Multiple gateways problem

Alexander Samad alex at
Fri Apr 1 01:52:11 CEST 2005

On Thu, Mar 31, 2005 at 06:37:50PM +0200, Rub?n Cardenal wrote:
> Hash: SHA1
> Hi,
>   I have a quite simple setup in ony of my servers but I can't make
> the conditional routing using iptables to work.
>   The server has:
>   eth0:
>   eth1/eth2: reserved for future use
>   eth3:
>   The eth3 is connected to a separate switch where 30 AP's are
> connected to and a dhcp server running on the server gives IP's to
> clients connected to the wireless lan. In the same way, eth0 is
> connected to another set of switchs (isolated from the switch where
> eth3 is connected to) where all LAN clients ( are
> connected to.
>   I can use two gateways, both of them are accessed via eth0:
> and The default gateway for all the LAN
> clients ( is (and must be) and just a
> few people is allowed to use the other gateway.
>   The desired configuration is that I want to be able to route
> certain clients from eth3 ( via instead
> of the default gw of the server (
>   All the configurations I've tried, doesn't work or make LAN clients
> loose connectivity with the server. How should I setup routes/rules?
if you can group your users to specific networks then you can use

ip ru for something like this

0:      from all lookup local 
200:    from lookup wireless 
201:    from lookup plana 
201:    from lookup planb 
32766:  from all lookup main 
32767:  from all lookup default 

or in using iptables -t mangle and PREROUTING you can mark your packets
with -m mark --set-mark 0x01

iptables -t mangle -I PREROUTING -s -m mark --set-mark
iptables -t mangle -I PREROUTING -s -m mark --set-mark
iptables -t mangle -I PREROUTING -s -m mark --set-mark

and then use ip ru sort of like

0:      from all lookup local 
200:    fwmark 0x01 lookup wireless 
200:    fwmark 0x02 lookup plana
200:    fwmark 0x03 lookup planb 
32766:  from all lookup main 
32767:  from all lookup default 

and then fill the tables with the appropiate routing rules

note - I split your back into 2 /24 just for example, you
might need to check the syntax of the -m mark target as well.


>   Regards,
> - - Ruben.
> Version: PGP 8.1
> iQA/AwUBQkwnXQcpyqBKAkY5EQLdOwCg/rIS18MM5mKYfXjEhvSiCPgOV1QAmwZ7
> TG3o6vj9sH7NQXoVkgUsBcvS
> =BTkL
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : /pipermail/netfilter/attachments/20050401/cda03b4c/attachment.bin

More information about the netfilter mailing list