LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 11-28-2006, 09:48 PM   #1
jvolkman
LQ Newbie
 
Registered: Nov 2006
Posts: 3

Rep: Reputation: 0
Route all HTTP traffic through wired interface on workstation


I have a Linux (Ubuntu Edgy) workstation that I use at work. I have access to two separate networks via a wireless and a wired connections:

eth0: ip=10.20.65.xx, gateway=10.20.65.1 [wired]
eth1: ip=192.168.40.xx, gateway=192.168.40.1 [wireless]

The wired network gives me access to the entire web via port 80 and 443, and some internal subnets.
The wireless network gives me complete access to the internet, but not to the internal network (Exchange and development servers).

My ultimate goal is to have all http/https routed over the wired network, as it is faster. Everything else that's not internal should go over the wireless (e.g., AIM, IRC, remote SSH).

I found documentation on iptables and iproute2, and started playing around. I've gotten as far as setting an iptables rule to mark all outgoing http packets, and setting an ip rule to route the marked packets to the wired connection:

iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 2
ip rule add fwmark 2 table 220
ip route add via 10.20.65.1 dev eth0 table 220
ip route flush cache

As soon as I add the route, outgoing HTTP requests stop responding. 'iptables -vnL -t mangle' lists increasing counts for packets matching my MARK rule, so I assume they're being marked.

At this point I'm stuck at broken HTTP. I've found a lot of documentation about doing this kind of stuff on a Linux router, using the PREROUTING chain, however I haven't found much on routing packets generated from the same machine. Can this be done?

Thanks
 
Old 11-29-2006, 08:11 AM   #2
ScooterB
Member
 
Registered: Sep 2003
Location: NW Arkansas
Distribution: Linux Redhat 9.0, Fedora Core 2,Debian 3.0, Win 2K, Win95, Win98, WinXp Pro
Posts: 344

Rep: Reputation: 31
The way that Linux handles routing and the firewall is via an alogorithym. There are basically three "areas". Input, Output and Forward corresponding to the chains. If a packet is destined to be forwarded, it doesn't go through the Input or Output chains. It will go through the Forward chain. The Input and Output strictly address the machine that IPTables is running on. So, you have to stop and think about the path that the packets must take a write your rules accordingly. If you are wondering if it is the firewall or not, turn off the firewall and then try it. If it goes through, it must be the firewall. If it doesn't, then it might be a routing issue (i.e., default routes?). Take a look at it and repost.
 
Old 11-29-2006, 10:30 AM   #3
jvolkman
LQ Newbie
 
Registered: Nov 2006
Posts: 3

Original Poster
Rep: Reputation: 0
I think I found at least one of my problems. I setup my routes as described before, and then caught traffic on eth0 with Wireshark while making HTTP requests. The thing that doesn't look right is:

ARP: Who has 10.21.65.1? Tell 192.168.40.183

192.168.40.183 is the wireless NIC's IP. eth0's IP is 10.21.65.149. Does this mean that the source address is being written to the outgoing packet before the routing stage? It seems as though the routing should write 10.21.65.149 as the source address.
 
Old 11-29-2006, 12:35 PM   #4
ScooterB
Member
 
Registered: Sep 2003
Location: NW Arkansas
Distribution: Linux Redhat 9.0, Fedora Core 2,Debian 3.0, Win 2K, Win95, Win98, WinXp Pro
Posts: 344

Rep: Reputation: 31
When you have two interfaces and am trying to route between them, you should have a source nat (snat) statement I believe. That way, all of the traffic coming from interface A is represented to the router as interface A's address. Then it knows what to do with it. Same goes for the other interface. Try that and repost.
 
Old 11-29-2006, 02:46 PM   #5
jvolkman
LQ Newbie
 
Registered: Nov 2006
Posts: 3

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by ScooterB
When you have two interfaces and am trying to route between them, you should have a source nat (snat) statement I believe. That way, all of the traffic coming from interface A is represented to the router as interface A's address. Then it knows what to do with it. Same goes for the other interface. Try that and repost.
That was it. Adding the SNAT rule makes everything work. Thanks.
 
Old 11-29-2006, 08:51 PM   #6
ScooterB
Member
 
Registered: Sep 2003
Location: NW Arkansas
Distribution: Linux Redhat 9.0, Fedora Core 2,Debian 3.0, Win 2K, Win95, Win98, WinXp Pro
Posts: 344

Rep: Reputation: 31
You're quite welcome! That's what we are all here for.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Traffic shaping (limiting outgoing bandwidth of all TCP-traffic except FTP/HTTP) ffkodd Linux - Networking 3 10-25-2008 12:09 AM
Bridging Wireless interface with the Wired one hohenzolern Linux - Wireless Networking 3 04-04-2006 03:49 PM
how to find http traffic and mail traffic alone? basbosco Linux - General 1 06-07-2005 10:29 PM
Laptop-net on wired/wireless interface blueplazma Linux - Wireless Networking 2 12-24-2004 02:29 PM
Route all traffic of a given type to an interface tsweatt Linux - Networking 0 09-01-2003 12:24 PM


All times are GMT -5. The time now is 12:56 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration