Chapter 25. Configuring policy-based routing to define alternative routes

Procedure

1. Configure the network interface to provider A:

   # nmcli connection add type ethernet con-name Provider-A ifname enp7s0 ipv4.method manual ipv4.addresses 198.51.100.1/30 ipv4.gateway 198.51.100.2 ipv4.dns 198.51.100.200 connection.zone external

   The nmcli connection add command creates a NetworkManager connection profile. The command uses the following options:

   • type ethernet: Defines that the connection type is Ethernet.
   • con-name <connection_name>: Sets the name of the profile. Use a meaningful name to avoid confusion.
   • ifname <network_device>: Sets the network interface.
   • ipv4.method manual: Enables to configure a static IP address.
   • ipv4.addresses <IP_address>/<subnet_mask>: Sets the IPv4 addresses and subnet mask.
   • ipv4.gateway <IP_address>: Sets the default gateway address.
   • ipv4.dns <IP_of_DNS_server>: Sets the IPv4 address of the DNS server.
   • connection.zone <firewalld_zone>: Assigns the network interface to the defined firewalld zone. Note that firewalld automatically enables masquerading for interfaces assigned to the external zone.

2. Configure the network interface to provider B:

   # nmcli connection add type ethernet con-name Provider-B ifname enp1s0 ipv4.method manual ipv4.addresses 192.0.2.1/30 ipv4.routes "0.0.0.0/0 192.0.2.2 table=5000" connection.zone external

   This command uses the ipv4.routes parameter instead of ipv4.gateway to set the default gateway. This is required to assign the default gateway for this connection to a different routing table (5000) than the default. NetworkManager automatically creates this new routing table when the connection is activated.

3. Configure the network interface to the internal workstations subnet:

   # nmcli connection add type ethernet con-name Internal-Workstations ifname enp8s0 ipv4.method manual ipv4.addresses 10.0.0.1/24 ipv4.routes "10.0.0.0/24 table=5000" ipv4.routing-rules "priority 5 from 10.0.0.0/24 table 5000" connection.zone trusted

   This command uses the ipv4.routes parameter to add a static route to the routing table with ID 5000. This static route for the 10.0.0.0/24 subnet uses the IP of the local network interface to provider B (192.0.2.1) as next hop.

   Additionally, the command uses the ipv4.routing-rules parameter to add a routing rule with priority 5 that routes traffic from the 10.0.0.0/24 subnet to table 5000. Low values have a high priority.

   Note that the syntax in the ipv4.routing-rules parameter is the same as in an ip rule add command, except that ipv4.routing-rules always requires specifying a priority.

4. Configure the network interface to the server subnet:

   # nmcli connection add type ethernet con-name Servers ifname enp9s0 ipv4.method manual ipv4.addresses 203.0.113.1/24 connection.zone trusted

Verification

1. On a RHEL host in the internal workstation subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  10.0.0.1 (10.0.0.1)     0.337 ms  0.260 ms  0.223 ms
       2  192.0.2.1 (192.0.2.1)   0.884 ms  1.066 ms  1.248 ms
       ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

2. On a RHEL host in the server subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  203.0.113.1 (203.0.113.1)    2.179 ms  2.073 ms  1.944 ms
       2  198.51.100.2 (198.51.100.2)  1.868 ms  1.798 ms  1.549 ms
       ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

1. Display the rule list:

   # ip rule list
   0:	from all lookup local
   5:	from 10.0.0.0/24 lookup 5000
   32766:	from all lookup main
   32767:	from all lookup default

   By default, RHEL contains rules for the tables local, main, and default.

2. Display the routes in table 5000:

   # ip route list table 5000
   0.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 100
   10.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102

3. Display the interfaces and firewall zones:

   # firewall-cmd --get-active-zones
   external
     interfaces: enp1s0 enp7s0
   trusted
     interfaces: enp8s0 enp9s0

4. Verify that the external zone has masquerading enabled:

   # firewall-cmd --info-zone=external
   external (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp1s0 enp7s0
     sources:
     services: ssh
     ports:
     protocols:
     masquerade: yes
     ...

