1

Let's say our router has 2 WAN IP addresses - ether1 with 199.16.1.2 and ether2 with 199.16.2.2, and a single default route pointing to 199.16.1.1 (the router directly connected to our router on ether1).

If a packet comes in on ether1 destined to 199.16.1.2, things are pretty straightforward - the reply from our router goes back out ether1 (using the default gateway route) with a source IP of 199.16.1.2.

If a packet comes in on ether2 destined to 199.16.2.2, the router's reply will go out the default gateway (out ether1), and its source IP address will be 199.16.2.2 (ether2's IP). If you want the reply to go out the same interface it came in on, you need some way to tell it that anything with the source IP address of 199.16.2.2 should go out ether2.

Does that sound right?

3

Routers route packets individually, based on the destination address, not the source address. A router doesn't know that any packet is a reply to any other packet. This can sometimes result in asymmetric routing.

6
  • So it sounds like it does indeed work as I suspected - it would go out ether1, but with ether2's IP as the source IP, right?
    – Tal
    Jan 16 '17 at 16:19
  • The source address is the address of the sending host, not a router address. Simply using a default route can certainly create an asymmetric routing problem. The way to fix that is to run a routing protocol, and exchange more specific routes. The interface with the more specific route will be used as the egress interface. You could still get asymmetric routing, but you know that the replies are using the shortest path to their destination.
    – Ron Maupin
    Jan 16 '17 at 16:23
  • I have a very specific example where the sending host (the one replying to the original request) is my router. Am I right in assuming that the reply will go out ether1, but it's source IP will be 199.16.2.2? It sounds like that's what you guys are saying.
    – Tal
    Jan 16 '17 at 18:05
  • A packet gets routed by its destination address. A router will look up the destination address in its routing table to determine to which interface the packet should be sent. If there is no destination network matching the destination address, the packet will be dropped. The default route (0.0.0.0/0) matches every destination address. If there is a more specific network matching the destination address it will be used.
    – Ron Maupin
    Jan 16 '17 at 18:23
  • I appreciate your input, but you're repeating yourself, and just quoting a textbook. I've read the book. My attempt to explain what is happening in my original question uses the exact logic you keep repeating. I just want to know that "yes - the packets in the example will go out ether1, and have the source IP of 199.16.2.2", or "No - they'll do something else, and here's why". My example does not, in any way, suggest that routing decisions are based on packet source IPs. I just want to make sure that routers don't have some crazy additional logic that would effect routing in my example.
    – Tal
    Jan 16 '17 at 20:01
2

Normally routers only consider the destination IP when routing.

Many routers can route based on more complex criteria, including the source address but this needs to be specially configured. This is usually called "policy routing".

Finally it is a bit odd for packets to be destined for a router unless the router is also doing NAT. At least on Linux I found that policy routing and NAT had an issue with each other, specifically the source IP Linux used for policy routing was the original source IP, not the translated source IP. I detail a method I found for working around this at how to make multiple subnet able to use one resource without being able to connect to each other in any way

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.