Tuesday, December 9, 2014

Linux based GRE tunnel using Policy Based Routing

Here we are not using DNAT but linux PBR. We'll need two IP addresses on your system, say IP1 & IP2. 


  1. On your system, create a GRE tunnel between Local IP1 and Remote IP:
    ## CREATE GRE TUNNELmodprobe ip_gre echo 1 > /proc/sys/net/ipv4/ip_forward ip tu add zen mode gre remote 10.66.63.5 local 10.66.63.21 ttl 128 ip ad ad dev zen 172.17.0.41 peer 172.17.0.42/30
    ip li set zen up ip tu ls zen ip ad ls zen ping 172.17.0.42 -c 5
  2. Create a custom routing table to handle routing for GRE traffic:
  3. echo 200 custom >> /etc/iproute2/rt_tables
  4. Create a rule to route traffic originating from IP2 through custom routing table created in step 3:
    ip rule add from 192.168.30.200 lookup custom
  5. Create a route in custom routing table to make GRE interface the default gateway.
    ip route add dev eth1 table custom
  6. Send traffic with IP2 as source ip.

GRE tunnel on a linux system using DNAT

## CREATE GRE TUNNEL
modprobe ip_gre echo 1 > /proc/sys/net/ipv4/ip_forward ip tu add zen mode gre remote 10.66.63.5 local 10.66.63.21 ttl 128 ip ad ad dev zen 172.17.0.41 peer 172.17.0.42/30 ip li set zen up #iptables -I POSTROUTING -o zen -j MASQUERADE ip tu ls zen ip ad ls zen ping 172.17.0.42 -c 5


### IPTABLE RULE TO FORWARD TRAFFIC THROUGH GRE iptables -F
iptables -I OUTPUT -t nat -p tcp -s 10.37.144.130 -m multiport --dport 80,443,9401 -j DNAT --to 172.17.0.58