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configuring policy-based routing
     hosts: managed-node-01.example.com
     tasks:
       - name: Routing traffic from a specific subnet to a different default gateway
         ansible.builtin.include_role:
           name: rhel-system-roles.network
         vars:
           network_connections:
             - name: Provider-A
               interface_name: enp7s0
               type: ethernet
               autoconnect: True
               ip:
                 address:
                   - 198.51.100.1/30
                 gateway4: 198.51.100.2
                 dns:
                   - 198.51.100.200
               state: up
               zone: external
   
             - name: Provider-B
               interface_name: enp1s0
               type: ethernet
               autoconnect: True
               ip:
                 address:
                   - 192.0.2.1/30
                 route:
                   - network: 0.0.0.0
                     prefix: 0
                     gateway: 192.0.2.2
                     table: 5000
               state: up
               zone: external
   
             - name: Internal-Workstations
               interface_name: enp8s0
               type: ethernet
               autoconnect: True
               ip:
                 address:
                   - 10.0.0.1/24
                 route:
                   - network: 10.0.0.0
                     prefix: 24
                     table: 5000
                 routing_rule:
                   - priority: 5
                     from: 10.0.0.0/24
                     table: 5000
               state: up
               zone: trusted
   
             - name: Servers
               interface_name: enp9s0
               type: ethernet
               autoconnect: True
               ip:
                 address:
                   - 203.0.113.1/24
               state: up
               zone: trusted

   The settings specified in the example playbook include the following:

   table: <value>

   Assigns the route from the same list entry as the table variable to the specified routing table.

   routing_rule: <list>

   Defines the priority of the specified routing rule and from a connection profile to which routing table the rule is assigned.

   zone: <zone_name>

   Assigns the network interface from a connection profile to the specified firewalld zone.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.network/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On a RHEL host in the internal workstation subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  10.0.0.1 (10.0.0.1)     0.337 ms  0.260 ms  0.223 ms
       2  192.0.2.1 (192.0.2.1)   0.884 ms  1.066 ms  1.248 ms
       ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

2. On a RHEL host in the server subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  203.0.113.1 (203.0.113.1)    2.179 ms  2.073 ms  1.944 ms
       2  198.51.100.2 (198.51.100.2)  1.868 ms  1.798 ms  1.549 ms
       ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

3. On the RHEL router that you configured using the RHEL system role:

   1. Display the rule list:

      # ip rule list
      0:      from all lookup local
      5:    from 10.0.0.0/24 lookup 5000
      32766:  from all lookup main
      32767:  from all lookup default

      By default, RHEL contains rules for the tables local, main, and default.

   2. Display the routes in table 5000:

      # ip route list table 5000
      0.0.0.0/0 via 192.0.2.2 dev enp1s0 proto static metric 100
      10.0.0.0/24 dev enp8s0 proto static scope link src 192.0.2.1 metric 102

   3. Display the interfaces and firewall zones:

      # firewall-cmd --get-active-zones
      external
        interfaces: enp1s0 enp7s0
      trusted
        interfaces: enp8s0 enp9s0

   4. Verify that the external zone has masquerading enabled:

      # firewall-cmd --info-zone=external
      external (active)
        target: default
        icmp-block-inversion: no
        interfaces: enp1s0 enp7s0
        sources:
        services: ssh
        ports:
        protocols:
        masquerade: yes
        ...

Procedure

1. Add the configuration for the network interface to provider A by creating the /etc/sysconfig/network-scripts/ifcfg-1_Provider-A file with the following content:

   TYPE=Ethernet
   IPADDR=198.51.100.1
   PREFIX=30
   GATEWAY=198.51.100.2
   DNS1=198.51.100.200
   DEFROUTE=yes
   NAME=1_Provider-A
   DEVICE=enp7s0
   ONBOOT=yes
   ZONE=external

   The configuration file uses the following parameters:

   • TYPE=Ethernet: Defines that the connection type is Ethernet.
   • IPADDR=IP_address: Sets the IPv4 address.
   • PREFIX=subnet_mask: Sets the subnet mask.
   • GATEWAY=IP_address: Sets the default gateway address.
   • DNS1=IP_of_DNS_server: Sets the IPv4 address of the DNS server.
   • DEFROUTE=yes|no: Defines whether the connection is a default route or not.
   • NAME=connection_name: Sets the name of the connection profile. Use a meaningful name to avoid confusion.
   • DEVICE=network_device: Sets the network interface.
   • ONBOOT=yes: Defines that RHEL starts this connection when the system boots.
   • ZONE=firewalld_zone: Assigns the network interface to the defined firewalld zone. Note that firewalld automatically enables masquerading for interfaces assigned to the external zone.

