Re: Routing the DNS Traffic via specific interface.

[gapsf@xxxxxxxxx]

Well, I know two ways,
but I don't know what is right from the standpoint of an more experienced sysadmin.
Solution #1
Script that periodically do "health check" of a link (i.e. route) by ping
some reliable host (router) reachable via eth2.
See example below. Run it in background from another bash script like `chkroutes &`.
Or even try to connect to DNS-server with `nc` instead of pings:
`nc -c exit -w1 <ip_of_DNS_server> 53`
Because ISPs equipment hardware exploited in this scenario,
I do not know whether it is acceptable according to netiquette.
If you want to react only to the interface down on gateway you should
use somthing like "post-up", "post-down" in /etc/network/interfaces in Debian.
On post-up add rule in RPDB, on post-down you delete this entry.
For tarffic switching you have three options:
- modify additional routing tables isp2: add/delete default route or
- modify RPDB rules: add/delete 'from all fwmark 0x4 lookup isp2' entry or even
- modify iptables rules - add/delete MARK rule.

Solution #2
Use dynamic routing protocols and daemons like zebra or quagga.
For me it's look like overkill in this simple situation.
And I still can't undestand how exactly routing daemon on gateway finds that route is dad.
So applicability of dynamic routing for this purposes is still unclear for me.

=== chkroutes =======================================================================================
#!/bin/sh

SWITCHED=0
TARGET=<some_reliable_host>

test_route2_cycle()
{
    while true; do
        ping -I eth2 -c3 $TARGET
        PING=$?
        if [ "$PING" == "0" && "$SWITCHED" == "1"]; then
            # TARGET reachable
            ip rule add from all fwmark 0x4 table inet2
            ip route flush cache
            SWITCHED=0
        else
            # TARGET unreachable
            if [ "$SWITCHED" == "0" ]; then
                ip rule del from all fwmark 0x4 table inet2
                ip route flush cache
                SWITCHED=1
            fi
        fi
        sleep 10
    done
}

echo $$ > /var/run/chkroutes.pid
test_route2_cycle
==============================================================================================


NG> Hi..
NG> Thanks for the help. This worked excellent for me. I have another question on this.
NG> Suppose if I have 2 interfaces say eth2 and eth3. If I want to implement conditional routing, say ex, eth2 is down and all DNS traffic needs to redirect via eth3 upon detecting the link failure, how do I do that.



NG> Thanks
NG> Ganesh Netravali


NG> -----Original Message-----
NG> From: gapsf@xxxxxxxxx [mailto:gapsf@xxxxxxxxx] 
NG> Sent: Wednesday, January 25, 2012 3:04 PM
NG> To: netfilter@xxxxxxxxxxxxxxx; Netravali Ganesh
NG> Subject: Re: Routing the DNS Traffic via specific interface.

NG> No. You should use "Policy routing" with MARK target in iptables.

NG> Mark outgoing DNS packets with iptables in mangle PREOROUTING for example.
NG> # iptables -t mangle -A PREROUTING -p udp --dport 53 -j MARK --set-mark 0x4

NG> Create additional routing table with different routing rules.
NG> Add new entry in /etc/iproute2/rt_tables =========================================
NG> #
NG> # reserved values
NG> #
NG> 255     local
NG> 254     main
NG> 253     default
NG> 0       unspec
NG> #
NG> # local
NG> #
NG> #1     inr.ruhep
NG> 1      isp2 # <- new entry
NG> =========================================

NG> Then execute
NG> # ip route flush table isp2
NG> and add defalt route into newly created table # route add default via <ip_of_your_eth2_gateway> dev eth2 table isp2

NG> Add new policy in RPDB.
NG> # ip rule add from all fwmark 0x4 table isp2

NG> Check RPDB
NG> # ip rule show
NG> You should view somthing like this:
NG> 0:      from all lookup local
NG> 32763:  from all fwmark 0x4 lookup isp2
NG> 32766:  from all lookup main
NG> 32767:  from all lookup default

NG> In result: all traffic routed with main routing table, except marked DNS traffic routed via "isp2" routing table via its default route and iface.
NG> View picture http://postimage.org/image/nn9owf5x7/ for example.

NG>> Hi ..

NG>> I have 2 interfaces eth0 and eth1 on the system connected to different subnets. I need to route all the outgoing DNS traffic of the system via eth1 interface. Pls let me know if below IPTABLES rules is proper way ?

NG>> Block the output DNS traffic on eth0 interface.

NG>> iptables -A FORWARD -p udp -o eth0 --dport 53 -j DROP

NG>> Forward output DNS traffic from eth1 interface

NG>> iptables -A FORWARD -p udp -o eth1 --dport 53 -j ACCEPT


NG>> Thanks
NG>> Ganesh


NG>> --
NG>> To unsubscribe from this list: send the line "unsubscribe netfilter" 
NG>> in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo 
NG>> info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html