# Web surfing via a specific interface? **URL:** \ **Category:** SLES Networking\ **Created:** [November 22, 2011, 9:16am UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970 "2011-11-22T09:16:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\ **Post date:** [November 22, 2011, 9:16am UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/1 "2011-11-22T09:16:02Z")
My server is SLES11-SP1. Interface-1 is my primary Internet access and default gateway. It’s an ADSL link at 5 Mbs with static IP’s. I get a call from the Cable company with an offer I can’t refuse. Now I have a second Internet connection at 25 Mbs with a single dynamic IP address. I have a spare nic in the server so interface-2 now connects to the Cable company. The idea was to use interface-2 for web surfing but I can’t see any way to route only port 80 and 443 traffic. /etc/sysconfig/SuSEfirewall2 allows me to specify the subnets and ports to forward but it doesn’t seem to allow me to specify a particular interface. How do I direct traffic to a particular interface based on port number? ## – Kevin Boyle If you find this post helpful, please click on the star below! KBOYLE’s Profile: [http://forums.novell.com/member.php?userid=19359](http://forums.novell.com/member.php?userid=19359) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [November 22, 2011, 3:46pm UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/2 "2011-11-22T15:46:01Z")
Maybe possible with: ## Code: # iptables -t nat -A PREROUTING -d ‘IP of eth1’ -p tcp --dports 80,443 -j DNAT --to ‘IP of eth2’. * * * Regards, Tom ## – amo\_vzug amo\_vzug’s Profile: [http://forums.novell.com/member.php?userid=25342](http://forums.novell.com/member.php?userid=25342) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [November 22, 2011, 4:03pm UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/3 "2011-11-22T16:03:58Z")
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This may be tricky. You’re talking about doing routing at layer 3 (IP) based on data at layer 4 (TCP) which is encapsulated in IP and, therefore, not really cared-about by the layer 3 stuff. Your default gateway would be the easiest thing to change to get things going over the Cable-based connection and then you could do the few things that need the other connection some other way. If it’s all inbound traffic of some sort (SSH, VPN, whatever) that you want to do over the other interface with the static IP then that may work easily. Knowing more about those services may help. Most of the time layer 4 switches tend to be dedicated devices that are doing switching based on the destination port and they only do it for a couple of destinations (LDAP servers for example). I’ve also heard of people in a situation like yours that basically use one connection until it dies and then failover to the other one. Good luck. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (GNU/Linux) Comment: Using GnuPG with Mozilla - [http://enigmail.mozdev.org/](http://enigmail.mozdev.org/) iQIcBAEBAgAGBQJOy6tmAAoJEF+XTK08PnB5u58P/jtdTt9+dObaQyQEy+cqjY+U eEESjkZUNyMVSLZYcJVF+0mDvk013JAQ3BAvQzC3WU2FAlGiuphdakFZP8ZKVgZU wLl/Bx7We0wfwAByrw+vs2i3QOylbD+FG/s/tcLbnaHhZKUx+vZRQMR3FP+JcHMb yoF1pBezGRoOAjGenjYRER/Zufvoxha8PYmAoEWw+R2mRw4sRbUzEEtLmeCIxyGb ykZSQaywmSNS89Nc4kj2xkpEZqnclB8MVPtaQa6G1UVIudg9GkSAEIbi6qU3WTnP NeG70dSQb4V6Eb18VWEq0bPMwkWPbns08zukSfwG2OrweLiLXWtfGBep7x4fYm8o 6Be3eDzhL84ZxeQvBAaijdETF/N+UfGpjE/A8DQcm822rEHokwuYisr5ZSpGmg65 H74NDdxrFUGL8Sva+WCW/geVC8uLn2ZKjZsY+VwppCq81+2Hon/mH85DQR/7UF5N uU95u5I+REO/n9gwLOe+O+JlwLsU+hBjzRWd4hbLxwnDmRcFHJUohvC/Rs5nLbLR zG6AGbkHOI8yZRYZmRxRaBGh9hQ2hUl9i4wXNP21egUNWxaqI66ZEnAj2D3lBQEf lj1ALCmmpM1ed6MkPyQJEhmpzVCiAzEHi/duOpNwRcho63IqepflEgHiOfrOh6HM T3efMC3t86DPxvb3kLow =BBj6 -----END PGP SIGNATURE----- ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [November 22, 2011, 6:16pm UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/4 "2011-11-22T18:16:02Z")
ab;2155569 Wrote:[color=blue] > This may be tricky.[/color] > Hi Aaron, I’ve worked with a dual interface router and had issues with traffic incoming via ISP #1 and the response sent via ISP #2. It does get messy, especially when the ISP #2 interface uses NAT. I had hoped to keep this relatively simple by only using the Cable ISP for surfing. I think this will require a bit more research. ☹ ## – Kevin Boyle If you find this post helpful, please click on the star below! KBOYLE’s Profile: [http://forums.novell.com/member.php?userid=19359](http://forums.novell.com/member.php?userid=19359) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [November 22, 2011, 6:26pm UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/5 "2011-11-22T18:26:02Z")
amo\_vzug;2155557 Wrote:[color=blue] > Maybe possible with:[color=green] > > > [/color][/color] > > Code: > > --------------------[color=blue][color=green] > > [/color] > > # iptables -t nat -A PREROUTING -d ‘IP of eth1’ -p tcp --dports 80,443 -j DNAT --to ‘IP of eth2’.[/color] --------------------[color=blue][color=green] > > [/color] > > Regards, > Tom[/color] > Hi Tom, So far, I have been able to use the SuSEfirewall2 config file to configure my firewall. I’ve read a bit about iptables and suspected that at some point I would need to understand it better. It looks like that day has arrived… Thanks for the tip! Kevin ## – KBOYLE KBOYLE’s Profile: [http://forums.novell.com/member.php?userid=19359](http://forums.novell.com/member.php?userid=19359) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [November 24, 2011, 1:36am UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/6 "2011-11-24T01:36:02Z")
