateways
=20
ill give you an idea how to do it as im blind with your network topology
linux can now have multiple virtual routing tables as well as multiple
network namespaces.. this leads to virtualization in the OS layer such
as LXC, Docker, etc...
assuming your server have two network interface cards .. eth0
connected to router A and eth1 connected to router B
virtual routing table id is based on number..=C2=A0 we will make a mapping
that virtual routing table id number to name.. just like in /etc/hosts
but the file is /etc/iproute2/rt_tables:
echo "200 routerA" >> /etc/iproute2/rt_tables
echo "201 routerB" >> /etc/iproute2/rt_tables
then create their default gateway for table routerA and table routerB:
ip route add default via <router A gateway IP address> dev eth0 table route=
rA
ip route add default via <router B gateway IP address> dev eth1 table route=
rB
then you have to mark or tag the incoming packets for eth0 and eth1..
we will tag all packets coming from eth0 as tag id 1 and all packets
coming from eth1 as tag id 2:
iptables -A PREROUTING -t mangle -i eth0 -j MARK --set-mark 1
iptables -A PREROUTING -t mangle -i eth1 -j MARK --set-mark 2
you can add specific destination protocol and port number of your
server service in the iptables rule above to match specific packet...
next is to add policy based routing rule:
ip rule add from all fwmark 1 table routerA
ip rule add from all fwmark 2 table routerB
the above rule says:
if outgoing packet tag as 1.. it will consult virtual routing table
routerA.. because your default gateway is the router A gateway IP
address.. it will send to router A...
if outgoing packet tag as 2.. it will consult virtual routing table
routerB.. because your default gateway is the router B gateway IP
address.. it will send to router B...
thats the basic of policy based routing...
fooler.
On Sat, Jul 2, 2016 at 1:37 AM, Michael Tinsay <tinsami1-/[email protected]> wrote:
> Thank you for the info fooler.
>
> I get what you're saying about policy-based routing, but isn't that
> applicable only to connections initiated by the server?=C2=A0 Can policy-=
based
> routing also do "All connections initiated externally and coming through =
the
> router ip address so-and-so goes through that router"?
>
>
> ________________________________
> From: fooler mail <[email protected]>
> To: Michael Tinsay <tinsami1-/[email protected]>; Philippine Linux Users' Group
> (PLUG) Technical Discussion List <[email protected]>
> Sent: Saturday, 2 July 2016, 11:33
> Subject: Re: [plug] Recognizing traffic from multiple gateways
>
> that is correct because traffic came from router A and B use the main
> routing table... your solution is to use policy based routing....
> create additional two routing table aside from the default or main
> routing table.. for incoming traffic for A or B.... mark or tag it ...
> upon out going.. your policy rule state that packet tag for A goes to
> gateway of=C2=A0 A and tag for B goes to gateway of B.. non tag packets
> goes to the main routing table's default gateway...
>
> fooler.
>
>
>
> On Thu, Jun 30, 2016 at 3:05 AM, Michael Tinsay <tinsami1-/[email protected]> wrot=
e:
>> Ooops...=C2=A0 My bad. I sent the email without putting a subject.=C2=A0=
Please
>> reply
>> to this one instead.
>>
>>
>> ________________________________
>> From: Michael Tinsay <tinsami1-/[email protected]>
>> To: "Philippine Linux Users' Group (PLUG) Technical Discussion List"
>> <[email protected]>
>> Sent: Thursday, 30 June 2016, 15:03
>> Subject:
>>
>> Hi.
>>
>> Have a question for the tcp/ip experts here.
>>
>> I recently had to split my various DSL lines between 2 routers. So Route=
r
>> A
>> have 3 lines connected to it while Router B has 2.=C2=A0 I now have a se=
rver
>> who
>> will be receiving external traffic through these servers via port
>> forwarding.=C2=A0 As I understand it, without any additional configurati=
on the
>> server will send outside-bound traffic through via the default route.=C2=
=A0 As
>> such, if Router A is the default route for the server, even if the traff=
ic
>> came from Router B the responses will be sent via Router A.
>>
>> If this is correct, what do I need to set up to have the server recogniz=
e
>> which traffic is coming from which router and send its responses to the
>> proper router accordingly?
