RHEL: Route network packets to go out via the same interface they came in

RHEL: Route network packets to go out via the same interface they came in

# Tested on RHEL 6
 
# When working on a server with several network interfaces, if we don't define any specific
# VLAN routing, all the outgoing traffic will usually go through the default interface.
 
# On servers connected to many different VLANs, and with special requirements regarding
# the traffic balancing on the physical interfaces, such may be the case of a backup server,
# this could be a laborious issue to manage.
 
# I have one bacukp server with two network interfaces: the first one, bond0, connected to
# the administrative network and the other one, bond1, linked to the backup network and
# running a service on a virtual IP that will be used by clients to send their data:
 
[root@mybckserver ~]# ifconfig | egrep "Link|inet add"
bond0     Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
          inet addr:10.69.961.124  Bcast:10.69.961.255  Mask:255.255.255.0
bond1     Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
          inet addr:10.256.11.117  Bcast:10.256.11.255  Mask:255.255.255.0
bond1:0   Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
          inet addr:10.256.11.118  Bcast:10.256.11.255  Mask:255.255.255.0
eth0      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
eth1      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:15
eth2      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
eth3      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:17
eth4      Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
eth6      Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
 
 
# To avoid overloading the public administrative network, I would like to configure the
# backup interface so all the requests are answered over this interface, this is, I'll force
# all outgoing packets to go out via the interface they came in.
 
# With my current configuration, all the ping requests made to my backup service, "bck-srv",
# are answered via bond0 instead of bond1:
 
[root@client01 ~]# ping -c 2 bck-srv
PING bck-srv.syscookbook.mydomain.org (10.256.11.118) 56(84) bytes of data.
64 bytes from bck-srv.syscookbook.mydomain.org (10.256.11.118): icmp_seq=1 ttl=63 time=0.301 ms
64 bytes from bck-srv.syscookbook.mydomain.org (10.256.11.118): icmp_seq=2 ttl=63 time=0.333 ms
 
--- bck-srv.syscookbook.mydomain.org ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.301/0.317/0.333/0.016 ms
 
# Incoming traffic arriving on bond1...
 
root@mybckserver:/root#> tcpdump -i bond1 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
13:06:26.359950 IP client01.syscookbook.mydomain.org > bck-srv.syscookbook.mydomain.org: ICMP echo request, id 14191, seq 1, length 64
13:06:27.359453 IP client01.syscookbook.mydomain.org > bck-srv.syscookbook.mydomain.org: ICMP echo request, id 14191, seq 2, length 64
 
2 packets captured
3 packets received by filter
0 packets dropped by kernel
 
# ...was answered using bond0:
 
root@mybckserver:/root#> tcpdump -i bond0 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:06:26.360003 IP bck-srv.syscookbook.mydomain.org > client01.syscookbook.mydomain.org: ICMP echo reply, id 14191, seq 1, length 64
13:06:27.359477 IP bck-srv.syscookbook.mydomain.org > client01.syscookbook.mydomain.org: ICMP echo reply, id 14191, seq 2, length 64
 
2 packets captured
13 packets received by filter
0 packets dropped by kernel
 
 
# This was the default routing table:
 
root@mybckserver:/root#> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.256.11.0     0.0.0.0         255.255.255.0   U     0      0        0 bond1
10.69.961.0     0.0.0.0         255.255.255.0   U     0      0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1010   0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1011   0        0 bond1
0.0.0.0         10.69.961.1     0.0.0.0         UG    0      0        0 bond0
 
 
# No special route or rule declared:
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/rule*
ls: cannot access /etc/sysconfig/network-scripts/rule*: No such file or directory
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/route*
ls: cannot access /etc/sysconfig/network-scripts/route*: No such file or directory
 
 
# At this point, to redirect all the backup traffic through the dedicated interface, I
# would need to define new routes for each VLAN connecting to my server for backups
# purposes.
 
# Should I do this, on one hand, in the long term I would have an enormous routing table,
# not easy to manage, and on the other hand I would run the risk of forgetting adding new
# VLANs to the routing table so I thought that it would be better to redirect ALL the
# replies to the requests received on bond1 through this interface.
 
