From specific source IP to specific destination IP with ip route or ip tables

Question

Problem

I've already created different IP aliases, (each with a different virtual Mac Address too) this way on my shell:

ip link add link eth0 address 00:11:11:11:11:11 eth0.1 type macvlan

ifconfig eth0.1 172.17.1.15/21 up

I have used eth0.1 instead of eth0:1 because otherwise, it does not work the macvlan. I know that the IP alias are written as: eth0:1, though.

It is set a speed throttling to 10Mbps per IP (or Mac Addr, I do not know yet) and I am studying its bypassing for a well intentioned project.

What I want now is to set a specific destination for each IP alias in order to study the router's speed throttling. It should now have 10Mbps per IP/connection.

For instance:

Router: 172.17.0.1/21

eth0> 172.17.1.14/21

eth0.1> 172.17.1.15/21

eth0.2> 172.17.1.16/21

I need now the eth0.1 to be the source to access: URL(speedtest1Web).

And the eth0.2 the source to access: URL(speedtest2Web).

I have tried:

iptables -t nat -A POSTROUTING -p tcp -s 172.17.1.15 -o eth0.1 -j SNAT --to-source xxx.xxx.xxx.xxx

or

iptables -t nat -I POSTROUTING -o eth0 -d xxx.xxx.xxx.xxx/32 -s 10.255.0.127 -j SNAT --to-source 172.17.1.15

where xxx.xxx.xxx.xxx = speedtest1Web

Is it correct the "-o eth0"? Or should I write "-o eth0.1"?

I have been trying many similar commands with no success or at least I continue having 10Mbps for all the connections instead of 10Mbps per connection (what it is supposed now with the IP aliasing).

Anton Danilov · Accepted Answer · 2019-05-15T14:11:26.090

You don't need usage of macvlan in your case.

Assign addresses on single interface. Aliases are deprecated way to have multiple addresses on same interface. You need macvlan only if you want have various mac addresses for various ip addresses, but it complicates the configuration of routing.

 l1:~# ip link set up dev eth0
 l1:~# ip address add 172.17.1.14/21 dev eth0
 l1:~# ip address add 172.17.1.15/21 dev eth0
 l1:~# ip address add 172.17.1.16/21 dev eth0

Verify list of addresses on the eth0 interface:

 l1:~# ip -4 a ls dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 172.17.0.14/21 scope global eth0
       valid_lft forever preferred_lft forever
    inet 172.17.0.15/21 scope global secondary eth0
       valid_lft forever preferred_lft forever
    inet 172.17.0.16/21 scope global secondary eth0
       valid_lft forever preferred_lft forever

Add the default route and the default source address, then verify configuration:

l1:~# ip route add 0/0 via 172.17.0.1 src 172.17.0.14
l1:~# ip route list
default via 172.17.0.1 dev eth0 src 172.17.0.14 
172.17.0.0/21 dev eth0 proto kernel scope link src 172.17.0.14

You have two ways to use the secondary addresses for specific destination. You can add the route to a particular destination with specifying src attribute:

Use 172.17.0.15 as source address for 192.168.10.2 destination

l1:~# ip route add 192.168.10.2 via 172.17.0.1 src 172.17.0.15

Use 172.17.0.16 as source address for 192.168.11.2 destination

l1:~# ip r add 192.168.11.2 via 172.17.0.1 src 172.17.0.16

Verify the routing table:

l1:~# ip r ls
default via 172.17.0.1 dev eth0 src 172.17.0.14 
172.17.0.0/21 dev eth0 proto kernel scope link src 172.17.0.14 
192.168.10.2 via 172.17.0.1 dev eth0 src 172.17.0.15 
192.168.11.2 via 172.17.0.1 dev eth0 src 172.17.0.16

Also you can check the actual routes for a specific destination with ip route get command:

l1:~# ip route get 192.168.10.2
192.168.10.2 via 172.17.0.1 dev eth0 src 172.17.0.15 uid 0 
    cache

There is a short version of same command:

l1:~# ip r g 192.168.11.2
192.168.11.2 via 172.17.0.1 dev eth0 src 172.17.0.16 uid 0 
    cache

Check the results with ping and tcpdump. Ping the hosts and check the output of tcpdump in an other console. You can use the wireshark instead tcpdump.:

l1:~# tcpdump -ni eth0 'icmp'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10:21:07.972535 IP 172.17.0.14 > 172.17.0.1: ICMP echo request, id 23048, seq 0, length 64
10:21:07.974416 IP 172.17.0.1 > 172.17.0.14: ICMP echo reply, id 23048, seq 0, length 64
10:21:15.391709 IP 172.17.0.15 > 192.168.10.2: ICMP echo request, id 23304, seq 0, length 64
10:21:15.393515 IP 192.168.10.2 > 172.17.0.15: ICMP echo reply, id 23304, seq 0, length 64
10:21:18.207461 IP 172.17.0.16 > 192.168.11.2: ICMP echo request, id 23560, seq 0, length 64
10:21:18.209391 IP 192.168.11.2 > 172.17.0.16: ICMP echo reply, id 23560, seq 0, length 64

