Home / server / Questions / 507526
Accepted
tudor -Reinstate Monica-
Asked: 2013-05-14 20:28:05 +0800 CST

Simple Policy Based Routing for matching source packet to return packet

  • 772

I have two ADSL modem-routers and a server all in the same statically-assigned IP address range (192.168.0.1/24).

Internet 1 -- (1.1.1.1) Modem 1 (192.168.0.1) -- Switch -- (192.168.0.3) Server 
Internet 2 -- (2.2.2.2) Modem 2 (192.168.0.2) -----/

Each of the modems forward ports to the server, e.g. ssh. This works on one modem but not the other. If I do a packet trace, the ssh packets arrive at the server and are returned via the default gateway, which may have a different external IP to the origin. If it does not match the origin, the response is thrown away and the ssh connection times out.

e.g. If the default gateway in the server is 192.168.0.1, then the ssh packets would take the following paths:

Request:  SSH to 1.1.1.1 -> 192.168.0.1 -> 192.168.0.3
Response: 192.168.0.3 -> 192.168.0.1 -> 1.1.1.1
Result: WORKS! :-D

Request:  SSH to 2.2.2.2 -> 192.168.0.2 -> 192.168.0.3
Response: 192.168.0.3 -> 192.168.0.1 -> 1.1.1.1
Result: WRONG RESPONSE IP (2.2.2.2 != 1.1.1.1)

I understand from chatting with the people on IRC ##networking that what I want is "Source-Based Routing", a type of Policy Based Routing.

From what I can tell, a PBR looks something like:

access-list 1 permit 192.168.0.1
access-list 2 permit 192.168.0.2
!
interface async 1
 ip policy route-map equal-access
!
route-map equal-access permit 10
 match ip address 1
 set ip default next-hop 192.168.0.1
route-map equal-access permit 20
 match ip address 2
 set ip default next-hop 192.168.0.2
route-map equal-access permit 30
 set default interface null0

I have spent many hours looking at tutorials and examples on this, but they don't seem to come near my needs. Specifically, I can't seem to understand:

  1. How the originating IP is matched to the response IP,
  2. The meaning of 'async' in the above example,
  3. If the above example is even remotely correct for my needs, and
  4. Where I should put this configuration on a standard Ubuntu Server?
linux

2 Answers

  1. Best Answer

    You need to add an additional IP to the server (eg 192.168.0.4) and DNAT the traffic coming to ADSL Modem 2 to the new address. This way the server will be able to differentiate between the 2 upstream connections; at the moment it can't do that because all traffic that it sees is destined to 192.168.0.3 from whatever source address out on the internet with no indication of which ADSL modem the packet traversed.

    With the additional IP setup, in your Policy Based Routing, you connection mark any traffic to 192.168.0.3 with a mark that uses a route table that default routes to ADSL Modem 1, and connection mark traffic to 192.168.0.4 with a mark to use a routing table with ADSL Modem 2 as the default gateway.

    • 2

  2. I've set this up in the past using policy routing from the Linux Advanced Routing and Traffic Control Howto.

    In your case, you appear to have a slightly different configuration with a switch in the middle. You can adapt your configuration to the suggestion perhaps by adding a second nic. Otherwise, you may need to setup multiple VLANs to accomplish what you are after with a single nic.

    • 1