Routing traffic on an ethernet alias to a default gateway

routingubuntu-10.04

This question is related to a previous one I asked.

I want to set up an OpenVPN dual client box such that a computer whose gateway is set to eth0:0 gets all their traffic routed through one OpenVPN tunnel, and a computer whose gateway is set to eth0:1 gets all their traffic routed through a different OpenVPN tunnel. Eventually, I want to be able to have multiple computers connecting to my dual client box, sharing that OpenVPN tunnel (but unaware of each other).

Diagram
(source: serahill.com)

I've set up the ethernet aliases in my dual client box and I've set my gateway on a connecting host to an ethernet alias on the dual client box. However, the routing doesn't appear to be happening properly. Any pings from my connecting host go directly to the default gateway of the dual client box instead of being routed through the tunnel.

These are the route commands I'm using once the tunnel is set up:

ip route add default dev $1 table us_table
ip rule add from [ip address of my ethernet alias] table us_table
ip route flush cache
iptables -t nat -A POSTROUTING -o $1 -j MASQUERADE[/code]

This is the routing table after the tunnel's set:

root@ahost:/etc/openvpn# ip route show
10.26.0.0/24 via 10.26.0.1 dev tun0 
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.242 
10.26.0.0/16 dev tun0  proto kernel  scope link  src 10.26.0.2 
default via 192.168.1.1 dev eth0  metric 100

This is the us_table routing table:

root@ahost:/etc/openvpn# ip route show table us_table
default dev tun0  scope link 

My rules:

root@ahost:/etc/openvpn# ip rule show
0:  from all lookup local 
32765:  from 192.168.1.242 lookup us_table 
32766:  from all lookup main 
32767:  from all lookup default 

Any suggestions on what I'm missing or doing wrong? I'm stumped here…

Best Answer

You have set the rule to match the ethernet alias address:

ip rule add from [ip address of my ethernet alias] table us_table

However, this will never match, as the masquerading is in the POSTROUTING chain, i.e. it happens after the routing decisions have already been made.

I have never used policy based routing, so I can only guess what you might have to do to get this working. The man page says that you can perform NAT before other rules, this might be able to sort you out. Alternatively you could use the actual IP address of the laptops or workstations as the source addresses (or ranges).