unable to forward route 443 to a specific interface

Cr0t · l33t Joined: 27 Apr 2002 Posts: 945 Location: USA

The server has two NIC, eth0 and eth1 both are connected to the same network. Both of them are using the same gateway. I have one host, which I want to route through eth1. The issue is that the target is in a cluster and has a bunch of IPs. I could run an "ip route add TARGET_IP via GW dev eth1 src SOURCE_IP", but the cluster is constantly rotating through different IPs and responding back through different IPs.

The good part is that the traffic always goes through 443. Anyway I can just forward 443 to/through eth1 via iptables? I tried it, but for some reason only the first couple of bytes go through eth1, but then it falls back to eth0.

Any ideas?
_________________
cya

©®0t

gentoo_ram · Posted: Sat Jul 21, 2012 5:47 pm Post subject:

Why do you have eth0 and eth1 on the same network? That's probably not going to work like you expect and is generally not the best practice.

Routing happens at the IP layer. All that's relevant in routing are the source and destination IP addresses. Ports are up at the higher TCP/UDP layers. You can't "route" based on port.

iptables is a firewall. It doesn't control routing.

You will need to describe what the real goal is. Also, give the output of 'ip addr show; ip route show'. What IP addresses are you trying to reach?

papahuhn · l33t Joined: 06 Sep 2004 Posts: 626

You can mark packets based on the TCP port within the OUTPUT- or PREROUTING-chain of the mangle table (depending of where your packets come from). Additionally, you need to set up an additional routing table for those packets, and match them via "ip rule add fwmark ..."

Addendum:

You should also consider your arp_filter and/or arp_ignore settings. In the traditional setup, an interface will respond to ARP with its MAC address, even if the requested IP address is owned by another interface on the same host. Maybe that is what you have experienced.
_________________
Death by snoo-snoo!