Policy Based Routing

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 00:13, 25 February 2014 (edit)
Sash (Talk | contribs)
(Source Based Routing)
← Previous diff
Revision as of 14:44, 1 November 2019 (edit) (undo)
Jeremywh7 (Talk | contribs)
m (References - Add forum link)
Next diff →
Line 32: Line 32:
==References== ==References==
-http://lartc.org/howto/lartc.rpdb.html#LARTC.RPDB.SIMPLE+Forum post with many guides and scripts: [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686 Policy Based Routing guide for DDWRT]<br>
 +Linux Advanced Routing & Traffic Control: [http://lartc.org/howto/lartc.rpdb.html#LARTC.RPDB.SIMPLE Simple source policy routing]<br>
 + 
[[Category:Routing]] [[Category:Routing]]
[[Category:Advanced tutorials]] [[Category:Advanced tutorials]]

Revision as of 14:44, 1 November 2019

Contents

Introduction

Traditional routing functions by sending packets out interfaces depending on where the destination address is by keeping a routing table of which networks are connected to which interfaces. Policy Based Routing is an advanced concept that sends packets based on other criteria such as the source address or TCP port. It does this by creating multiple routing tables and rules that specify which routing table to use when certain criteria are met. Source based policy routing is fairly easy to configure and doesn't require much thought but other forms of policy routing require much more thought to ensure that it functions.

Routing Commands

Source Based Routing

Source based routing only requires a few commands:

ip rule add from [source IP]/[netmask] table 200
ip route add default via [gateway] dev [interface] table 200
ip route flush cache

The [source IP] should be whatever the IP of the machine is that you want to be routed differently, optionally with a [netmask] to specify a block of source addresses to route differently. The [gateway] should be the IP of the next router to send traffic to such as your VPN server or the gateway IP of your ISP. The [interface] should be whichever interface the traffic needs to be sent out to reach the alternative gateway such as tun0 for a VPN.

Example:

ip rule add from 192.168.1.128/28 table 200
ip route add default via 10.0.0.1 dev ppp0 table 200
ip route flush cache

You can show the table content with (might not work on crippled ip route)

ip route list table table 200
ip rule show

Integrating the Commands

With OpenVPN

Your routing commands need to go in the route-up script. See the OpenVPN guide for examples of how to configure route-up scripts.

With PPTP

Your routing commands need to go in the /tmp/pptpd_client/ip-up script, or maybe .ipup as per Script Execution (needs testing).

With A Physical Interface

Your routing commands can go in the firewall script on the Administration->Commands page.

References

Forum post with many guides and scripts: Policy Based Routing guide for DDWRT
Linux Advanced Routing & Traffic Control: Simple source policy routing