vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #229 from currite/pbr

Browse Source 
pbr: some format and indentation
This commit is contained in:
Christian Poessinger 2020-04-02 08:08:10 +02:00 committed by GitHub
commit e6b80fe82e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
docs/routing/pbr.rst
View File

@ -5,15 +5,16 @@
PBR PBR
--- ---
:abbr:`PBR (Policy-Based Routing)` allowing traffic to be assigned to different :abbr:`PBR (Policy-Based Routing)` allowing traffic to be assigned to
routing tables. Traffic can be matched using standard 5-tuple matching (source different routing tables. Traffic can be matched using standard 5-tuple
address, destination address, protocol, source port, destination port). matching (source address, destination address, protocol, source port,
destination port).
Transparent Proxy Transparent Proxy
^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^
The following example will show how VyOS can be used to redirect web traffic to The following example will show how VyOS can be used to redirect web
an external transparent proxy: traffic to an external transparent proxy:
.. code-block:: none .. code-block:: none
@ -21,9 +22,9 @@ an external transparent proxy:
set policy route FILTER-WEB rule 1000 protocol tcp set policy route FILTER-WEB rule 1000 protocol tcp
set policy route FILTER-WEB rule 1000 set table 100 set policy route FILTER-WEB rule 1000 set table 100
This creates a route policy called FILTER-WEB with one rule to set the routing This creates a route policy called FILTER-WEB with one rule to set the
table for matching traffic (TCP port 80) to table ID 100 instead of the routing table for matching traffic (TCP port 80) to table ID 100
default routing table. instead of the default routing table.
To create routing table 100 and add a new default gateway to be used by To create routing table 100 and add a new default gateway to be used by
traffic matching our route policy: traffic matching our route policy:
@ -32,10 +33,11 @@ traffic matching our route policy:
set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2 set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2
This can be confirmed using the show ip route table 100 operational command. This can be confirmed using the ``show ip route table 100`` operational
command.
Finally, to apply the policy route to ingress traffic on our LAN interface, Finally, to apply the policy route to ingress traffic on our LAN
we use: interface, we use:
.. code-block:: none .. code-block:: none
@ -45,15 +47,15 @@ we use:
Multiple Uplinks Multiple Uplinks
^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^
VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and VyOS Policy-Based Routing (PBR) works by matching source IP address
forwarding the traffic using different routing tables. ranges and forwarding the traffic using different routing tables.
Routing tables that will be used in this example are: Routing tables that will be used in this example are:
* ``table 10`` Routing table used for VLAN 10 (192.168.188.0/24) * ``table 10`` Routing table used for VLAN 10 (192.168.188.0/24)
* ``table 11`` Routing table used for VLAN 11 (192.168.189.0/24) * ``table 11`` Routing table used for VLAN 11 (192.168.189.0/24)
* ``main`` Routing table used by VyOS and other interfaces not participating in * ``main`` Routing table used by VyOS and other interfaces not
PBR participating in PBR
.. figure:: ../_static/images/pbr_example_1.png .. figure:: ../_static/images/pbr_example_1.png
:scale: 80 % :scale: 80 %
@ -89,7 +91,8 @@ Apply routing policy to **inbound** direction of out VLAN interfaces
set interfaces ethernet eth0 vif 11 policy route 'PBR' set interfaces ethernet eth0 vif 11 policy route 'PBR'
**OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR **OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11)
from PBR
.. code-block:: none .. code-block:: none
@ -98,5 +101,5 @@ Apply routing policy to **inbound** direction of out VLAN interfaces
set policy route PBR rule 10 destination address '192.168.189.0/24' set policy route PBR rule 10 destination address '192.168.189.0/24'
set policy route PBR rule 10 set table 'main' set policy route PBR rule 10 set table 'main'
.. note:: Allows the VLAN10 and VLAN20 hosts to communicate with each other These commands allow the VLAN10 and VLAN20 hosts to communicate with
using the main routing table. each other using the main routing table.