RHEL: Route network packets to go out via the same interface they came in

RHEL: Route network packets to go out via the same interface they came in

# Tested on RHEL 6
 
# When working on a server with several network interfaces, if we don't define any specific
# VLAN routing, all the outgoing traffic will usually go through the default interface.
 
# On servers connected to many different VLANs, and with special requirements regarding
# the traffic balancing on the physical interfaces, such may be the case of a backup server,
# this could be a laborious issue to manage.
 
# I have one bacukp server with two network interfaces: the first one, bond0, connected to
# the administrative network and the other one, bond1, linked to the backup network and
# running a service on a virtual IP that will be used by clients to send their data:
 
[root@mybckserver ~]# ifconfig | egrep "Link|inet add"
bond0     Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
          inet addr:10.69.961.124  Bcast:10.69.961.255  Mask:255.255.255.0
bond1     Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
          inet addr:10.256.11.117  Bcast:10.256.11.255  Mask:255.255.255.0
bond1:0   Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
          inet addr:10.256.11.118  Bcast:10.256.11.255  Mask:255.255.255.0
eth0      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
eth1      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:15
eth2      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:14
eth3      Link encap:Ethernet  HWaddr 24:6E:G6:H7:99:17
eth4      Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
eth6      Link encap:Ethernet  HWaddr A0:36:MF:C8:DC:88
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
 
 
# To avoid overloading the public administrative network, I would like to configure the
# backup interface so all the requests are answered over this interface, this is, I'll force
# all outgoing packets to go out via the interface they came in.
 
# With my current configuration, all the ping requests made to my backup service, "bck-srv",
# are answered via bond0 instead of bond1:
 
[root@client01 ~]# ping -c 2 bck-srv
PING bck-srv.syscookbook.mydomain.org (10.256.11.118) 56(84) bytes of data.
64 bytes from bck-srv.syscookbook.mydomain.org (10.256.11.118): icmp_seq=1 ttl=63 time=0.301 ms
64 bytes from bck-srv.syscookbook.mydomain.org (10.256.11.118): icmp_seq=2 ttl=63 time=0.333 ms
 
--- bck-srv.syscookbook.mydomain.org ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.301/0.317/0.333/0.016 ms
 
# Incoming traffic arriving on bond1...
 
root@mybckserver:/root#> tcpdump -i bond1 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
13:06:26.359950 IP client01.syscookbook.mydomain.org > bck-srv.syscookbook.mydomain.org: ICMP echo request, id 14191, seq 1, length 64
13:06:27.359453 IP client01.syscookbook.mydomain.org > bck-srv.syscookbook.mydomain.org: ICMP echo request, id 14191, seq 2, length 64
 
2 packets captured
3 packets received by filter
0 packets dropped by kernel
 
# ...was answered using bond0:
 
root@mybckserver:/root#> tcpdump -i bond0 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:06:26.360003 IP bck-srv.syscookbook.mydomain.org > client01.syscookbook.mydomain.org: ICMP echo reply, id 14191, seq 1, length 64
13:06:27.359477 IP bck-srv.syscookbook.mydomain.org > client01.syscookbook.mydomain.org: ICMP echo reply, id 14191, seq 2, length 64
 
2 packets captured
13 packets received by filter
0 packets dropped by kernel
 
 
# This was the default routing table:
 
root@mybckserver:/root#> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.256.11.0     0.0.0.0         255.255.255.0   U     0      0        0 bond1
10.69.961.0     0.0.0.0         255.255.255.0   U     0      0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1010   0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1011   0        0 bond1
0.0.0.0         10.69.961.1     0.0.0.0         UG    0      0        0 bond0
 
 
# No special route or rule declared:
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/rule*
ls: cannot access /etc/sysconfig/network-scripts/rule*: No such file or directory
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/route*
ls: cannot access /etc/sysconfig/network-scripts/route*: No such file or directory
 
 
# At this point, to redirect all the backup traffic through the dedicated interface, I
# would need to define new routes for each VLAN connecting to my server for backups
# purposes.
 
# Should I do this, on one hand, in the long term I would have an enormous routing table,
# not easy to manage, and on the other hand I would run the risk of forgetting adding new
# VLANs to the routing table so I thought that it would be better to redirect ALL the
# replies to the requests received on bond1 through this interface.
 
