RE: Routing the DNS Traffic via specific interface.

[Netravali Ganesh <gnetravali@xxxxxxxxxxxx>]

Hi..

Thanks for the help. This worked excellent for me. I have another question on this.

Suppose if I have 2 interfaces say eth2 and eth3. If I want to implement conditional routing, say ex, eth2 is down and all DNS traffic needs to redirect via eth3 upon detecting the link failure, how do I do that.



Thanks
Ganesh Netravali


-----Original Message-----
From: gapsf@xxxxxxxxx [mailto:gapsf@xxxxxxxxx] 
Sent: Wednesday, January 25, 2012 3:04 PM
To: netfilter@xxxxxxxxxxxxxxx; Netravali Ganesh
Subject: Re: Routing the DNS Traffic via specific interface.

No. You should use "Policy routing" with MARK target in iptables.

Mark outgoing DNS packets with iptables in mangle PREOROUTING for example.
# iptables -t mangle -A PREROUTING -p udp --dport 53 -j MARK --set-mark 0x4

Create additional routing table with different routing rules.
Add new entry in /etc/iproute2/rt_tables =========================================
#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1     inr.ruhep
1      isp2 # <- new entry
=========================================

Then execute
# ip route flush table isp2
and add defalt route into newly created table # route add default via <ip_of_your_eth2_gateway> dev eth2 table isp2

Add new policy in RPDB.
# ip rule add from all fwmark 0x4 table isp2

Check RPDB
# ip rule show
You should view somthing like this:
0:      from all lookup local
32763:  from all fwmark 0x4 lookup isp2
32766:  from all lookup main
32767:  from all lookup default

In result: all traffic routed with main routing table, except marked DNS traffic routed via "isp2" routing table via its default route and iface.
View picture http://postimage.org/image/nn9owf5x7/ for example.

NG> Hi ..

NG> I have 2 interfaces eth0 and eth1 on the system connected to different subnets. I need to route all the outgoing DNS traffic of the system via eth1 interface. Pls let me know if below IPTABLES rules is proper way ?

NG> Block the output DNS traffic on eth0 interface.

NG> iptables -A FORWARD -p udp -o eth0 --dport 53 -j DROP

NG> Forward output DNS traffic from eth1 interface

NG> iptables -A FORWARD -p udp -o eth1 --dport 53 -j ACCEPT


NG> Thanks
NG> Ganesh


NG> --
NG> To unsubscribe from this list: send the line "unsubscribe netfilter" 
NG> in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo 
NG> info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html