By default, a router (or layer-3 gateway) routes packets based on packet destination address header. It looks up its default routing table (statically configured or learnt through dynamic routing protocols eg. OSPF/BGP), chooses the most specific route (default route will be used if no matching route), and selects nexthop/gateway address. 

But in certain complex scenarios, we need to forward packets based on source, or destination or applications, or a combination of multiple criterion. That's where we need traffic steering (a.k.a, Policy-Based Routing/PBR). PBR can be very useful when interconnecting several private networks, or sharing multiple upstream ISP links, or directing traffic for special purposes (eg. redirect to external proxies, firewalls or caching engines etc).

RansNet routers support PBR based on either (or combination) of below:

• Source address

• Destination address

• Applications (protocol, port number, FQDN, object-groups)

CONFIG NOTES

• PBR happens at inbound interface when packets enters the interface, so "ip pbr policy..." should always be matching packets when they enter the interface (therefore use firewall-set inbound to mark packets, or use "ip pbr policy xx src..."

• When we configure PBR on HSG (with hotspot service running), we need to take note of a few things:

  • we must use firewall-set to mark the interesting packets, and apply fwmark to PBR policy. Don't use "ip pbr policy xx src y.y.y." to match by source IP address. Because the packets will not match this rule due to the order of operations between hotspot and PBR processes.

  • when we configure firewall-set to match packets, we must mark at the inbound interface. But because hotspot service generates dynamic tunnel interface so we are not sure which tunnel no. to use, so we will use tun+ and further restrict specific source networks by using "src" option under firewall-set to narrow to a particular vlan/network.

• if the nexthop exit interface is a physical/vlan interface, we must specific nexthop IP and optionally together with the interface eg. ip pbr route 10 0.0.0.0/0 nexthop 192.168.1.1 interface eth0 (the interface eth0 is optional, but the nexthop 192.168.1.1 is a MUST)

• if nexthop exit interface is a LTE interface (eg. lte0) which we don't know the exact nexthop IP, we just use interface as next hop, eg. ip pbr route 10 0.0.0.0/0 nexthop lte0

CONFIGURATION STEPS

1. Configure PBR policy (ip pbr policy xx), to define target packets for PBR

2. Configure PBR route (ip pbr route x.x.x.x/y), to define how/where to forward targeted packets instead of using default routing table

3. Configure firewall-access and firewall-snat rules to permit Internet access

CONFIGURATION EXAMPLE - Based on source

In this example, we are trying to achieve below objectives:

1. clients from 172.16.30.0/24 will go out from ISP1 link for Internet access

2. clients from 172.16.40.0/24 will go out from ISP2 link for Internet access

CONFIGURATION EXAMPLE - Based on Applications

In this example, we are trying to achieve below objectives:

• HTTP (TCP/80) access will go out from ISP1 link

• HTTPS (TCP/443 and UDP/443) access will go out from ISP2 link

TROUBLESHOOTING COMMANDS

CONFIG EXAMPLE ON HOTSPOT GATEWAY

Attached is a complete working configuration.