Split-Routing on Debian/Ubuntu

My post on split-routing on OpenWRT has been incredibly popular, and led to many people implementing split-routing, whether or not they had OpenWRT. While it's fun to have an exercise as a reader, it led to me having to help lots of newbies through porting that setup to a Debian / Ubuntu environment. To save myself some time, here's how I do it on Debian:

Background, especially for non-South Africa readers: Bandwidth in South Africa is ridiculously expensive, especially International bandwidth. The point of this exercise is that we can buy "local-only" DSL accounts which only connect to South African networks. E.g. I have an account that gives me 30GB of local traffic / month, for the same cost as 2.5GB of International traffic account. Normally you'd change your username and password on your router to switch account when you wanted to do something like an Debian apt-upgrade, but that's irritating. There's no reason why you can't have a Linux-based router concurrently connected to both accounts via the same ADSL line.

Firstly, we have a DSL modem. Doesn't matter what it is, it just has to support bridged mode. If it won't work without a DSL account, you can use the Telkom guest account. My recommendation for a modem is to buy a Telkom-branded Billion modem (because Telkom sells everything with really big chunky, well-surge-protected power supplies).

For the sake of this example, we have the modem (IP 10.0.0.2/24) plugged into eth0 on our server, which is running Debian or Ubuntu, doesn't really matter much - personal preference. The modem has DHCP turned off, and we have our PCs on the same ethernet segment as the modem. Obviously this is all trivial to change.

You need these packages installed:

# aptitude install iproute pppoe wget awk findutils

You need ppp interfaces for your providers. I created /etc/ppp/peers/intl-dsl:

user intl-account@uber-isp.net
unit 1
pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
noipdefault
defaultroute
hide-password
lcp-echo-interval 20
lcp-echo-failure 3
noauth
persist
maxfail 0
mtu 1492
noaccomp
default-asyncmap

/etc/ppp/peer/local-dsl:

user local-account@uber-isp.net
unit 2
pty "/usr/sbin/pppoe -I eth0 -T 80 -m 1452"
noipdefault
hide-password
lcp-echo-interval 20
lcp-echo-failure 3
connect /bin/true
noauth
persist
maxfail 0
mtu 1492
noaccomp
default-asyncmap

unit 1 makes a connection always bind to "ppp1". Everything else is pretty standard. Note that only the international connection forces a default route.

To /etc/ppp/pap-secrets I added my username and password combinations:

# User                     Host Password
intl-account@uber-isp.net  *    s3cr3t
local-account@uber-isp.net *    passw0rd

You need custom iproute2 routing tables for each interface, for the source routing. This will ensure that incoming connections get responded to out of the correct interface. As your provider only lets you send packets from your assigned IP address, you can't send packets with the international address out of the local interface. We get around that with multiple routing tables. Add these lines to /etc/iproute2/rt_tables:

1       local-dsl
2       intl-dsl

Now for some magic. I create /etc/ppp/ip-up.d/20routing to set up routes when a connection comes up:

#!/bin/sh -e

case "$PPP_IFACE" in
 "ppp1")
   IFACE="intl-dsl"
   ;;
 "ppp2")
   IFACE="local-dsl"
   ;;
 *)
   exit 0
esac

# Custom routes
if [ -f "/etc/network/routes-$IFACE" ]; then
  cat "/etc/network/routes-$IFACE" | while read route; do
    ip route add "$route" dev "$PPP_IFACE"
  done
fi

# Clean out old rules
ip rule list | grep "lookup $IFACE" | cut -d: -f2 | xargs -L 1 -I xx sh -c "ip rule del xx"

# Source Routing
ip route add "$PPP_REMOTE" dev "$PPP_IFACE" src "$address" table "$IFACE"
ip route add default via "$PPP_REMOTE" table "$IFACE"
ip rule add from "$PPP_LOCAL" table "$IFACE"

# Make sure this interface is present in all the custom routing tables:
route=`ip route show dev "$PPP_IFACE" | awk '/scope link  src/ {print $1}'`
awk '/^[0-9]/ {if ($1 > 0 && $1 < 250) print $2}' /etc/iproute2/rt_tables | while read table; do
  ip route add "$route" dev "$PPP_IFACE" table "$table"
done

That script loads routes from /etc/network/routes-intl-dsl and /etc/network/routes-local-dsl. It also sets up source routing so that incoming connections work as expected.

