Linux Policy-Based Routing: Multi-Homing and Source Tables

Standard Linux network configurations use a single default gateway in the main routing table. When a server has multiple network interfaces or multiple public IP addresses on separate subnets, standard routing fails. If a packet arrives on secondary interface eth1, the application generates a reply packet with source address eth1. But when the kernel routes the reply, it looks up the main table and transmits the packet out of eth0 via the primary gateway.

Upstream Internet Service Providers implement Reverse Path Filtering (RPF) to drop spoofed traffic. When your primary gateway sees a packet exiting eth0 with eth1's IP address, it drops it as asymmetric routing abuse. Solving this requires Policy-Based Routing (PBR): routing packets based on source IP address rather than solely destination IP.

Expand

Creating Custom Routing Tables with iproute2

Linux supports up to 255 named routing tables. We start by registering custom table names in /etc/iproute2/rt_tables:

# Append custom table definitions
echo "100 uplink1" | sudo tee -a /etc/iproute2/rt_tables
echo "200 uplink2" | sudo tee -a /etc/iproute2/rt_tables

Now configure dedicated routing rules and gateways for each interface:

# Primary interface eth0 (192.0.2.10/24, gateway 192.0.2.1)
ip route add 192.0.2.0/24 dev eth0 src 192.0.2.10 table uplink1
ip route add default via 192.0.2.1 dev eth0 table uplink1

# Secondary interface eth1 (198.51.100.10/24, gateway 198.51.100.1)
ip route add 198.51.100.0/24 dev eth1 src 198.51.100.10 table uplink2
ip route add default via 198.51.100.1 dev eth1 table uplink2

# Add policy routing rules based on packet source address
ip rule add from 192.0.2.10/32 table uplink1 priority 100
ip rule add from 198.51.100.10/32 table uplink2 priority 200

Persisting Policy Routing via Netplan

To ensure rules persist across system reboots on Ubuntu systems, configure routing policy rules directly inside /etc/netplan/01-netcfg.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - 192.0.2.10/24
      routes:
        - to: default
          via: 192.0.2.1
          metric: 100
      routing-policy:
        - from: 192.0.2.10
          table: 100
    eth1:
      addresses:
        - 198.51.100.10/24
      routes:
        - to: default
          via: 198.51.100.1
          table: 200
      routing-policy:
        - from: 198.51.100.10
          table: 200

Apply the configuration with:

sudo netplan apply

Subnetting and Networking Video

Review foundational networking and subnet fundamentals in this clear breakdown:

Verifying Path Reachability

Test both uplinks using traceroute or ping with explicit source binding:

# Test reachability out of primary interface
ping -I 192.0.2.10 1.1.1.1 -c 3

# Test reachability out of secondary interface
ping -I 198.51.100.10 1.1.1.1 -c 3

Both pings should succeed with independent round-trip metrics, confirming symmetrical bidirectional routing.

Configure flexible multi-IP routing on DDoS-protected Linux VPS at netbayhosts.in.