Warning: This is a low-value/watered-down post

Background#

I got a Shenzhen-Hong Kong IEPL machine from a friend. It has two network interfaces, eth0 and eth1, but by default, all traffic goes through eth0. eth1 had no routing configured. I planned to use metrics for basic traffic splitting initially, and then use PBR (Policy-Based Routing) to implement rule-based routing configuration.

Configuration#

The machine’s network was initially configured by cloud-init:

1
# This file is generated from information provided by the datasource. Changes
2
# to it will not persist across an instance reboot. To disable cloud-init's
3
# network configuration capabilities, write a file
4
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
5
# network: {config: disabled}
6
network:
7
    version: 2
8
    ethernets:
9
        eth0:
10
            addresses:
11
            - 10.10.1.31/16
12
            gateway4: 10.10.0.1
13
            match:
14
                macaddress: bc:24:11:f8:42:7a
15
            nameservers:
16
                addresses:
17
                - 223.5.5.5
18
                - 119.29.29.29
19
                search:
20
                - [REDACTED]
21
            set-name: eth0
22
        eth1:
23
            addresses:
24
            - 10.20.1.31/16
25
            - [REDACTED]/64
26
            gateway4: 10.20.0.1
27
            gateway6: fe80::be24:11ff:fe80:66bb
28
            match:
29
                macaddress: bc:24:11:50:96:0a
30
            nameservers:
31
                addresses:
32
                - 223.5.5.5
33
                - 119.29.29.29
34
                search:
35
                - [REDACTED]
36
            set-name: eth1

After backing up the config, I added metrics:

1
# This file is generated from information provided by the datasource. Changes
2
# to it will not persist across an instance reboot. To disable cloud-init's
3
# network configuration capabilities, write a file
4
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
5
# network: {config: disabled}
6
network:
7
    version: 2
8
    ethernets:
9
        eth0:
10
            addresses:
11
            - 10.10.1.31/16
12
            gateway4: 10.10.0.1
13
            match:
14
                macaddress: bc:24:11:f8:42:7a
15
            nameservers:
16
                addresses:
17
                - 223.5.5.5
18
                - 119.29.29.29
19
                search:
20
                - [REDACTED]
21
            set-name: eth0
22
           routes:
23
             - to: "default"
24
               via: "10.10.0.1"
25
               # Set metric=50 as the backup exit
26
               metric: 50
27
        eth1:
28
            addresses:
29
            - 10.20.1.31/16
30
            - [REDACTED]/64
31
            gateway4: 10.20.0.1
32
            gateway6: fe80::be24:11ff:fe80:66bb
33
            match:
34
                macaddress: bc:24:11:50:96:0a
35
            nameservers:
36
                addresses:
37
                - 223.5.5.5
38
                - 119.29.29.29
39
                search:
40
                - [REDACTED]
41
            set-name: eth1
42
           routes:
43
             - to: "default"
44
               via: "10.20.0.1"
45
               # Set metric=25 as the preferred exit
46
               metric: 25

Create the PBR configuration:

1
network:
2
  version: 2
3
  ethernets:
4
    eth0:
5
      routes:
6
        - to: default
7
          via: 10.10.0.1
8
          table: 10
9
      routing-policy:
10
        - from: 10.10.0.0/16
11
          table: 10
12
        - to: 202.46.[REDACTED]/32
13
          table: 10
14
    eth1:
15
      routes:
16
        - to: default
17
          via: 10.20.0.1
18
          table: 20
19
      routing-policy:
20
        - from: 10.20.0.0/16
21
          table: 20
22
        - to: 38.47.[REDACTED]/32
23
          table: 20
24
        - to: 23.149.[REDACTED]/32
25
          table: 20

For IPs that need to be accessed via a specific exit, just add a ‘to’ type rule and bind it to the corresponding routing table.

After finishing, run

1
netplan apply

to update the configuration.