>>
>> TIA!
>>
>>
>> --- mike t.
>
>>
>>
>>
>> _________________________________________________
>> Philippine Linux Users' Group (PLUG) Mailing List
>> http://lists.linux.org.ph/mailman/listinfo/plug
>> Searchable Archives: http://archives.free.net.ph
> _________________________________________________
> Philippine Linux Users' Group (PLUG) Mailing List
> http://lists.linux.org.ph/mailman/listinfo/plug
> Searchable Archives: http://archives.free.net.ph
>
>
>
>
> _________________________________________________
> Philippine Linux Users' Group (PLUG) Mailing List
> http://lists.linux.org.ph/mailman/listinfo/plug
> Searchable Archives: http://archives.free.net.ph
------=_Part_1408477_950162613.1467620263267
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html><head></head><body><div style=3D"color:#000; background-color:#fff; f=
ont-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10=
px"><div id=3D"yui_3_16_0_ym19_1_1467618935240_5614"><span id=3D"yui_3_16_0=
_ym19_1_1467618935240_6137">Hi fooler,</span></div><div id=3D"yui_3_16_0_ym=
19_1_1467618935240_5614"><span><br></span></div><div id=3D"yui_3_16_0_ym19_=
1_1467618935240_5614"><span><br></span></div><div id=3D"yui_3_16_0_ym19_1_1=
467618935240_5614" dir=3D"ltr"><span id=3D"yui_3_16_0_ym19_1_1467618935240_=
5885">I understand multiple routing tables for multi-NIC setup. Howev=
er, My setup is more like both routers and my server is connected to a netw=
ork switch, to put it simply. To illustrate:</span></div><div id=3D"y=
ui_3_16_0_ym19_1_1467618935240_5614"><span><br></span></div><div id=3D"yui_=
3_16_0_ym19_1_1467618935240_5614"><span><br></span></div><div id=3D"yui_3_1=
6_0_ym19_1_1467618935240_5614"><span id=3D"yui_3_16_0_ym19_1_1467618935240_=
5884"> DSL A <=3D=3D> Router/FW A <=3D=3D=3D=3D\</span></div>=
<div id=3D"yui_3_16_0_ym19_1_1467618935240_5614"><span id=3D"yui_3_16_0_ym1=
9_1_1467618935240_6143"> (10.20.30=
.40/8) |</span></div><div id=3D"yui_3_16_0_ym19_1_1467618935240_5614"=
> &nbs=
p; LAN Switch <=3D=3D> Server (10.9.8.7/8)<br></div><div id=3D"yui_3_=
16_0_ym19_1_1467618935240_5614"> &=
nbsp; |<br></div><di=
v id=3D"yui_3_16_0_ym19_1_1467618935240_5614"><span id=3D"yui_3_16_0_ym19_1=
_1467618935240_6144"> DSL B <=3D=3D> Router/FW B <=3D=3D=3D=
=3D/</span></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_14676=
18935240_5903"> (10.11.12.13/8)</d=
iv><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_1467618935240_5903"=
><br></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_14676189352=
40_5903"><br></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_146=
7618935240_5903">Until a couple of weeks ago, Router B was non-existent and=
both DSL lines were connected to Router A. Circumstances forced me t=
o setup router B and connect DSL B to it. So now, previous traffic th=
at flowed through DSL B to the server aren't routed properly, but they have=
been rerouted through DSL A, so it is not a big concern right now. I=
'm just wondering if there's a way to get traffic in DSL B bound for the se=
rver flowing back again with the new setup. If not, I can live with i=
t.</div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_1467618935240_=
5903"><br></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_1_146761=
8935240_5903"><br></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16_0_ym19_=
1_1467618935240_5903"><br></div><div class=3D"qtdSeparateBR" id=3D"yui_3_16=
_0_ym19_1_1467618935240_5903">--- mike t.</div><div class=3D"qtdSeparateBR"=
id=3D"yui_3_16_0_ym19_1_1467618935240_5903"><br></div><div class=3D"qtdSep=