Now, we need those route files to exist and contain something useful. Create the script /etc/cron.daily/za-routes (and make it executable):

#!/bin/sh -e
ROUTEFILE=/etc/network/routes-local-dsl

wget -q http://mene.za.net/za-routes/latest.txt -O /tmp/zaroutes
size=`stat -c '%s' /tmp/zaroutes`

if [ $size -gt 0 ]; then
  mv /tmp/zaroutes "$ROUTEFILE"
fi

It downloads the routes file from cocooncrash's site (he gets them from local-route-server.is.co.za, aggregates them, and publishes every 6 hours). Run it now to seed that file.

Now some International-only routes. I use IS local DSL, so SAIX DNS queries should go through the SAIX connection even though the servers are local to ZA.

My /etc/network/routes-intl-dsl contains SAIX DNS servers and proxies:

196.25.255.3
196.25.1.9
196.25.1.11
196.43.1.14
196.43.1.11
196.43.34.190
196.43.38.190
196.43.42.190
196.43.45.190
196.43.46.190
196.43.50.190
196.43.53.190
196.43.9.21

Now we can tell /etc/network/interfaces about our connections so that they can get brought up automatically on bootup:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
        address 10.0.0.1
        netmask 255.255.255.0

auto local-dsl
iface local-dsl inet ppp
        provider local-dsl

auto intl-dsl
iface intl-dsl inet ppp
        provider intl-dsl

For DNS, I use dnsmasq, hardcoded to point to IS & SAIX upstreams. My machine's /etc/resolv.conf just points to this dnsmasq.

So something like /etc/resolv.conf:

nameserver 127.0.0.1

/etc/dnsmasq.conf:

no-resolv
# IS:
server=168.210.2.2
server=196.14.239.2
# SAIX:
server=196.43.34.190
server=196.43.46.190
server=196.25.1.11
domain=foobar.lan
dhcp-range=10.0.0.128,10.0.0.254,12h
dhcp-authoritative
no-negcache

If you haven't already, you'll need to turn on ip_forward. Add the following to /etc/sysctl.conf and then run sudo sysctl -p:

net.ipv4.ip_forward=1

Finally, you'll need masquerading set up in your firewall. Here is a trivial example firewall, put it in /etc/network/if-up.d/firewall and make it executable. You should probably change it to suit your needs or use something else, but this should work:

#!/bin/sh
if [ $IFACE != "eth0" ]; then
  exit;
fi

iptables -F INPUT
iptables -F FORWARD
iptables -t nat -F POSTROUTING
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A FORWARD -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o ppp+ -j ACCEPT
iptables -A FORWARD -j DROP
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o ppp+ -j MASQUERADE

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Split routing

Very useful for cutting and pasting :) thanks so much for this detailed, concise and well written article.

we have the modem (IP

we have the modem (IP 10.0.0.2/24) plugged into eth0 on our server, which is running Debian or Ubuntu, doesn't really matter much all natural ways to get rid of herpes

The particular fundamental

The particular fundamental aim of yoga exercise is usually to get back together the spirits considering the Substantial, and also ‘Super' heart and soul, just like a good ovum yolk is usually a particular while using the egg cell in total. Whenever we get back together together with the Better spirit not to mention give up as a result, after that most people turned out to be totally as well as full. This unique can be like a unification involving the individuals associated with Radha in addition to The almighty Krishna.
Amazana Serpong Residence | cream pemutih muka | Grosir Baju Korea | Rumah Di Alam Sutera

I am continually scanning

I am continually scanning online for articles that can help me. There is clearly a ton to think about this. I think you made some great focuses in Features additionally. Continue working, incredible occupation!
fairfield ct home remodeling

This blog will be a great

This blog will be a great source blog for those who wants to know about this topic. parentstomorrow.com/find-out-when-are-you-most-fertile/

how do wrinkles occur

Each maneuvers I'll be checking to your nurse so the envision you posting previously further directly.how do wrinkles occur

I have already used this

I have already used this modem and thanks for letting us know about the history/information behind this tool.
realestate notes

web Yes I agree with you..

web

Yes I agree with you..

