Policy Routing With Linux - Online Edition

by Matthew G. Marsh

Table Of Contents

Section I - Theory, Usage, and Utilities

This initial chapter provides brief coverage of standard TCP/IP routing as practiced under IPv4. The uses of the traditional Unix and Cisco IOS commands and syntax for simple setups will be mentioned. We will also touch upon the methodologies behind route costing such as Hop count and Link State. Finally we will illustrate a simple Internet connected network along with the needed routing commands to connect using Linux.

Traditional IPv4 routing Theory

Unix Configuration Commands

Cisco IOS Configuration Commands

IPv4 Dynamic Routing Protocols

Unix Routing Daemons & Cisco IOS Configurations

Here we will discuss the types of environments that led to the development of the concept of policy routing and the theory behind why you would want to use policy routing structures. We will only consider the policy structures themselves and how they solve these problems.

What do you mean by "Policy"

Common IPv4Routing Problems

PolicyRouting Structure

In this chapter we will now address how the Linux Policy Routing structure is implemented. We will cover how this structure interacts with the Packet Paths both native within the kernel and in conjunction with the packet filtering and network extensions.

Packet Paths through the Kernel

IPFWADM/IPChains Packet Pathing

NetFilter Packet Pathing

Routing Policy DataBase (RPDB)

Obtaining & Compiling IPROUTE2

General command structure

In this chapter we will cover how to implement standard networks, much as we had seen in Chapter 1, using the policy routing tools. We will introduce the extensions for use with the policy routing structures and how even relatively simple network configurations can benefit from implementation using policy routing structures.

Chapter 1 Example Revisited

Multiple IP Addressing

Multiple Default Routes

Loop Routing

Multiple Routing Tables

Rule and Table Interactions

In this chapter we will cover network configurations where the only complete solutions demand policy routing structures. We will cover multiple networks with disparate gateways, bandwidth and link state load balancing, and transparent routing structures. We will also mention several firewall type functions and interactions between the functions. In most cases we will illustrate several different solutions to solving the problems. This will show the flexibility and scope of the solution space for these functions.

Local Interfaces

MultiHomed, MultiAddressed

Transparent Routing

Policy Firewalling

Routing Load Balancing

Phantom Forwarders

Here we will take up the interactions between policy routing structures and dynamic routing protocols. This is an especially sticky subject as most dynamic routing protocols only understand traditional routing. There are many different points of potential conflict as we had discussed in Chapters 1,2, and 4, between a traditional routing structure and a policy routing structure. Here we will bridge the gap and show you how to use both methods. We will also note where to obtain various policy routing aware routing daemons and what you will have to consider to implement them within the Linux environment.

Realms and Information Bases

Gated and Zebra

Rules and Dynamic Structure

The origination of NAT is related to the origination of policy routing. And in Linux the first implementation of true one-to-one NAT was done as a policy routing structure. Here we take up this method and also discuss the various other ways that these functions may also be implemented within a Linux system. Some of the discusison within this chapter will touch upon utilities and methods we will not be covering in this book (REF: PakSecured Policy Routing Firewall) but are noted here for reference.

Basic NAT

FastNAT

Pseudo NAT

IPv6 Theory & History

Policy Routing Usage

Policy Routing Triad

The Protocols: IPv{4,6} & IPSec

Security & Commerce