Centos – Multihoming with iproute2 and multiple VLANs

centosroutingvlan

I'm currently in charge of setting up our office's Linux router. We've been operating with two VLANs (one for data, one for voice) and a single WAN connection. Recently, we've had issues with our primary WAN provider, so we've gotten a more stable channel with substantially less bandwidth exclusively for our VOIP traffic. I'm running into a bit of an issue with setting up our CentOS machine to do multihoming properly. Here's our current layout:

eth0 – hardware NIC
eth0.2 – data WAN provider
eth0.3 – voice WAN provider
eth0.4 – internal data LAN
eth0.5 – internal VoIP lan

I currently have all traffic routed to the default gateway for eth0.2. What I want to do is make sure that traffic that is intended for our VoIP system gets routed to eth0.5, and that all VoIP traffic then goes out on eth0.3. I may be overcomplicating this, but I do need VLAN seperation between our data devices and our voice devices, and I'm not sure of any better way to do it. My understanding is that, using iproute2, I need to create two tables for the specific routing, and then make sure that the voice traffic is explicitly set to go out on eth0.3. I'm not sure exactly where to start looking for resources, and I'm relatively new to the CentOS world, so I was hoping even for some basic primers on where to look (I have gone through man for iproute2, iptables, and tc, but it's all a little bit over my head). Thanks in advance!

Best Answer

First set up basic multihoming:

echo -e "200\tuplink2" >> /etc/iproute2/rt_tables
echo "default table uplink2 via GA.TE.WA.Y2" > /etc/sysconfig/network-scripts/route-eth1
echo "from IP.AD.DR.ES table uplink2" > /etc/sysconfig/network-scripts/rule-eth1

after that you need to create iptables rules to match and mark your VOIP traffic:

iptables -A PREROUTING -t mangle <some voip matching> -j MARK --set-mark 0x1

and add this rule to actually route marked packets

echo "ip rule add from all fwmark 0x1 table uplink2" > /etc/sysconfig/network-scripts/rule-eth1

and don't forget to restart networking:

service network restart
Related Topic