It is imperative that we read

It is imperative that we read blog post very carefully. I am already done it and find that this post is really amazing. - See more at:
sports nutrition shop

When the casing in the jar

When the casing in the jar has completely cooled off, your casing layer is ready to be used. truthaboutcellulite.com reviews

Apa anda mengerti pengertian

Apa anda mengerti pengertian di dengan Penyakit Kanker Payudara? Penyakit Kanker Payudara jenis penyakit terdapat pada bagian payudara, atau kebahayaan diawali di sel pada payudara wanita. old school new body f4x workout

best monthly subscription boxes

Nice Post. It’s really a very good. I noticed all your improtant points. Thanks

high quality article writing service

Thank you for this great information, you write very well which i like very much. I am really impressed by your post. high quality article writing service

You have a real ability for

You have a real ability for writing unique content. I like how you think and the way you represent your views in this article. I agree with your way of thinking. Thank you for sharing. - See more at:
Culebrita water taxi

Obat herbal Kanker Payudara

Obat herbal Kanker Payudara Terpercaya
obat herbal kanker payudara - Apa anda mengerti pengertian dari dengan Penyakit Kanker Payudara? Penyakit Kanker Payudara adalah jenis penyakit yang terdapat pada bagian payudara, atau kebahayaan yang diawali dari sel pada payudara wanita. Kanker payudara kebanyakan dirasakan oleh para wanita, namun bisa jugajenis penyakit payudara terjadi pada para pria. Pada umumnya penyelidikan menerangkan jika 80% jenis penyakit payudara dialami lebih banyak pada para perempuan. sakit kanker payudara jadi perhatian tersendiri bagi kesehatan para perempuan. kebanyakan penyakit kanker payudara diberi tanda dengan adanya benjolan di bagian payudara. Tapi saudara harus berhati-hati dikarenakan penyakit kanker pun dapat menjadi mengganas tidak memperlihatkan adanya berbentuk benjolan.
Menurut pendapat Dr.Alfiah Amiruddin ada 20 jenis sakit kanker payudara yang menunjukkan ditandai dengan bentuk benjolan. Namun tak seperti kanker payudara yang lain, penyakit tanda-tanda adanya benjolan. Gejala awal yang ditunjukkan semacam radang semacam bekas gigitan serangga.Penyakit Kanker ini termasuk jenis yang berbahaya.
Saat Ini Sudah Hadir Jual Obat Herbal Kanker Payudara
Obat Kesehatan amazon Plus merupakan obat tradisional kanker payudara yang dibuat dari ekstrak kulit manggis yang didalamnya terkandung senyawa xanthones ( anti oksidan yang mampu menyembuhkan berbagai jenis penyakit yang mematikan ) diantaranya membantu menyembuhkan kanker payudara.
amazonObat Tradisional Kanker Payudara amazon Plus di produksi berbentuk minuman kesehatan di dalam botol kaca 350 ml.
amazon PlusObat Herbal Kanker Payudara amazon Di produksi dengan bio-teknologi canggih, sehingga kualitasnya sangat baik juga terjamin. amazon PlusObat Tradisional Kanker Payudara amazon telah memperoleh izin penjualan dari banyak lembaga di negara kita, salah satunya izin dari depkes.
Salah satu manfaat ektrak kulit manggis yaitu dapat menghentikan bertumbuhnya sel-sel kanker, sudah dipercaya oleh para ahli medis dari berbagai belahan penjuru dunia.
Di negara adidaya Amerika Serikat, olahan ekstrak buah manggis menjadi berbagai macam obat herbal telah ada sejak awal tahun 2000an.
Jaminan uang Kembali Obat Tradisional Kanker Payudara amazon Nature
amazonObat Herbal Kanker Payudara amazon Plus adalah satu-satunya Obat Herbal Kanker Payudara di Indonesia, yang terbukti memberi garansi, bila setelah kita mengkonsumi amazon Plus ini, tidak mengalami perubahan menuju arah kesembuhan.

