Chapter 26. Configuring policy-based routing to define alternative routes Red Hat Enterprise Linux 9 | Red Hat Customer Portal (2024)

Prerequisites

• The system uses NetworkManager to configure the network, which is the default.

• The RHEL router you want to set up in the procedure has four network interfaces:

  • The enp7s0 interface is connected to the network of provider A. The gateway IP in the provider’s network is 198.51.100.2, and the network uses a /30 network mask.
  • The enp1s0 interface is connected to the network of provider B. The gateway IP in the provider’s network is 192.0.2.2, and the network uses a /30 network mask.
  • The enp8s0 interface is connected to the 10.0.0.0/24 subnet with internal workstations.
  • The enp9s0 interface is connected to the 203.0.113.0/24 subnet with the company’s servers.
• Hosts in the internal workstations subnet use 10.0.0.1 as the default gateway. In the procedure, you assign this IP address to the enp8s0 network interface of the router.
• Hosts in the server subnet use 203.0.113.1 as the default gateway. In the procedure, you assign this IP address to the enp9s0 network interface of the router.
• The firewalld service is enabled and active.

Procedure

1. Configure the network interface to provider A:

   # nmcli connection add type ethernet con-name Provider-A ifname enp7s0 ipv4.method manual ipv4.addresses 198.51.100.1/30 ipv4.gateway 198.51.100.2 ipv4.dns 198.51.100.200 connection.zone external

   The nmcli connection add command creates a NetworkManager connection profile. The command uses the following options:

   • type ethernet: Defines that the connection type is Ethernet.
   • con-name <connection_name>: Sets the name of the profile. Use a meaningful name to avoid confusion.
   • ifname <network_device>: Sets the network interface.
   • ipv4.method manual: Enables to configure a static IP address.
   • ipv4.addresses <IP_address>/<subnet_mask>: Sets the IPv4 addresses and subnet mask.
   • ipv4.gateway <IP_address>: Sets the default gateway address.
   • ipv4.dns <IP_of_DNS_server>: Sets the IPv4 address of the DNS server.
   • connection.zone <firewalld_zone>: Assigns the network interface to the defined firewalld zone. Note that firewalld automatically enables masquerading for interfaces assigned to the external zone.

2. Configure the network interface to provider B:

   # nmcli connection add type ethernet con-name Provider-B ifname enp1s0 ipv4.method manual ipv4.addresses 192.0.2.1/30 ipv4.routes "0.0.0.0/0 192.0.2.2 table=5000" connection.zone external

   This command uses the ipv4.routes parameter instead of ipv4.gateway to set the default gateway. This is required to assign the default gateway for this connection to a different routing table (5000) than the default. NetworkManager automatically creates this new routing table when the connection is activated.

3. Configure the network interface to the internal workstations subnet:

   # nmcli connection add type ethernet con-name Internal-Workstations ifname enp8s0 ipv4.method manual ipv4.addresses 10.0.0.1/24 ipv4.routes "10.0.0.0/24 table=5000" ipv4.routing-rules "priority 5 from 10.0.0.0/24 table 5000" connection.zone trusted

   This command uses the ipv4.routes parameter to add a static route to the routing table with ID 5000. This static route for the 10.0.0.0/24 subnet uses the IP of the local network interface to provider B (192.0.2.1) as next hop.

   Additionally, the command uses the ipv4.routing-rules parameter to add a routing rule with priority 5 that routes traffic from the 10.0.0.0/24 subnet to table 5000. Low values have a high priority.

   See Also

   Known Issues 11.09.210[OpenWrt Wiki] Accessing LuCI web interface securelyImportant points to know about PaperCut MF version 24R163-Z32-AAC2 | Rack Servers - GIGABYTE Ukraine

   Note that the syntax in the ipv4.routing-rules parameter is the same as in an ip rule add command, except that ipv4.routing-rules always requires specifying a priority.

4. Configure the network interface to the server subnet:

   # nmcli connection add type ethernet con-name Servers ifname enp9s0 ipv4.method manual ipv4.addresses 203.0.113.1/24 connection.zone trusted

Verification

1. On a RHEL host in the internal workstation subnet:

   1. Install the traceroute package:

      # dnf install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.comtraceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 10.0.0.1 (10.0.0.1) 0.337 ms 0.260 ms 0.223 ms 2 192.0.2.1 (192.0.2.1) 0.884 ms 1.066 ms 1.248 ms ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

2. On a RHEL host in the server subnet:

   1. Install the traceroute package:

      # dnf install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.comtraceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 203.0.113.1 (203.0.113.1) 2.179 ms 2.073 ms 1.944 ms 2 198.51.100.2 (198.51.100.2) 1.868 ms 1.798 ms 1.549 ms ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

Troubleshooting steps

On the RHEL router:

1. Display the rule list:

   # ip rule list0:from all lookup local5:from 10.0.0.0/24 lookup 500032766:from all lookup main32767:from all lookup default

   By default, RHEL contains rules for the tables local, main, and default.

