Application Policy Routing in Linux Firewall

Source: Internet
Author: User

Assume that the network has two external interfaces: eth0 172.16.1.1/24, eth1 10.0.0.1/24, and eth2 192.168.1.1. Now we have designed such a policy to export all the web service data from the internal network to 172.16.1.1. Other data goes to the exit 10.0.0.1.
# Interface settings
Ifconfig eth0 172.16.1.1 netmask 255.255.255.0
Ifconfig eth1 10.0.0.1 netmask 255.255.255.0
Ifconfig eth2 192.168.1.1 netmask 255.255.255.0
Echo 1>/proc/sys/net/ipv4/ip_forward
# Mark the web service data packets as 100
# This step is critical. iproute2 toolkit is used to implement policy routing. However, iproute2 toolkit cannot match based on ports. Therefore, iptables must be used in combination.
Iptables-t mangle-a prerouting-p tcp -- dport 80-j MARK -- set-mark 100
# Add multiple route tablesAssume 172.16.1.1 the egress gateway is 172.16.1.254.
Ip route add 0/0 via 172.16.1.254 table 100
# Setting routing policiesQuery route table No. 100 for data with 100 mark bits
Ip rule add fwmark 100 table 100
# If NAT is required, it is directly routed if NAT is not required.
Iptables-t nat-a postrouting-o eth2-j MASQUERADE
This article mainly explains that iptables and iproute2 can be used in a lot of scenarios after collaboration. You can use iptables's powerful ability to identify data packets to mark different types of data packets as defined by you. Then, you can use iproute2's policy routing function to perform manual intervention on the routes.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.