BlackMen

will start under saturated water conditions mostly through denitrification in fine-textured soils and through leaching in coarse-textured soils or intensively drained soils.Air tightness testing

We supply a range of

We supply a range of freestanding baths that are available in different shapes, sizes and colours and are all supplied by top-flight manufacturer's for your peace of mind. car insurance quote

Definitely.... blog link

Definitely....

blog link

Really great post. I simply

Really great post. I simply unearthed your site and needed to say that I have truly appreciated perusing your blog entries. Any way I'll be subscribing to your food and I trust you post again soon.
favorite book

Typically you'll transform

Typically you'll transform your account information on the router to modify consideration whenever you planned to take action like an Debian apt-upgrade, although that is certainly frustrating. description

The modem has DHCP turned

The modem has DHCP turned remote, furthermore we contain our PCs on the like ethernet divide as the modem. Obviously this is total frivolous to transpose. premieressay.com

Error

I keep getting this when I try to seed the local routes file:

"/etc/cron.daily/za-routes: 9: [[: not found"

What is the reason for this? The /etc/network/routes-local-dsl file remains empty so the script is stalling?

Thanks

Bashism

Whoops, that looks liike a bashism. Change the double square brackets to single ones.

There's a lot sewa bus

There's a lot sewa bus pariwisata to be desain interior rumah minimalis said about kebaya pengantin modern the way desain rumah minimalis the perfect rumah dijual combination of a info lokasi tempat obyek wisata movie and its music model rumah minimalis can move us

fire rated downlights It

fire rated downlights It tastes strange mixed with other things and awful mixed with water. The only drawback being, that I sometimes don't uniformly ration my shipments.

Many thanks for this

Many thanks for this brilliant post! Many points have extremely useful. Hopefully you'll continue sharing your knowledge around. kulaklık

I might want to thank you for

I might want to thank you for the exertions you have made in composing this article. I am trusting the same best work from you later on also.
Gilbert Electrician

High School were thrilled to

High School were thrilled to be presenting their business plans recently live via WebEx to a panel of SAP judges who were participating from Mexico and Brazil! We are introducing technology communication tools commonly used in business offices – in the classroom. And the results are amazing and inspiring for everyone involved! family reunion photography

I most likely appreciating

I most likely appreciating each and every bit of it. It is an incredible site and decent impart. I need to much obliged. Great employment! You all do an incredible blog, and have some extraordinary substance. Keep doing awesome.
Injustice Hack

I simply want to tell you

I simply want to tell you that I am new to weblog and definitely liked this blog site. Very likely I’m going to bookmark your blog . You absolutely have wonderful stories. Cheers for sharing with us your blog.
Buckeye Electrician

You have made an incredible

You have made an incredible showing. I will most likely burrow it and by and by propose to my companions. I am certain they will be profited from this site.
Washer repair DC

Really a great addition. I

Really a great addition. I have read this post. Thanks for sharing information about it. I really like that. Thanks so lot for your convene buy computer game downloads for pc

Wireless?

Hi,

I realise I'm making my life difficult but I would like to have this very set up except only on my computer; not on the family pc. That way split routing only takes place on my pc (for local torrenting) , but everywhere else I couldn't care and they can all access through the intl account like normal. Thus I assume masquerading isn't necessary, because there is no "internet connection sharing" (sorry to use the windows lingo) that needs to take place.

Further, it makes sense not to have the default connection set up in the router itself (a mega 105W for interests sake) and rather allow each computer to make it's own pppoe connection. Problem is then you have 2 or 3 computers (including my split routed pc) all dialling the telkom account independantly - wouldn't that be a problem?

I tried to set it up as per your instructions with the exception of the dnsmasq (because I don't use it - rather just use 10.0.0.2) and left out masquerading too. Also I replaced etho0 with wlan0 thinking this would move the connection through the wireless. In my network connections dialogue I've got "ifupdown (wlan0)" under the wired tab - telling this set up is specific for wired connections - how can I tell it to dial through the wireless connection (is that even possible?)

My wireless was not working at all, because I coudn't even connect to 10.0.0.2. When i backtraced and removed the /etc/network/interfaces changes it was all back to normal.

Thanks
Grant

Re: Wireless?

Hi.

Yes you wouldn’t need masquerading.