Other way is usage the SNAT target in the iptables. But if you have the hundreds of similar rules, it may impact the performance.

l1:~# iptables -t nat -A POSTROUTING \
               -o eth0 --dst 192.168.10.2 \
          -j SNAT --to-source 172.17.0.15
l1:~# iptables -t nat -A POSTROUTING \
               -o eth0 --dst 192.168.11.2 \
          -j SNAT --to-source 172.17.0.16

Better use the iptables-save and iptables-apply to safe configure the iptables. Verification is the same as in the route case - with ping and tcpdump. Also, you can check the rule counters to sure those rules work.

l1:~# iptables-save -c -t nat
# Generated by iptables-save v1.6.2 on Wed May 15 10:31:26 2019
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [4:336]
:POSTROUTING ACCEPT [0:0]
[2:168] -A POSTROUTING -d 192.168.10.2/32 -o eth0 -j SNAT --to-source 172.17.0.15
[2:168] -A POSTROUTING -d 192.168.11.2/32 -o eth0 -j SNAT --to-source 172.17.0.16
COMMIT
# Completed on Wed May 15 10:31:26 2019

There is the third way to use the specific source. In some applications you can specify the source in a configuration file or with command line arguments. For ping this is -I option:

l1:~# ping -c 2 -I 172.17.0.15 192.168.11.2
PING 192.168.11.2 (192.168.11.2) from 172.17.0.15: 56 data bytes
64 bytes from 192.168.11.2: seq=0 ttl=63 time=2.348 ms
64 bytes from 192.168.11.2: seq=1 ttl=63 time=1.270 ms

--- 192.168.11.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 1.270/1.809/2.348 ms

l1:~# tcpdump -ni eth0 'icmp'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
10:37:08.724723 IP 172.17.0.15 > 192.168.11.2: ICMP echo request, id 37384, seq 0, length 64
10:37:08.726805 IP 192.168.11.2 > 172.17.0.15: ICMP echo reply, id 37384, seq 0, length 64
10:37:09.724985 IP 172.17.0.15 > 192.168.11.2: ICMP echo request, id 37384, seq 1, length 64
10:37:09.726084 IP 192.168.11.2 > 172.17.0.15: ICMP echo reply, id 37384, seq 1, length 64

Also, you should know, what neither ip route or iptables know nothing about domain-names and can use only ip address of destination. Iptables can resolve domain-name at rule creation, but ip address in it won't being updated magically. There are some tricks to avoid this limitation:
- Fix the ip address associated with domain-name. You can use the /etc/hosts file to do it. This way suitable for quick tests and DNS records with long TTL.
- Most flexible way: usage of dnsmasq, ipset and iptables. In this case dnsmasq resolves the domain-names and stores its ip addresses into ipset lists. You can use these lists in the iptables SNAT rules.

I have followed all the steps you have given, it creates correctly the different IPs and their routes. However, when I drop the ping to (www.speedtest.net) and captured with tcpdump I see that they are dropped from the interface IP (172.17.0.14) instead of the 172.17.0.15. The same way for another URL set to the 172.17.0.16. I would really appreciate if you could explain those tricks to avoid the limitation that you have told. Thank you so much. — fqlenos, May 15 '19 at 13:52
I do not know if I am being pretty clear in English, but basically I need two or more different IPs (in the same computer) connected to two or more **different** speedtests web pages and realize if I obtain 10Mbps on each web page independently. — fqlenos, May 15 '19 at 14:08
Check the ip addresses of these speed test sites. They should be different. If they are same, nothing of above will help. For quick test fix these addresses into `/etc/hosts/`. — Anton Danilov, May 15 '19 at 14:18
Well, I have finally routed everything properly. I drop `ping www.movistar.es` and `ping www.speedtest.net` simultaneously and with `tcpdump -ni eth0 icmp` I see their respective source IP. Now, I have run both speedtests simultaneously and I continue having the half of the bandwidth on each. This may be because the speed throttling is assigned per Mac Address instead of IP as I thought initially? Can I change the Mac Address to the virtual IPs? Thanks for your fast replies @Anton Danilov — fqlenos, May 15 '19 at 17:35
Best practice is limiting the bandwidth for assigned subnet, not per mac or per ip address. Also, I think your uplink uses the fair queue, and the bandwidth is being divided between flows fairly. — Anton Danilov, May 15 '19 at 21:50
Fine, understood... So it seems that I it is impossible to bypass this bandwidth limit, isn't it? — fqlenos, May 15 '19 at 23:05
Yes, seems like that. But mark the answer as correct to help other. — Anton Danilov, May 15 '19 at 23:08
Any way to change src address without having it added to a network interface with `ip address add`? — laimison, Sep 02 '22 at 01:22

From specific source IP to specific destination IP with ip route or ip tables

Problem

For instance:

I have tried:

1 Answers1