arateBR" id=3D"yui_3_16_0_ym19_1_1467618935240_5903"><br></div><div class=
=3D"yahoo_quoted" id=3D"yui_3_16_0_ym19_1_1467618935240_5619" style=3D"disp=
lay: block;"> <div style=3D"font-family: Courier New, courier, monaco, mon=
ospace, sans-serif; font-size: 10px;" id=3D"yui_3_16_0_ym19_1_1467618935240=
_5618"> <div style=3D"font-family: HelveticaNeue, Helvetica Neue, Helvetica=
, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" id=3D"yui_3_16_0_ym19=
_1_1467618935240_5617"> <div dir=3D"ltr" id=3D"yui_3_16_0_ym19_1_1467618935=
240_5616"> <font size=3D"2" face=3D"Arial" id=3D"yui_3_16_0_ym19_1_14676189=
35240_5615"> <hr size=3D"1" id=3D"yui_3_16_0_ym19_1_1467618935240_6041"> <b=
><span style=3D"font-weight:bold;">From:</span></b> fooler mail <fooler.=
[email protected]><br> <b><span style=3D"font-weight: bold;">To:</span></b>=
Michael Tinsay <tinsami1-/[email protected]>; Philippine Linux Users' Group (=
PLUG) Technical Discussion List <[email protected]> <br> <b><sp=
an style=3D"font-weight: bold;">Sent:</span></b> Sunday, 3 July 2016, 19:56=
<br> <b><span style=3D"font-weight: bold;">Subject:</span></b> Re: [plug] R=
ecognizing traffic from multiple gateways<br> </font> </div> <div class=3D"=
y_msg_container" id=3D"yui_3_16_0_ym19_1_1467618935240_6021"><br>ill give y=
ou an idea how to do it as im blind with your network topology<br clear=3D"=
none"><br clear=3D"none">linux can now have multiple virtual routing tables=
as well as multiple<br clear=3D"none">network namespaces.. this leads to v=
irtualization in the OS layer such<br clear=3D"none">as LXC, Docker, etc...=
<br clear=3D"none"><br clear=3D"none">assuming your server have two network=
interface cards .. eth0<br clear=3D"none">connected to router A and eth1 c=
onnected to router B<br clear=3D"none"><br clear=3D"none">virtual routing t=
able id is based on number.. we will make a mapping<br clear=3D"none"=
>that virtual routing table id number to name.. just like in /etc/hosts<br =
clear=3D"none">but the file is /etc/iproute2/rt_tables:<br clear=3D"none"><=
br clear=3D"none">echo "200 routerA" >> /etc/iproute2/rt_tables<br cl=
ear=3D"none">echo "201 routerB" >> /etc/iproute2/rt_tables<br clear=
=3D"none"><br clear=3D"none">then create their default gateway for table ro=
uterA and table routerB:<br clear=3D"none"><br clear=3D"none">ip route add =
default via <router A gateway IP address> dev eth0 table routerA<br c=
lear=3D"none">ip route add default via <router B gateway IP address> =
dev eth1 table routerB<br clear=3D"none"><br clear=3D"none">then you have t=
o mark or tag the incoming packets for eth0 and eth1..<br clear=3D"none">we=
will tag all packets coming from eth0 as tag id 1 and all packets<br clear=
=3D"none">coming from eth1 as tag id 2:<br clear=3D"none"><br clear=3D"none=
">iptables -A PREROUTING -t mangle -i eth0 -j MARK --set-mark 1<br clear=3D=
"none">iptables -A PREROUTING -t mangle -i eth1 -j MARK --set-mark 2<br cle=
ar=3D"none"><br clear=3D"none">you can add specific destination protocol an=
d port number of your<br clear=3D"none">server service in the iptables rule=
above to match specific packet...<br clear=3D"none"><br clear=3D"none">nex=
t is to add policy based routing rule:<br clear=3D"none"><br clear=3D"none"=
>ip rule add from all fwmark 1 table routerA<br clear=3D"none">ip rule add =
from all fwmark 2 table routerB<br clear=3D"none"><br clear=3D"none">the ab=
ove rule says:<br clear=3D"none"><br clear=3D"none">if outgoing packet tag =
as 1.. it will consult virtual routing table<br clear=3D"none">routerA.. be=