Personally, I prefer to have the router handle all the ADSL-related technicalities, because then connecting new machines to the network is simpler (and usually requires no configuration at all). More generally, it just leads to a neater network - that’s how IP networks are supposed to be. However, yes you can have multiple PPPoE connections (and I think telkom technicians love reconfiguring PCs to do PPPoE directly). I think the limit is 4, but I’m not sure. Test.

Yes you can connect via wireless. It’s an ethernet network like any other. However the instructions I gave were for a server more than a desktop, you’d probably not want to implement it quite like tihs on a desktop. So as to your questions about dialogs, I have no idea what you are referring to. To use these instructions on a wireless network, you’ll have to configure the wireless network with /etc/network/interfaces, the old-school debian way.

Wireless

Hi,

Theoretically wireless should work, BUT if I understand your setup correctly it probably wont. Most wireless routers I've worked with doesn't have a layer 2 switch between the wireless and ethernet networks but rather a layer 3 switch (router). This means all IP packets (layer 3) can freely move from the wireless to the ethernet and your modem, but PPPoE packets (layer 2) is blocked.

If your wireless device is running linux like openwrt or ddwrt you can work around this by installing a pppoe forwarder like pppoe-relay (I beleive ddwrt has this installed by default) which will forward the pppoe packets to the ethernet segment where your modem is.

As a Newbie, I am permanently

As a Newbie, I am permanently exploring online for articles that can be of assistance to me. Thank you
Click Clone Cash

Reply to comment | Tumbleweed Rants

Hey I know this is off topic but I was wondering if you knew of any widgets I
could add to my blog that automatically tweet my newest twitter updates.
I've been looking for a plug-in like this for quite some time and
was hoping maybe you would have some experience with something like this.
Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

Feel free to visit my web blog :: pirater un compte facebook

stunning, incredible, I was

stunning, incredible, I was wondering how to cure skin inflammation regularly. furthermore discovered your site by google, took in a ton, now i'm a bit clear. I've bookmark your site furthermore include rss. keep us overhauled...
Dead Trigger 2 Hack

I will try to use your

I will try to use your advice, for sure I will have amazing results, thank you again!
www.groomsfatherspeech.com

I simply want to tell you

I simply want to tell you that I am new to weblog and definitely liked this blog site. Very likely I’m going to bookmark your blog . You absolutely have wonderful stories. Cheers for sharing with us your blog.
"portable vaporizer"

I surmise I have chosen an

I surmise I have chosen an intelligent and mind blowing website with interesting material. vfd055e43a

But I’ll have to say that the

But I’ll have to say that the Canon was much nicer to work on - they are quite easy to service. Kudos to Canon… https://www.rebelmouse.com/

Incredible post! I am really

Incredible post! I am really getting prepared to over this data, is extremely useful my companion. Likewise extraordinary blog here with the greater part of the important data you have. Keep doing awesome doing here.
rebelmouse.com rates it highly

echo 1 > /proc/sys/net/ipv4/ip_forward

Hi

Thanks for the tutorial, it helped a lot.

But on my Ubuntu 8.10 server I needed to enable ip forwarding:

"echo 1 > /proc/sys/net/ipv4/ip_forward"

Regards,

sysctl.conf

You should rather set net.ipv4.ip_forward=1 in sysctl.conf.

Certainly a fantastic piece

Certainly a fantastic piece of work ... It has relevant information. Thanks for posting this. Your blog is so interesting and very informative.Thanks sharing. Definitely a great piece of work Thanks for your work. - See more at:
Hay Day Hack android

Brilliant

Thanks a stax - I had to make slight changes as I use roaring penguin pppoe - but it all worked out perfectly.

Pingback

[...] recently followed tumbleweed’s split routing post (his post explains the odd reasoning why any one would go through all this effort) after doing this [...]

Test

Hi thanks for this great tut, stupid question, how will I know if it worked or not?

If it worked

This does assume some medium-level Linux networking knowledge, in which case you can answer that yourself.

Look at the packet counters on both ppp interfaces, do they rise?

Traceroute to local and international sites. The next hop for local should be different to international.

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.
Type the characters you see in this picture. (verify using audio)
Type the characters you see in the picture above; if you can't read them, submit the form and a new image will be generated. Not case sensitive.