 
# First, I create a new routing table dedicated to bond1:
 
root@mybckserver:/root#> ip route add 10.256.11.0/24 dev bond1 table 1
root@mybckserver:/root#> ip route add default via 10.256.11.1 dev bond1 table 1
 
# And then I add some rules to link bond1 to the previously created table and process all
# the traffic received on the corresponding IPs by this new routing table:
 
root@mybckserver:/root#> ip rule add iif bond1 table 1
 
root@mybckserver:/root#> ip rule add from 10.256.11.117 table 1
root@mybckserver:/root#> ip rule add from 10.256.11.118 table 1
 
 
# This is the my configuration:
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/rule*
-rw-r--r-- 1 root root 70 Feb 20 13:17 /etc/sysconfig/network-scripts/rule-bond1
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/route*
-rw-r--r-- 1 root root 72 Feb 20 13:17 /etc/sysconfig/network-scripts/route-bond1
 
root@mybckserver:/root#> cat /etc/sysconfig/network-scripts/route-bond1
10.256.11.0/24 dev bond1 table 1
default via 10.256.11.1 dev bond1 table 1
 
root@mybckserver:/root#> cat /etc/sysconfig/network-scripts/rule-bond1
iif bond1 table 1
from 10.256.11.117 table 1
from 10.256.11.118 table 1
 
 
# I'll restart the network service to verify that everything is ok with this configuration
 
root@mybckserver:/root#> service network restart
 
 
# And, as a result, all the traffic received on bond1 is using the default gateway of the
# new routing table and thus all the backup traffic will go through the dedicated interface,
# as expected ("dsmc" makes part of the commercial suite I'm using for backups):
 
[root@client01 ~]# dsmc
IBM Tivoli Storage Manager
Command Line Backup-Archive Client Interface
  Client Version 7, Release 1, Level 6.4
  Client date/time: 02/20/2018 13:14:06
(c) Copyright by IBM Corporation and other(s) 1990, 2016. All Rights Reserved.
 
Node Name: client01
Session established with server MYSERVER: Linux/x86_64
  Server Version 7, Release 1, Level 8.0
  Server date/time: 02/20/2018 13:14:06  Last access: 02/14/2018 15:56:30
 
tsm> quit
 
# Incoming traffic arriving on bond1...
 
root@mybckserver:/root#> tcpdump -i bond1 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
[...]
13:14:06.681180 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [.], ack 7978, win 169, length 0
13:14:10.899841 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [P.], seq 572:576, ack 7978, win 169, length 4
13:14:10.900082 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [F.], seq 576, ack 7978, win 169, length 0
13:14:10.913489 IP bck-srv.syscookbook.mydomain.org.imtc-mcs > client01.syscookbook.mydomain.org.40916: Flags [F.], seq 7978, ack 577, win 149, length 0
13:14:10.913812 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [.], ack 7979, win 169, length 0
 
28 packets captured
28 packets received by filter
0 packets dropped by kernel
 
 
# ...not being replied anymore via bond0:
 
root@mybckserver:/root#> tcpdump -i bond0 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
 
0 packets captured
10 packets received by filter
0 packets dropped by kernel
 
 
# ...now I can't see the new configuration for bond1 on the default routing table
 
root@mybckserver:/root#> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.256.11.0     0.0.0.0         255.255.255.0   U     0      0        0 bond1
10.69.961.0     0.0.0.0         255.255.255.0   U     0      0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1010   0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1011   0        0 bond1
0.0.0.0         10.69.961.1     0.0.0.0         UG    0      0        0 bond0
 
 
# For that I have to look directly in the new routing table:
 
root@mybckserver:/root#> ip route show table 1
10.256.11.0/24 dev bond1  scope link
default via 10.256.11.1 dev bond1
 
 
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
8 Vim Tips And Tricks That Will Make You A Pro User
Viewed 482 times since Fri, Apr 19, 2019
How to Configure ‘FirewallD’ in RHEL/CentOS 7 and Fedora 21
Viewed 576 times since Wed, Oct 9, 2019
Monitoring bezpieczeństwa Linux: integracja auditd + OSSEC cz. I
Viewed 683 times since Fri, Apr 5, 2019
Install OpenVPN On CentOS / RHEL 7
Viewed 110 times since Fri, May 15, 2020
Do you Know These 5 Use of V$session View ?
Viewed 5169 times since Thu, Jun 21, 2018
linux ssh Remotely Initiated Reverse SSH Tunnel
Viewed 123 times since Wed, Apr 22, 2020
RHEL: Extending a vmdk (Virtual Machine disk)
Viewed 1013 times since Sun, May 27, 2018
Linux - How to get network speed and statistic of ethernet adapter in Linux
Viewed 489 times since Fri, Jun 8, 2018
An easier way to manage disk decryption at boot with Red Hat Enterprise Linux 7.5 using NBDE
Viewed 1498 times since Mon, Aug 6, 2018
How to Register and Enable Red Hat Subscription, Repositories and Updates for RHEL 7.0 Server
Viewed 1016 times since Mon, Oct 29, 2018