Monthly Archive for Januar, 2011

Linux IProute – Source based routing

Published on Januar 24, 2011 in Internet and Linux. 0 Comments

Source based routing is usefull if you want to divert your traffic to different outgoing network interfaces based on their source IP. Of course this is only usefull if your system has more than on IP address and network interface.

The key to source based routing is the concept of multiple routing tables. Each of these routing tables has its own set of rules, including lo and a default gateway. These tables are created using the ip route command with a table NR suffix. The packets enter these tables if they are direct there by ip rules create with the ip rule command.

If you want to handle all traffic from sourceip /netmask via interface ethX, you’d need two rules for this traffic and some default rules for the remaining traffic as show below.

ip rule flush
 
ip rule add prio 200 from <sourceip /netmask> lookup 250
ip rule add prio 32700 from all lookup main
ip rule add prio 32750 from all lookup default
 
ip route add 127.0.0.0/8 dev lo table 250
ip route add destip/net via dev ethX table 250
ip route add default via <defaultgw> table 250</defaultgw></sourceip>

IPTables Passive FTP Connection Tracking on non-standard ports

Published on Januar 1, 2011 in Verschiedenes. 0 Comments Tags: , , , .

Ever tried to run a Linux FTP Server behind a IPTables firwall on non-standard ports, i.e. not on port 21?

The problem is that the FTP connection tracking module nf_conntrack_ftp only watches port 21. If you want to use other ports the module must be loaded with the parameter “ports=21,5367″ if you want to run an ftp server on port 21 and one on port 5367. The usual other iptables rules apply, too.