cause your default gateway is the router A gateway IP<br clear=3D"none">add=
ress.. it will send to router A...<br clear=3D"none">if outgoing packet tag=
as 2.. it will consult virtual routing table<br clear=3D"none">routerB.. b=
ecause your default gateway is the router B gateway IP<br clear=3D"none">ad=
dress.. it will send to router B...<br clear=3D"none"><br clear=3D"none">th=
ats the basic of policy based routing...<br clear=3D"none"><br clear=3D"non=
e">fooler.<br clear=3D"none"><br clear=3D"none"><br clear=3D"none"><br clea=
r=3D"none"><br clear=3D"none">On Sat, Jul 2, 2016 at 1:37 AM, Michael Tinsa=
y <<a shape=3D"rect" ymailto=3D"mailto:tinsami1-/[email protected]" href=3D"mailt=
o:tinsami1-/[email protected]">tinsami1-/[email protected]</a>> wrote:<br clear=3D"none">&=
gt; Thank you for the info fooler.<br clear=3D"none">><br clear=3D"none"=
>> I get what you're saying about policy-based routing, but isn't that<b=
r clear=3D"none">> applicable only to connections initiated by the serve=
r? Can policy-based<br clear=3D"none">> routing also do "All conne=
ctions initiated externally and coming through the<br clear=3D"none">> r=
outer ip address so-and-so goes through that router"?<br clear=3D"none">>=
;<br clear=3D"none">><br clear=3D"none">> ___________________________=
_____<br clear=3D"none">> From: fooler mail <<a shape=3D"rect" ymailt=
o=3D"mailto:[email protected]" href=3D"mailto:[email protected]">fo=
[email protected]</a>><br clear=3D"none">> To: Michael Tinsay <<=
a shape=3D"rect" ymailto=3D"mailto:tinsami1-/[email protected]" href=3D"mailto:tinsa=
mi1-/[email protected]">tinsami1-/[email protected]</a>>; Philippine Linux Users' Group<br=
clear=3D"none">> (PLUG) Technical Discussion List <<a shape=3D"rect"=
ymailto=3D"mailto:[email protected]" href=3D"mailto:plug-cunTk1MwBs9kibMonLAN/[email protected]=
.org.ph">[email protected]</a>><br clear=3D"none">> Sent: Satur=
day, 2 July 2016, 11:33<br clear=3D"none">> Subject: Re: [plug] Recogniz=
ing traffic from multiple gateways<br clear=3D"none">><br clear=3D"none"=
>> that is correct because traffic came from router A and B use the main=
<br clear=3D"none">> routing table... your solution is to use policy bas=
ed routing....<br clear=3D"none">> create additional two routing table a=
side from the default or main<br clear=3D"none">> routing table.. for in=
coming traffic for A or B.... mark or tag it ...<br clear=3D"none">> upo=
n out going.. your policy rule state that packet tag for A goes to<br clear=
=3D"none">> gateway of A and tag for B goes to gateway of B.. non =
tag packets<br clear=3D"none">> goes to the main routing table's default=
gateway...<br clear=3D"none">><br clear=3D"none">> fooler.<br clear=
=3D"none">><br clear=3D"none">><br clear=3D"none">><br clear=3D"no=
ne">> On Thu, Jun 30, 2016 at 3:05 AM, Michael Tinsay <<a shape=3D"re=
ct" ymailto=3D"mailto:tinsami1-/[email protected]" href=3D"mailto:tinsami1-/[email protected]=
">tinsami1-/[email protected]</a>> wrote:<br clear=3D"none">>> Ooops...&nbs=
p; My bad. I sent the email without putting a subject. Please<br clea=
r=3D"none">>> reply<br clear=3D"none">>> to this one instead.<b=
r clear=3D"none">>><br clear=3D"none">>><br clear=3D"none">>=
> ________________________________<br clear=3D"none">>> From: Mich=
ael Tinsay <<a shape=3D"rect" ymailto=3D"mailto:tinsami1-/[email protected]" href=
=3D"mailto:tinsami1-/[email protected]">tinsami1-/[email protected]</a>><br clear=3D"none"=
>>> To: "Philippine Linux Users' Group (PLUG) Technical Discussion Li=
