{"id":278,"date":"2017-07-24T17:13:21","date_gmt":"2017-07-24T15:13:21","guid":{"rendered":"http:\/\/blog.le-vert.net\/?p=278"},"modified":"2017-07-24T17:14:13","modified_gmt":"2017-07-24T15:14:13","slug":"policy-based-routing-pbr-with-shorewall-to-migrate-a-server","status":"publish","type":"post","link":"https:\/\/blog.le-vert.net\/?p=278","title":{"rendered":"Policy Based Routing (PBR) with Shorewall to migrate a server"},"content":{"rendered":"
\n\t\t\t\t\tTweet<\/a>\n\t\t\t\t<\/div><\/div>

Hey,<\/p>\n

Today I’m doing pure sysadmin work and I’ve been asked to migrate several servers from an obsolete IP range 192.168.x to 10.x. Things were quite easy until I reached the internal mail server that can be used by hundreds field hardware as a relay server. Everybody is supposed to use DNS entry but I won’t trust that.<\/p>\n

So my idea is to switch eth0 to the new network and keep a new eth1 in the old one to keep the service working and be able to log what’s using the obsolete address.
\nThere’s just a little problem: if my default gateway is on eth0, any packet entering eth1 from a routed network (would work for what’s connected in the legacy local network) will be answered using the default gateway on eth0. That’s asymmetric routing and that just doesn’t work.<\/p>\n

Okay, so how do I solve that ? With Shorewall of course ! The idea if to tag any packet entering eth1 with a different mark than the ones coming throught eth0 and provide different routing table for each mark. I’ll do this on CentOS today but it should be basically the same for any Linux system. Shorewall is usually available everywhere but you can try doing this by hand with “ip” and “iptables”. Looks like a lot of pain to me, though.
\nHaving both address routed and working is a nice step but it’s pretty useless if I have no way to find out who’s using the obsolete address so we’ll use Shorewall to log these access and create a specific rsyslog\/logrotate configuration to get a dedicated log.<\/p>\n

First, we’ll change the network configuration to have both interfaces up with a default gateway only on the first interface (connected to the new network). The gateway will be later overridden by Shorewall but it’s always saner to have a default configuration working, even with limited feature.<\/p>\n

So make sure to create proper ifcfg-eth0<\/code> and ifcfg-eth1<\/code> in \/etc\/sysconfig\/network-scripts<\/code> and make sure to have only GATEWAY<\/code> defined on the new network. You should also make sure that the server is reachable on its new address and reachable on the old address with a machine directly connected to the legacy network.<\/p>\n

Let’s continue with a very basic Shorewall configuration. yum -y install shorewall<\/code> and then make sure to have the three following files in \/etc\/shorewall<\/code>:<\/p>\n