How to Turn a Linux Server into a Router to Handle Traffic Statically and Dynamically – Part 10

[‘

n

As we have anticipated in previous tutorials of this LFCE (Linux Foundation Certified Engineer) series, in this article we will discuss the routing of IP traffic statically and dynamically with specific applications.

n

Configure Linux as Router
Linux Foundation Certified Engineer – Part 10

n

Introducing The Linux Foundation Certification Program

n

n

n

n

First things first, let’s get some definitions straight:

n

    n

  1. In simple words, a packet is the basic unit that is used to transmit information within a network. Networks that use TCP/IP as network protocol follow the same rules for transmission of data: the actual information is split into packets that are made of both data and the address where it should be sent to.
  2. n

  3. Routing is the process of “guiding” the data from source to destination inside a network.
  4. n

  5. Static routing requires a manually-configured set of rules defined in a routing table. These rules are fixed and are used to define the way a packet must go through as it travels from one machine to another.
  6. n

  7. Dynamic routing, or smart routing (if you wish), means that the system can alter automatically, as needed, the route that a packet follows.
  8. n

n

Advanced IP and Network Device Configuration

n

The iproute package provides a set of tools to manage networking and traffic control that we will use throughout this article as they represent the replacement of legacy tools such as ifconfig and route.

n

The central utility in the iproute suite is called simply ip. Its basic syntax is as follows:

n

# ip object commandrn

n

Where object can be only one of the following (only the most frequent objects are shown – you can refer to man ip for a complete list):

n

    n

  1. link: network device.
  2. n

  3. addr: protocol (IP or IPv6) address on a device.
  4. n

  5. route: routing table entry.
  6. n

  7. rule: rule in routing policy database.
  8. n

n

Whereas command represents a specific action that can be performed on object. You can run the following command to display the complete list of commands that can be applied to a particular object:

n

# ip object helprn

n

For example,

n

# ip link helprn

n

IP Command Help
IP Command Help

n

The above image shows, for example, that you can change the status of a network interface with the following command:

n

# ip link set interface {up | down}rn

n

For such more examples of ‘ip‘ command, read 10 Useful ‘ip’ Commands to Configure IP Address

n

Example 1: Disabling and enabling a network interface

n

In this example, we will disable and enable eth1:

n

# ip link showrn# ip link set eth1 downrn# ip link showrn

n

Disable eth0 Interface in Linux
Disable eth0 Interface

n

If you want to re-enable eth1,

n

# ip link set eth1 uprn

n

Instead of displaying all the network interfaces, we can specify one of them:

n

# ip link show eth1rn

n

Which will return all the information for eth1.

n

Example 2: Displaying the main routing table

n

You can view your current main routing table with either of the following 3 commands:

n

# ip route showrn# route -nrn# netstat -rnrn

n

Check route in Linux
Check Linux Route Table

n

The first column in the output of the three commands indicates the target network. The output of ip route show (following the keyword dev) also presents the network devices that serve as physical gateway to those networks.

n

Although nowadays the ip command is preferred over route, you can still refer to man ip-route and man route for a detailed explanation of the rest of the columns.

n

Example 3: Using a Linux server to route packets between two private networks

n

We want to route icmp (ping) packets from dev2 to dev4 and the other way around as well (note that both client machines are on different networks). The name of each NIC, along with its corresponding IPv4 address, is given inside square brackets.

n

Our test environment is as follows:

n

Client 1: CentOS 7 [enp0s3: 192.168.0.17/24] - dev1rnRouter: Debian Wheezy 7.7 [eth0: 192.168.0.15/24, eth1: 10.0.0.15/24] - dev2rnClient 2: openSUSE 13.2 [enp0s3: 10.0.0.18/24] - dev4rn

n

Let’s view the routing table in dev1 (CentOS box):

n

# ip route showrn

n

and then modify it in order to use its enp0s3 NIC and the connection to 192.168.0.15 to access hosts in the 10.0.0.0/24 network:

n

# ip route add 10.0.0.0/24 via 192.168.0.15 dev enp0s3rn

n

Which essentially reads, “Add a route to the 10.0.0.0/24 network through the enp0s3 network interface using 192.168.0.15 as gateway”.

n

Route Network in Linux
Route Network in Linux

n

Likewise in dev4 (openSUSE box) to ping hosts in the 192.168.0.0/24 network:

n

# ip route add 192.168.0.0/24 via 10.0.0.15 dev enp0s3rn

n

Network Routing in Linux
Network Routing in Linux

n

Finally, we need to enable forwarding in our Debian router:

n

# echo 1 > /proc/sys/net/ipv4/ip_forwardrn

n

Now let’s ping:

n

Check Network Routing
Check Network Routing

n

and,

n

Route Ping Status
Route Ping Status

n

To make these settings persistent across boots, edit /etc/sysctl.conf on the router and make sure the net.ipv4.ip_forward variable is set to true as follows:

n

net.ipv4.ip_forward = 1rn

n

In addition, configure the NICs on both clients (look for the configuration file within /etc/sysconfig/network on openSUSE and /etc/sysconfig/network-scripts on CentOS – in both cases it’s called ifcfg-enp0s3).

n

Here’s the configuration file from the openSUSE box:

n

BOOTPROTO=staticrnBROADCAST=10.0.0.255rnIPADDR=10.0.0.18rnNETMASK=255.255.255.0rnGATEWAY=10.0.0.15rnNAME=enp0s3rnNETWORK=10.0.0.0rnONBOOT=yesrn

n

Example 4: Using a Linux server to route packages between a private networks and the Internet

n

Another scenario where a Linux machine can be used as router is when you need to share your Internet connection with a private LAN.