amo\_vzug;2155557 Wrote:[color=blue] > Maybe possible with:[color=green] > > > [/color][/color] > > Code: > > --------------------[color=blue][color=green] > > [/color] > > # iptables -t nat -A PREROUTING -d ‘IP of eth1’ -p tcp --dports 80,443 -j DNAT --to ‘IP of eth2’. > > [/color] > --------------------[color=blue][color=green] > > > [/color] > > Regards, > Tom[/color] > Here’s what I tried and the results I got. ## Code: # iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dports 80,443 -j DNAT --to 222.222.222.222 ## iptables v1.4.6: unknown option `–dports’ ## Code: # iptables -t nat -n -L Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) target prot opt source destination # iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dport 80 -j DNAT --to 222.222.222.222 # iptables -t nat -A PREROUTING -d 111.111.111.111 -p tcp --dport 443 -j DNAT --to 222.222.222.222 # iptables -t nat -n -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp – 0.0.0.0/0 111.111.111.111 tcp dpt:80 to:222.222.222.222 DNAT tcp – 0.0.0.0/0 111.111.111.111 tcp dpt:443 to:222.222.222.222 Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.254.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 MASQUERADE all – 192.168.253.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) target prot opt source destination # * * * Observations: - I don’t understand the need for the duplicate MASQUERADE entries. I would think a single entry for each of the subnets should do. I suspect it is just the way that SuSEfirewall2 generated the rules… - The new entries to the PREROUTING chain have no effect. All outbount packets are via 111.111.111.111. - I don’t understand what DNAT refers to. - After a few minutes the nat table reverts back to the original version without the additional entries to the PREROUTING chain. Do you know why this might happen? Do you have any additional suggestions? Kevin ## – KBOYLE KBOYLE’s Profile: [http://forums.novell.com/member.php?userid=19359](http://forums.novell.com/member.php?userid=19359) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [December 2, 2011, 1:46pm UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/7 "2011-12-02T13:46:01Z")
Hi Kevin, is running a squid proxy on the machine an option? Then you might want to look at the tcp\_outgoing\_address option (an make sure your proxy will only listen on an internal interface, like 127.0.0.1 if all requests origin on the sam machine - http\_port option)… Regards, Jens ## – from the times when today’s “old school” was “new school” :eek: jmozdzen’s Profile: [http://forums.novell.com/member.php?userid=32246](http://forums.novell.com/member.php?userid=32246) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [December 3, 2011, 2:26am UTC](https://forums.suse.com/t/web-surfing-via-a-specific-interface/21970/8 "2011-12-03T02:26:02Z")
jmozdzen;2158140 Wrote:[color=blue] > Hi Kevin, > > is running a squid proxy on the machine an option? Then you might want > to look at the tcp\_outgoing\_address option (an make sure your proxy will > only listen on an internal interface, like 127.0.0.1 if all requests > origin on the sam machine - http\_port option)… > > Regards, > > Jens[/color] > Hi Jens, This is a firewall machine. Most requests will originate from somewhere on the LAN although some could/will originate from this server. I’m relatively new to Linux with only a few years under my belt. I have yet to play with a squid proxy or delve into iptables, both of which are on my to do list. I don’t think it is too unusual these days to have a second ISP for backup or load balancing. I have configured a Netgear FVS336G dual WAN router/firewall for a customer. It provides load balancing and fail-over but creating rules is very time consuming and the device has throughput limitations. In my area, the cable company is offering 100 megabit service which can tax many small routers. I would think a SLES firewall should be able to provide the capabilities I need and accommodate the higher throughput. I’m surprised this issue hasn’t come up before… I suspect iptables might be the solution. I’ll just have to make some time to learn a bit more about it. If anyone is interested, I can recommend a good book. It’s well organized and easy to read but there is a lot of material to digest… 'Novell Press Books - Linux Firewalls, Third Edition ’ ([http://www.novell.com/training/books/book.html?book=bookAdm&val=2](http://www.novell.com/training/books/book.html?book=bookAdm&val=2)) Thank you for your input. ## – Kevin Boyle If you find this post helpful, please click on the star below! KBOYLE’s Profile: [http://forums.novell.com/member.php?userid=19359](http://forums.novell.com/member.php?userid=19359) View this thread: [http://forums.novell.com/showthread.php?t=448538](http://forums.novell.com/showthread.php?t=448538)