st"<br clear=3D"none">>> <<a shape=3D"rect" ymailto=3D"mailto:plug=
@lists.linux.org.ph" href=3D"mailto:[email protected]">plug-cunTk1MwBs//[email protected]=
ux.org.ph</a>><br clear=3D"none">>> Sent: Thursday, 30 June 2016, =
15:03<br clear=3D"none">>> Subject:<br clear=3D"none">>><br cle=
ar=3D"none">>> Hi.<br clear=3D"none">>><br clear=3D"none">>&=
gt; Have a question for the tcp/ip experts here.<br clear=3D"none">>>=
<br clear=3D"none">>> I recently had to split my various DSL lines be=
tween 2 routers. So Router<br clear=3D"none">>> A<br clear=3D"none">&=
gt;> have 3 lines connected to it while Router B has 2. I now have=
a server<br clear=3D"none">>> who<br clear=3D"none">>> will be=
receiving external traffic through these servers via port<br clear=3D"none=
">>> forwarding. As I understand it, without any additional con=
figuration the<br clear=3D"none">>> server will send outside-bound tr=
affic through via the default route. As<br clear=3D"none">>> su=
ch, if Router A is the default route for the server, even if the traffic<br=
clear=3D"none">>> came from Router B the responses will be sent via =
Router A.<br clear=3D"none">>><br clear=3D"none">>> If this is =
correct, what do I need to set up to have the server recognize<br clear=3D"=
none">>> which traffic is coming from which router and send its respo=
nses to the<br clear=3D"none">>> proper router accordingly?<br clear=
=3D"none">>><br clear=3D"none">>> TIA!<br clear=3D"none">>&g=
t;<br clear=3D"none">>><br clear=3D"none">>> --- mike t.<br cle=
ar=3D"none">><br clear=3D"none">>><br clear=3D"none">>><br c=
lear=3D"none">>><br clear=3D"none">>> _________________________=
________________________<br clear=3D"none">>> Philippine Linux Users'=
Group (PLUG) Mailing List<br clear=3D"none">>> <a shape=3D"rect" hre=
f=3D"http://lists.linux.org.ph/mailman/listinfo/plug" target=3D"_blank">htt=
p://lists.linux.org.ph/mailman/listinfo/plug</a><br clear=3D"none">>>=
Searchable Archives: <a shape=3D"rect" href=3D"http://archives.free.net.ph=
/" target=3D"_blank">http://archives.free.net.ph</a><div class=3D"yqt251538=
7323" id=3D"yqtfd15754"><br clear=3D"none">> ___________________________=
______________________<br clear=3D"none">> Philippine Linux Users' Group=
(PLUG) Mailing List<br clear=3D"none">> <a shape=3D"rect" href=3D"http:=
//lists.linux.org.ph/mailman/listinfo/plug" target=3D"_blank">http://lists.=
linux.org.ph/mailman/listinfo/plug</a><br clear=3D"none">> Searchable Ar=
chives: <a shape=3D"rect" href=3D"http://archives.free.net.ph/" target=3D"_=
blank">http://archives.free.net.ph</a><br clear=3D"none">><br clear=3D"n=
one">><br clear=3D"none">><br clear=3D"none">><br clear=3D"none">&=
gt; _________________________________________________<br clear=3D"none">>=
; Philippine Linux Users' Group (PLUG) Mailing List<br clear=3D"none">> =
<a shape=3D"rect" href=3D"http://lists.linux.org.ph/mailman/listinfo/plug" =
target=3D"_blank">http://lists.linux.org.ph/mailman/listinfo/plug</a><br cl=
ear=3D"none">> Searchable Archives: <a shape=3D"rect" href=3D"http://arc=
hives.free.net.ph/" target=3D"_blank">http://archives.free.net.ph</a><br cl=
ear=3D"none"></div><br><br></div> </div> </div> </div></div></body></html>
------=_Part_1408477_950162613.1467620263267--
--===============7647366382584402339==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_________________________________________________
Philippine Linux Users' Group (PLUG) Mailing List
http://lists.linux.org.ph/mailman/listinfo/plug
Searchable Archives: http://archives.free.net.ph
--===============7647366382584402339==--