Assume that the network has two external interfaces: eth0 172.16.1.1/24, eth1 10.0.0.1/24, and eth2 192.168.1.1. Now we have designed such a policy to export all the web service data from the internal network to 172.16.1.1. Other data goes to the exit 10.0.0.1.
# Interface settings
Ifconfig eth0 172.16.1.1 netmask 255.255.255.0
Ifconfig eth1 10.0.0.1 netmask 255.255.255.0
Ifconfig eth2 192.168.1.1 netmask 255.255.255.0
Echo 1>/proc/sys/net/ipv4/ip_forward
# Mark the web service data packets as 100
# This step is critical. iproute2 toolkit is used to implement policy routing. However, iproute2 toolkit cannot match based on ports. Therefore, iptables must be used in combination.
Iptables-t mangle-a prerouting-p tcp -- dport 80-j MARK -- set-mark 100
# Add multiple route tablesAssume 172.16.1.1 the egress gateway is 172.16.1.254.
Ip route add 0/0 via 172.16.1.254 table 100
# Setting routing policiesQuery route table No. 100 for data with 100 mark bits
Ip rule add fwmark 100 table 100
# If NAT is required, it is directly routed if NAT is not required.
Iptables-t nat-a postrouting-o eth2-j MASQUERADE
This article mainly explains that iptables and iproute2 can be used in a lot of scenarios after collaboration. You can use iptables's powerful ability to identify data packets to mark different types of data packets as defined by you. Then, you can use iproute2's policy routing function to perform manual intervention on the routes.