Application Policy Routing under Linux Firewall

Assuming that there are two external interfaces in the network, the IP address is eth0 172.16.1.1/24,eth1 10.0.0.1/24, and the interface connecting the internal network is eth2 192.168.1.1. Now we design a strategy that will move all the data from the Web services from the internal network to 172.16.1.1 this exit. Other data went to 10.0.0.1 this exit.

#接口设置

Ifconfig eth0 172.16.1.1 netmask 255.255.255.0

Ifconfig eth1 10.0.0.1 netmask 255.255.255.0

Ifconfig eth2 192.168.1.1 netmask 255.255.255.0

Echo 1 >/proc/sys/net/ipv4/ip_forward

#将web服务类的数据包打上标示100

#这一步, it is critical that the IPROUTE2 Toolkit is used to implement policy routing, but the IPROUTE2 toolkit cannot be matched against the port, so iptables is needed to match

Iptables-t mangle-a prerouting-p tcp--dport 80-j MARK--set-mark 100

#增加多路由表 assume that 172.16.1.1 's gateway to this exit is 172.16.1.254

IP route add 0/0 via 172.16.1.254 table 100

#设置路由策略 the data in the data packet marker is 100, query route 100th routing table

IP rule add fwmark table 100

#NAT If you need to do NAT if you don't need it, route directly

Iptables-t nat-a postrouting-o Eth2-j Masquerade

This article mainly explains that iptables and Iproute2 can make many strong applications after cooperating with each other. You can use Iptables's powerful log-based identification to put different types of packets into your own-defined labels, and then use the IPROUTE2 's Policy routing function to conduct human intervention.