n

Router: Debian Wheezy 7.7 [eth0: Public IP, eth1: 10.0.0.15/24] - dev2rnClient: openSUSE 13.2 [enp0s3: 10.0.0.18/24] - dev4rn

n

In addition to set up packet forwarding and the static routing table in the client as in the previous example, we need to add a few iptables rules in the router:

n

# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADErn# iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPTrn# iptables -A FORWARD -i eth1 -o eth0 -j ACCEPTrn

n

The first command adds a rule to the POSTROUTING chain in the nat (Network Address Translation) table, indicating that the eth0 NIC should be used for outgoing packages.

n

MASQUERADE indicates that this NIC has a dynamic IP and that before sending the package to the “wild wild world” of the Internet, the private source address of the packet has to be changed to that of the public IP of the router.

n

In a LAN with many hosts, the router keeps track of established connections in /proc/net/ip_conntrack so it knows where to return the response from the Internet to.

n

Only part of the output of:

n

# cat /proc/net/ip_conntrackrn

n

is show in the following screenshot.

n

Route Packages in Linux
Route Packages in Linux

n

Where the origin (private IP of openSUSE box) and destination (Google DNS) of packets is highlighted. This was the result of running:

n

# curl www.tecmint.comrn

n

on the openSUSE box.

n

As I’m sure you can already guess, the router is using Google’s 8.8.8.8 as nameserver, which explains why the destination of outgoing packets points to that address.

n

Note: That incoming packages from the Internet are only accepted is if they are part of an already established connection (command #2), while outgoing packages are allowed “free exit” (command #3).

n

Don’t forget to make your iptables rules persistent following the steps outlined in Part 8 – Configure Iptables Firewall of this series.

n

Dynamic Routing with Quagga

n

Nowadays, the tool most used for dynamic routing in Linux is quagga. It allows system administrators to implement, with a relatively low-cost Linux server, the same functionality that is provided by powerful (and costly) Cisco routers.

n

The tool itself does not handle the routing, but rather modifies the kernel routing table as it learns new best routes to handle packets.

n

Since it’s a fork of zebra, a program whose development ceased a while ago, it maintains for historical reasons the same commands and structure than zebra. That is why you will see a lot of reference to zebra from this point on.

n

Please note that it is not possible to cover dynamic routing and all the related protocols in a single article, but I am confident that the content presented here will serve as a starting point for you to build on.

n

Installing Quagga in Linux

n

To install quagga on your chosen distribution:

n

# aptitude update && aptitude install quagga tttt[On Ubuntu]rn# yum update && yum install quagga ttttt[CentOS/RHEL]rn# zypper refresh && zypper install quagga tttt[openSUSE]rn

n

We will use the same environment as with Example #3, with the only difference that eth0 is connected to a main gateway router with IP 192.168.0.1.

n

Next, edit /etc/quagga/daemons with,

n

zebra=1rnripd=1rn

n

Now create the following configuration files.

n

# /etc/quagga/zebra.confrn# /etc/quagga/ripd.confrn

n

and add these lines (replace for a hostname and password of your choice):

n

service quagga restartrnhostname    tdev2rnpassword    tquaggarn

n

# service quagga restartrn

n

Install Quagga in Linux
Start Quagga Service

n

Note: That ripd.conf is the configuration file for the Routing Information Protocol, which provides the router with the information of which networks can be reached and how far (in terms of amount of hops) they are.

n

Note that this is only one of the protocols that can be used along with quagga, and I chose it for this tutorial due to easiness of use and because most network devices support it, although it has the disadvantage of passing credentials in plain text. For that reason, you need to assign proper permissions to the configuration file:

n

# chown quagga:quaggavty /etc/quagga/*.confrn# chmod 640 /etc/quagga/*.conf rn

n

Example 5: Setting up quagga to route IP traffic dynamically

n

In this example we will use the following setup with two routers (make sure to create the configuration files for router #2 as explained previously):

n

Configure Quagga in Linux
Configure Quagga

n

Important: Don’t forget to repeat the following setup for both routers.

n

Connect to zebra (listening on port 2601), which is the logical intermediary between the router and the kernel:

n

# telnet localhost 2601rn

n

Enter the password that was set in the /etc/quagga/zebra.conf file, and then enable configuration:

n

enablernconfigure terminalrn

n

Enter the IP address and network mask of each NIC:

n

inter eth0rnip addr 192.168.0.15rninter eth1rnip addr 10.0.0.15rnexitrnexitrnwritern

n

Configure Router in Linux
Configure Router

n

Now we need to connect to the RIP daemon terminal (port 2602):

n

# telnet localhost 2602rn

n

Enter username and password as configured in the /etc/quagga/ripd.conf file, and then type the following commands in bold (comments are added for the sake of clarification):

n

enable turns on privileged mode command.rnconfigure terminal changes to configuration mode. This command is the first step to configurationrnrouter rip enables RIP.rnnetwork 10.0.0.0/24 sets the RIP enable interface for the 10.0.0.0/24 network. rnexitrnexitrnwrite writes current configuration to configuration file.rn

n

Enable Router in Linux
Enable Router

n

Note: That in both cases the configuration is appended to the lines that we added previously (/etc/quagga/zebra.conf and /etc/quagga/ripd.conf).

n

Finally, connect again to the zebra service on both routers and note how each one of them has “learned” the route to the network that is behind the other, and which is the next hop to get to that network, by running the command show ip route:

n

# show ip routern

n

Check IP Routing Table in Linux
Check IP Routing

n

If you want to try different protocols or setups, you may want to refer to the Quagga project site for further documentation.

n

Conclusion

n

In this article we have explained how to set up static and dynamic routing, using a Linux box router(s). Feel free to add as many routers as you wish, and to experiment as much as you want. Do not hesitate to get back to us using the contact form below if you have any comments or questions.

n

n

‘]