Linux Router with Single NIC

iptableslinuxnetworkingroutingvlan

Suppose I have a small network, with a number of VLANs as follows:

VLAN1 10.1.1.0/24

VLAN2 10.1.2.0/24

VLAN3 10.1.3.0/24

VLAN routing is taken care of by the core switch, the switch doesn't do policy based routing (Dell PowerConnect 6224F), so it will only take a default route for all other traffic that falls outside of the VLANs above. (i.e. 0.0.0.0/0).

Now suppose I have two internet connections, each with a NAT DSL modem on VLAN1 (say 10.1.1.16 and 10.1.1.17), and I want devices on VLAN2 to use one internet connection and devices on VLAN3 to use the other, I was thinking of using a Linux box to achieve this.

Say I configure a Linux box (10.1.1.8), and configure the default gateway on the core switch to point to 10.1.1.8, is it then possible to configure IPTables on the Linux box to do what I need?

Most how-to guides for setting up a Linux based router have two two network interfaces as a requirement, but I don't think this is needed in this scenario as this Linux box will simply sit on the same VLAN as the DSL modems. (plus I don't currently have any spare NICs to put in the server I have), so my question is, (assuming it is possible) can anyone provide me with some guidance to create some IP tables rules to take care of this?

I might also in the future like all HTTP connections to be transparently proxied, ideally via a shared squid instance, but still routing requests down the appropriate DSL connection.

Edit:

I've no need to route between VLANs, as the core switch is already doing this fine. I'm perhaps not getting the terminology right, but if I configure the default route for 0.0.0.0/0 on the core switch to be 10.1.1.8, can I configure the Linux box to redirect packets down the correct DSL gateway, depending upon the source of the packet?

An example of what I'm trying to achieve…

PC on VLAN3 (10.1.3.123) sends a packet to 1.2.3.4. The default gateway on the PC is 10.1.3.1 (i.e. the routing interface on VLAN3), the switch then routes this packet via 10.1.1.1 to 10.1.1.8 (the switch is configured to use this IP as the next hop for 0.0.0.0/0). The Linux box then routes/redirects that packet via the DSL modem 10.1.1.17, because the source IP was within VLAN 3 (10.1.3.0/24). Had the packet have originated from 10.1.2.0/24, then the Linux box would route/redirect via 10.1.1.16

                      VLAN 1
                   (10.1.1.0/24)
  10.1.1.16 (DSL1) ------+
                         |
  10.1.1.17 (DSL2) ------+
                         |
  10.1.1.8 (Linux) ------+
                         |
                  +-------------+
   VLAN 2  -------| Core Switch |-------  VLAN 3
(10.1.2.0/24)     +-------------+      (10.1.2.0/24)

Further Edit:

I guess I've not explained very well what I'm trying to achieve here, but please bear with me a bit here, as I'm not a network guru (just in case you haven't already detected this!).

I don't want to create multiple interfaces on the linux box, as I don't want it doing any routing between VLANs, I just want the box to sit on one of the VLANs (single interface) and forward (or route?) packets via DSL1 or DSL2, depending upon the source of the packet. If 10.1.1.8 is the default route for 0.0.0.0/0 on our network, surely this can be done?

Best Answer

What you're proposing is certainly possible, infact it's a very common network configuration to have a layer 3 switch doing the bulk of your internal routing and providing some basic access controls then offloading more complicated traffic to the edge/core.

Your Linux edge router will need to be aware of all the subnets behind the switch - you can do this with static routes, eg:

route add -net 10.1.1.0/16 gw <switch IP>

Or the Dell switch (from a quick google) supports RIP and OSPF, so you could get it to advertise it's routes to the Linux box automatically if you used Quagga or similar to pick up the advertisements.

Your clients will only need to be configured with their default gateway (the switch interface on their VLAN) and have appropriate ACLs in place on the switch to allow their traffic out to the edge.

Unfortunately I've not done PBR on Linux so can't give you any magic rules and can only really point at an article Google found - looks relevant though. Don't get too hung up on the multiple interface thing though, it's easy to make one interface into multiple on Linux by either creating aliases (ifconfig eth0:25 <ipaddr>) or VLANs (ifconfig eth0.25 <ipaddr>).

Related Topic