2. Add the configuration for the network interface to provider B:

   1. Create the /etc/sysconfig/network-scripts/ifcfg-2_Provider-B file with the following content:

      TYPE=Ethernet
      IPADDR=192.0.2.1
      PREFIX=30
      DEFROUTE=no
      NAME=2_Provider-B
      DEVICE=enp1s0
      ONBOOT=yes
      ZONE=external

      Note that the configuration file for this interface does not contain a default gateway setting.

   2. Assign the gateway for the 2_Provider-B connection to a separate routing table. Therefore, create the /etc/sysconfig/network-scripts/route-2_Provider-B file with the following content:

      0.0.0.0/0 via 192.0.2.2 table 5000

      This entry assigns the gateway and traffic from all subnets routed through this gateway to table 5000.

3. Create the configuration for the network interface to the internal workstations subnet:

   1. Create the /etc/sysconfig/network-scripts/ifcfg-3_Internal-Workstations file with the following content:

      TYPE=Ethernet
      IPADDR=10.0.0.1
      PREFIX=24
      DEFROUTE=no
      NAME=3_Internal-Workstations
      DEVICE=enp8s0
      ONBOOT=yes
      ZONE=internal

   2. Add the routing rule configuration for the internal workstation subnet. Therefore, create the /etc/sysconfig/network-scripts/rule-3_Internal-Workstations file with the following content:

      pri 5 from 10.0.0.0/24 table 5000

      This configuration defines a routing rule with priority 5 that routes all traffic from the 10.0.0.0/24 subnet to table 5000. Low values have a high priority.

   3. Create the /etc/sysconfig/network-scripts/route-3_Internal-Workstations file with the following content to add a static route to the routing table with ID 5000:

      10.0.0.0/24 via 192.0.2.1 table 5000

      This static route defines that RHEL sends traffic from the 10.0.0.0/24 subnet to the IP of the local network interface to provider B (192.0.2.1). This interface is to routing table 5000 and used as the next hop.

4. Add the configuration for the network interface to the server subnet by creating the /etc/sysconfig/network-scripts/ifcfg-4_Servers file with the following content:

   TYPE=Ethernet
   IPADDR=203.0.113.1
   PREFIX=24
   DEFROUTE=no
   NAME=4_Servers
   DEVICE=enp9s0
   ONBOOT=yes
   ZONE=internal

5. Restart the network:

   # systemctl restart network

Verification

1. On a RHEL host in the internal workstation subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  10.0.0.1 (10.0.0.1)     0.337 ms  0.260 ms  0.223 ms
       2  192.0.2.1 (192.0.2.1)   0.884 ms  1.066 ms  1.248 ms
       ...

      The output of the command displays that the router sends packets over 192.0.2.1, which is the network of provider B.

2. On a RHEL host in the server subnet:

   1. Install the traceroute package:

      # yum install traceroute

   2. Use the traceroute utility to display the route to a host on the internet:

      # traceroute redhat.com
      traceroute to redhat.com (209.132.183.105), 30 hops max, 60 byte packets
       1  203.0.113.1 (203.0.113.1)    2.179 ms  2.073 ms  1.944 ms
       2  198.51.100.2 (198.51.100.2)  1.868 ms  1.798 ms  1.549 ms
       ...

      The output of the command displays that the router sends packets over 198.51.100.2, which is the network of provider A.

1. Display the rule list:

   # ip rule list
   0:      from all lookup local
   5:      from 10.0.0.0/24 lookup 5000
   32766:  from all lookup main
   32767:  from all lookup default

   By default, RHEL contains rules for the tables local, main, and default.

2. Display the routes in table 5000:

   # ip route list table 5000
   default via 192.0.2.2 dev enp1s0
   10.0.0.0/24 via 192.0.2.1 dev enp1s0

3. Display the interfaces and firewall zones:

   # firewall-cmd --get-active-zones
   external
     interfaces: enp1s0 enp7s0
   internal
     interfaces: enp8s0 enp9s0

4. Verify that the external zone has masquerading enabled:

   # firewall-cmd --info-zone=external
   external (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp1s0 enp7s0
     sources:
     services: ssh
     ports:
     protocols:
     masquerade: yes
     ...