0

I am using IPSET to define the interested IP range.

I want to direct packets to one out of two WAN connections according to an IP range. Here are my conditions.

  1. A specific IP range. It is defined by using IPSET command to modify the underlying object for the network-group function.
  2. WAN connection, using DHCP, on eth4.
  3. Another WAN connection, using DHCP, on eth3.
  4. ER-X router, v2.09

By default, IP packets should use eth3 wan connection unless the destination IP address lied in the interested IP range. If so, packets should use eth4.

I have tried the following way, but it does not work. All packets always use eth3 unless I pulled out the eth3 connector.

First, create a network-group named "specialroute" and then use IPSET to import the interested IP range (for packets destination addresses to match).

Then create a static route table, representing where matched packets should go.

set protocols static table 13 interface-route 0.0.0.0/0 next-hop-interface eth4

Then mark eth4 with the failover-only flag to direct packets to eth3 by default.

However, some packets with the destination in the pre-defined IP range should go to eth4. So, I tried using Policy-Based-Routing to achieve the goal.

set firewall modify PBR rule 90 action modify
set firewall modify PBR rule 90 description specialroute
set firewall modify PBR rule 90 destination group network-group specialroute
set firewall modify PBR rule 90 modify table 13

It did not work as the failover-only flag might prevail PBR rules, and the router never sent packets from eth4.

What should I do? I want to let packets use one WAN connection by default unless the destination address belongs to the pre-defined IP ranges.

3
  • Can you post gui pictures of your config?. Jul 4, 2021 at 4:14
  • Routing by destination is done using the routing table. Simply add a specific entry for the desired address range, using a better metric than the default route one's. PBR is only required when routing by protocol, source address or similar.
    – Zac67
    Dec 1, 2021 at 9:27
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 20:23

1 Answer 1

0

I think you have configure Both the Routes in the main routing table as well as in table 13 and configure the PBR policy on the LAN interface in "IN" Direction

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.