No, but you can do all kinds of that stuff with iptables and advanced routing. I think you need advanced routing.
With advanced routing you can set up multiple routing tables that are used as a function of the ip address for instance of the host that wants a connection (from the top of my head). Perhaps there are better ways.
For some leads see a sniplet of text from my site:
#
What you can do with mangling table in iptables is to look at where your packet is coming from in addition to what port it is using (80 or 25 and so on) and decide on the basis of that where you want the packet to be routed to. So you can give some email, http, ssh traffic a different default gateway from other email, http, ssh traffic, depending on where it came from.
Notice that you cannot do this with normal routing, or source/destination nat. With normal routing you cannot split on the basis of where traffic comes from. You also cannot split on the basis of service, although destination nat can do this to some degree.
This is for instance usefull when you have two routes to the internet and you want some traffic to go over one, and other traffic over the other connection. You could also split up routes between services, for instance between http and email for instance.
So for instance you want to reroute all port 80 (http) from your internal network going to the internet to go to your server, which is a proxy. But not for a specific range of servers: your intranet servers that are in your dmz. How do you do that?
1. iptables -t mangle -A OUTPUT -p tcp --dport 80 -d ! 197.157.136.240/28 -s 197.157.136.242/32 -j MARK --set-mark 1
Here you mangle traffic to be marked "1" going out the output chain of your firewall, with destination port 80 (http); but not to your dmz (197.157.136.240/28), coming from your internal network 197.157.136.242/32.
Notice that the mangle table only exists in the prerouting and output chain. You cannot mangle at other places like input, forward and so on.
2. To make packets that are marked with "1" get another route we will: A. make a new routingtable 100; B. We will call that table marky with an alias; C. We will send traffic with a mark 1 to route table marky; D. we will give route table marky a default route different from the normal default route.
First we call table 100 marky by alias:
echo 100 marky > /etc/iproute2/rt_tables
Second we send all marked traffic to that table:
ip rule add fwmark 1 table marky
Third we add a defualt gateway to route table marky:
ip route add default via 210.99.155.97 dev eth2 table marky
See the advanced routing howto for the syntax here or man ip route.
That is it!
3 Replies
781 Views