2. Display the routes in table 5000:

   See Also

   R263-Z30-AAC1 | Rack Servers - GIGABYTE Luxembourg

   # ip route list table 50000.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 10010.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102

3. Display the interfaces and firewall zones:

   # firewall-cmd --get-active-zonesexternal interfaces: enp1s0 enp7s0trusted interfaces: enp8s0 enp9s0

4. Verify that the external zone has masquerading enabled:

   # firewall-cmd --info-zone=externalexternal (active) target: default icmp-block-inversion: no interfaces: enp1s0 enp7s0 sources: services: ssh ports: protocols: masquerade: yes ...

Additional resources

• nm-settings(5) man page
• nmcli(1) man page

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has sudo permissions on them.
• The managed nodes uses the NetworkManager and firewalld services.

• The managed nodes you want to configure has four network interfaces:

  • The enp7s0 interface is connected to the network of provider A. The gateway IP in the provider’s network is 198.51.100.2, and the network uses a /30 network mask.
  • The enp1s0 interface is connected to the network of provider B. The gateway IP in the provider’s network is 192.0.2.2, and the network uses a /30 network mask.
  • The enp8s0 interface is connected to the 10.0.0.0/24 subnet with internal workstations.
  • The enp9s0 interface is connected to the 203.0.113.0/24 subnet with the company’s servers.
• Hosts in the internal workstations subnet use 10.0.0.1 as the default gateway. In the procedure, you assign this IP address to the enp8s0 network interface of the router.
• Hosts in the server subnet use 203.0.113.1 as the default gateway. In the procedure, you assign this IP address to the enp9s0 network interface of the router.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---- name: Configuring policy-based routing hosts: managed-node-01.example.com tasks: - name: Routing traffic from a specific subnet to a different default gateway ansible.builtin.include_role: name: rhel-system-roles.network vars: network_connections: - name: Provider-A interface_name: enp7s0 type: ethernet autoconnect: True ip: address: - 198.51.100.1/30 gateway4: 198.51.100.2 dns: - 198.51.100.200 state: up zone: external - name: Provider-B interface_name: enp1s0 type: ethernet autoconnect: True ip: address: - 192.0.2.1/30 route: - network: 0.0.0.0 prefix: 0 gateway: 192.0.2.2 table: 5000 state: up zone: external - name: Internal-Workstations interface_name: enp8s0 type: ethernet autoconnect: True ip: address: - 10.0.0.1/24 route: - network: 10.0.0.0 prefix: 24 table: 5000 routing_rule: - priority: 5 from: 10.0.0.0/24 table: 5000 state: up zone: trusted - name: Servers interface_name: enp9s0 type: ethernet autoconnect: True ip: address: - 203.0.113.1/24 state: up zone: trusted

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On a RHEL host in the internal workstation subnet:

   1. Install the traceroute package:

      # dnf install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.comtraceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 10.0.0.1 (10.0.0.1) 0.337 ms 0.260 ms 0.223 ms 2 192.0.2.1 (192.0.2.1) 0.884 ms 1.066 ms 1.248 ms ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

2. On a RHEL host in the server subnet:

   1. Install the traceroute package:

      # dnf install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.comtraceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets 1 203.0.113.1 (203.0.113.1) 2.179 ms 2.073 ms 1.944 ms 2 198.51.100.2 (198.51.100.2) 1.868 ms 1.798 ms 1.549 ms ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

3. On the RHEL router that you configured using the RHELsystemrole:

   1. Display the rule list:

      # ip rule list0: from all lookup local5: from 10.0.0.0/24 lookup 500032766: from all lookup main32767: from all lookup default

      By default, RHEL contains rules for the tables local, main, and default.

   2. Display the routes in table 5000:

      # ip route list table 50000.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 10010.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102

   3. Display the interfaces and firewall zones:

      # firewall-cmd --get-active-zonesexternal interfaces: enp1s0 enp7s0trusted interfaces: enp8s0 enp9s0

   4. Verify that the external zone has masquerading enabled:

      # firewall-cmd --info-zone=externalexternal (active) target: default icmp-block-inversion: no interfaces: enp1s0 enp7s0 sources: services: ssh ports: protocols: masquerade: yes ...

Additional resources

• /usr/share/ansible/roles/rhel-system-roles.network/README.md file
• /usr/share/doc/rhel-system-roles/network/ directory