 
# First, I create a new routing table dedicated to bond1:
 
root@mybckserver:/root#> ip route add 10.256.11.0/24 dev bond1 table 1
root@mybckserver:/root#> ip route add default via 10.256.11.1 dev bond1 table 1
 
# And then I add some rules to link bond1 to the previously created table and process all
# the traffic received on the corresponding IPs by this new routing table:
 
root@mybckserver:/root#> ip rule add iif bond1 table 1
 
root@mybckserver:/root#> ip rule add from 10.256.11.117 table 1
root@mybckserver:/root#> ip rule add from 10.256.11.118 table 1
 
 
# This is the my configuration:
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/rule*
-rw-r--r-- 1 root root 70 Feb 20 13:17 /etc/sysconfig/network-scripts/rule-bond1
 
root@mybckserver:/root#> ls -lrt /etc/sysconfig/network-scripts/route*
-rw-r--r-- 1 root root 72 Feb 20 13:17 /etc/sysconfig/network-scripts/route-bond1
 
root@mybckserver:/root#> cat /etc/sysconfig/network-scripts/route-bond1
10.256.11.0/24 dev bond1 table 1
default via 10.256.11.1 dev bond1 table 1
 
root@mybckserver:/root#> cat /etc/sysconfig/network-scripts/rule-bond1
iif bond1 table 1
from 10.256.11.117 table 1
from 10.256.11.118 table 1
 
 
# I'll restart the network service to verify that everything is ok with this configuration
 
root@mybckserver:/root#> service network restart
 
 
# And, as a result, all the traffic received on bond1 is using the default gateway of the
# new routing table and thus all the backup traffic will go through the dedicated interface,
# as expected ("dsmc" makes part of the commercial suite I'm using for backups):
 
[root@client01 ~]# dsmc
IBM Tivoli Storage Manager
Command Line Backup-Archive Client Interface
  Client Version 7, Release 1, Level 6.4
  Client date/time: 02/20/2018 13:14:06
(c) Copyright by IBM Corporation and other(s) 1990, 2016. All Rights Reserved.
 
Node Name: client01
Session established with server MYSERVER: Linux/x86_64
  Server Version 7, Release 1, Level 8.0
  Server date/time: 02/20/2018 13:14:06  Last access: 02/14/2018 15:56:30
 
tsm> quit
 
# Incoming traffic arriving on bond1...
 
root@mybckserver:/root#> tcpdump -i bond1 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
[...]
13:14:06.681180 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [.], ack 7978, win 169, length 0
13:14:10.899841 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [P.], seq 572:576, ack 7978, win 169, length 4
13:14:10.900082 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [F.], seq 576, ack 7978, win 169, length 0
13:14:10.913489 IP bck-srv.syscookbook.mydomain.org.imtc-mcs > client01.syscookbook.mydomain.org.40916: Flags [F.], seq 7978, ack 577, win 149, length 0
13:14:10.913812 IP client01.syscookbook.mydomain.org.40916 > bck-srv.syscookbook.mydomain.org.imtc-mcs: Flags [.], ack 7979, win 169, length 0
 
28 packets captured
28 packets received by filter
0 packets dropped by kernel
 
 
# ...not being replied anymore via bond0:
 
root@mybckserver:/root#> tcpdump -i bond0 host client01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes
 
0 packets captured
10 packets received by filter
0 packets dropped by kernel
 
 
# ...now I can't see the new configuration for bond1 on the default routing table
 
root@mybckserver:/root#> route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.256.11.0     0.0.0.0         255.255.255.0   U     0      0        0 bond1
10.69.961.0     0.0.0.0         255.255.255.0   U     0      0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1010   0        0 bond0
169.254.0.0     0.0.0.0         255.255.0.0     U     1011   0        0 bond1
0.0.0.0         10.69.961.1     0.0.0.0         UG    0      0        0 bond0
 
 
# For that I have to look directly in the new routing table:
 
root@mybckserver:/root#> ip route show table 1
10.256.11.0/24 dev bond1  scope link
default via 10.256.11.1 dev bond1
 
 
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
15 Linux Yum Command Examples – Install, Uninstall, Update Packages
Viewed 861 times since Thu, Oct 25, 2018
Linux An introduction to swap space on Linux systems
Viewed 321 times since Thu, Jan 23, 2020
RHEL: Extending a vmdk (Virtual Machine disk)
Viewed 1033 times since Sun, May 27, 2018
RHEL: Multipathing basics
Viewed 1161 times since Sat, Jun 2, 2018
ZPOOL: Create a new zpool for zfs filesystems
Viewed 769 times since Sun, Jun 3, 2018
6 rsync Examples to Exclude Multiple Files and Directories using exclude-from
Viewed 495 times since Wed, Oct 31, 2018
Watchdog script to keep an application running
Viewed 1264 times since Tue, Jul 31, 2018
RHEL: Rebuilding the initial ramdisk image
Viewed 1519 times since Sat, Jun 2, 2018
Open SSL Creating Certificate Signing Request — CSR Generation
Viewed 558 times since Mon, Feb 18, 2019
debian Debian/Ubuntu Linux: Find If Installed APT Package Includes a Fix/Patch Via CVE Number
Viewed 479 times since Sun, Sep 23, 2018