{"id":479,"date":"2020-08-05T16:38:00","date_gmt":"2020-08-05T07:38:00","guid":{"rendered":""},"modified":"2020-10-02T22:27:58","modified_gmt":"2020-10-02T13:27:58","slug":"linux%e3%81%a7pbr","status":"publish","type":"post","link":"https:\/\/wp.zassoul.com\/?p=479","title":{"rendered":"Linux\u3067PBR"},"content":{"rendered":"<p>AWS\u3067\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u7acb\u3061\u4e0a\u3052\u305f\u3068\u304d\uff0c2\u3064\u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u306b\u6240\u5c5e\u3055\u305b\u4e00\u65b9\u306f\u793e\u5185\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\uff0c\u4e00\u65b9\u306f\u30e1\u30f3\u30c6\u30ca\u30f3\u30b9\u7528\u306b\u5916\u90e8(\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8)\u304b\u3089SSH\u30a2\u30af\u30bb\u30b9\u7528\u306b\u3068\u69cb\u6210\u3059\u308b\u3053\u3068\u304c\u3042\u308b\u3002 <\/p>\n<div><\/div>\n<div>  \u3053\u306e\u5834\u5408\uff0c\u305d\u308c\u305e\u308c\u306eNIC\u306b\u7740\u4fe1\u3057\u305f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u305d\u306eNIC\u304b\u3089\u5fdc\u7b54\u3092\u8fd4\u3057\u3066\u6b32\u3057\u3044\u304c\u901a\u4fe1\u5143\u304c\u4e0d\u7279\u5b9a\u3060\u3068\u30b9\u30bf\u30c6\u30a3\u30c3\u30af\u30eb\u30fc\u30c8\u3067\u51e6\u7406\u3059\u308b\u306e\u306f\u4e0d\u53ef\u80fd\u3002\u3053\u306e\u3088\u3046\u306a\u6642\u306fPBR\u3092\u8a2d\u5b9a\u3057\u3066\u5bfe\u5fdc\u3059\u308b\u3002 <\/div>\n<div><\/div>\n<div>\u53c2\u8003)&nbsp;<\/div>\n<div>  <a href=\"http:\/\/linuxjf.osdn.jp\/JFdocs\/Adv-Routing-HOWTO\/index.html\" target=\"_blank\" rel=\"noopener noreferrer\">Linux Advanced Routing &amp; Traffic Control HOWTO<\/a><\/div>\n<div>  <a href=\"http:\/\/linux-ip.net\/gl\/ip-cref\/ip-cref-node75.html\">http:\/\/linux-ip.net\/gl\/ip-cref\/ip-cref-node75.html<\/a><\/div>\n<div style=\"clear: both; text-align: center;\">  <a href=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR.png\" style=\"margin-left: 1em; margin-right: 1em;\"><img decoding=\"async\" border=\"0\" data-original-height=\"567\" data-original-width=\"1224\" src=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR-300x139.png\" width=\"640\" \/><\/a><\/div>\n<h3 style=\"text-align: left;\">\u624b\u9806<\/h3>\n<div>\n<ul style=\"text-align: left;\">\n<li>\u30eb\u30fc\u30c8\u30c6\u30fc\u30d6\u30eb\u306e\u4f5c\u6210<\/li>\n<li>\u30dd\u30ea\u30b7\u30fc\u306e\u4f5c\u6210<\/li>\n<li>\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u306e\u8ffd\u52a0<\/li>\n<li>\u6c38\u7d9a\u7684\u8a2d\u5b9a<\/li>\n<\/ul>\n<\/div>\n<h3 style=\"text-align: left;\">\u30eb\u30fc\u30c8\u30c6\u30fc\u30d6\u30eb\u306e\u4f5c\u6210<\/h3>\n<div>  \/etc\/iproute2\/rt_tables   \u306bens192\u7528\u306e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u30c6\u30fc\u30d6\u30eb\u300crt10\u300d\u3068ens224\u7528\u306e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u30c6\u30fc\u30d6\u30eb\u300crt100\u300d\u3092\u8ffd\u52a0\u3059\u308b\u3002\u306a\u304a\uff0cID\u306f1\uff5e255\u307e\u3067\u3042\u308a\uff0c254\u306fmain\u30c6\u30fc\u30d6\u30eb\uff0c255\u306flocal\u3067\u30ea\u30b6\u30fc\u30d6\u3055\u308c\u3066\u3044\u308b\u3002\u3053\u3053\u3067\u306f100\u3068101\u3092\u4f7f\u7528\u3059\u308b\u3002 <\/div>\n<pre>#<br \/># reserved values<br \/>#<br \/>255     local<br \/>254     main<br \/>253     default<br \/>0       unspec<br \/>#<br \/># local<br \/>#<br \/>#1      inr.ruhep<br \/>100     rt100       #\u8ffd\u52a0<br \/>101     rt10        #\u8ffd\u52a0<br \/><br \/><\/pre>\n<h3 style=\"text-align: left;\">\u30dd\u30ea\u30b7\u30fc\u306e\u4f5c\u6210<\/h3>\n<div>  \u66f8\u5f0f: ip rule add from &lt;IF address&gt; table &lt;table name&gt; priority   &lt;priority number&gt; <\/div>\n<pre># ip rule add from 192.168.10.40 table rt10 priority 100<br \/># ip rule add from 192.168.1.40 table rt100 priority 101<br \/><\/pre>\n<p>priorit\u3092\u6307\u5b9a\u3057\u306a\u3044\u3068\u30ab\u30fc\u30cd\u30eb\u304c\u4e00\u756a\u53e4\u3044priority\u306e\u524d\u306b\u81ea\u52d5\u3067\u63a1\u756a\u3059\u308b\u3002\u4f55\u3082\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u3051\u308c\u3070main\u306e32766\u306e\u524d\u306b\u9806\u306b\u8ffd\u52a0\u3055\u308c\u308b\u3002(32765\uff0c32764\u3068\u3044\u3046\u611f\u3058\u3067)  <\/p>\n<div><\/div>\n<h3 style=\"text-align: left;\">\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u306e\u8ffd\u52a0<\/h3>\n<div>  \u66f8\u5f0f: ip route add default via &lt;Gateway address&gt; dev &lt;IF name&gt;   table &lt;table name&gt;&nbsp; <\/div>\n<pre># ip route add default via 192.168.10.1 dev ens192 table rt10<br \/># ip route add default via 192.168.1.1 dev ens224 table rt100<br \/><\/pre>\n<div><\/div>\n<div>\u307e\u305a\u306f\u3053\u308c\u3067PBR\u306f\u8a2d\u5b9a\u5b8c\u4e86\u3002<\/div>\n<div>192.168.1.0\/24\u306b\u3044\u308bPC\u304b\u3089ping\u306e\u30c6\u30b9\u30c8\u3002<\/div>\n<div><\/div>\n<div>  PBR\u8a2d\u5b9a\u524d\u306fens192\u304b\u3089reply\u304c\u8fd4\u3063\u3066\u3044\u306a\u3044\u3002\uff08\u306a\u304a\uff0c\u30ea\u30d0\u30fc\u30b9\u30d1\u30b9\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u304c\u6709\u52b9\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067ens224\u3067\u306f\u623b\u308a\u306e\u30d1\u30b1\u30c3\u30c8\u304c\u304b\u3048\u3089\u306a\u3044\uff09 <\/div>\n<div style=\"clear: both; text-align: center;\">  <a href=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR_icmp_before.png\" style=\"margin-left: 1em; margin-right: 1em;\"><img decoding=\"async\" border=\"0\" data-original-height=\"206\" data-original-width=\"979\" src=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR_icmp_before-300x63.png\" width=\"640\" \/><\/a><\/div>\n<div>PBR\u8a2d\u5b9a\u5f8c\u306f\u3057\u3063\u304b\u308a\u7740\u4fe1IF\u304b\u3089reply\u304c\u8fd4\u3063\u3066\u3044\u308b\u3002<\/div>\n<div style=\"clear: both; text-align: center;\">  <a href=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR_icmp_after.png\" style=\"margin-left: 1em; margin-right: 1em;\"><img decoding=\"async\" border=\"0\" data-original-height=\"293\" data-original-width=\"970\" src=\"https:\/\/wp.zassoul.com\/wp-content\/uploads\/2020\/08\/PBR_icmp_after-300x91.png\" width=\"640\" \/><\/a><\/div>\n<div><\/div>\n<h3 style=\"text-align: left;\">\u6c38\u7d9a\u7684\u8a2d\u5b9a<\/h3>\n<div>  \u30b3\u30de\u30f3\u30c9\u3067\u8a2d\u5b9a\u3057\u305f\u30eb\u30fc\u30eb\u3068\u30eb\u30fc\u30c8\u306f\u518d\u8d77\u52d5\u3067\u6d88\u3048\u308b\u305f\u3081\uff0c\/etc\/sysconfig\/network-script\u914d\u4e0b\u306b\u5b9a\u7fa9\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3059\u308b\u3068\u3042\u3063\u305f\u304c\uff0cNetworkManger\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u74b0\u5883\u3067\u306f\u5229\u7528\u3067\u304d\u306a\u3044\u3002 <\/div>\n<div><\/div>\n<h4 style=\"text-align: left;\">\uff65 \u30eb\u30fc\u30eb\u5b9a\u7fa9<\/h4>\n<div>\/etc\/sysconfig\/network-script\/rule-&lt;IF\u540d&gt;<\/div>\n<div>\u5404IF\u306b\u5148\u306e\u30b3\u30de\u30f3\u30c9\u3092\u8a18\u8ff0\u3002<\/div>\n<pre>ip rule add from 192.168.10.40 table rt10 priority 100<br \/><\/pre>\n<pre>ip rule add from 192.168.1.40 table rt100 priority 101<br \/><\/pre>\n<div><\/div>\n<h4 style=\"text-align: left;\">\uff65 \u30eb\u30fc\u30c8\u5b9a\u7fa9<\/h4>\n<div>\/etc\/sysconfig\/network-script\/route-&lt;IF\u540d&gt;<\/div>\n<div>\u5404IF\u306b\u5148\u306e\u30b3\u30de\u30f3\u30c9\u3092\u8a18\u8ff0\u3002<\/div>\n<pre>ip route add default via 192.168.10.1 dev ens192 table rt10<br \/><\/pre>\n<pre>ip route add default via 192.168.1.1 dev ens224 table rt100<br \/><\/pre>\n<div><\/div>\n<div>  \u3053\u308c\u304cNG\u3068\u306a\u308b\u3068\uff0c\u8d77\u52d5\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u4e0a\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3088\u3046\u306b\u4ed5\u8fbc\u3080\u65b9\u6cd5\u304c\u8003\u3048\u3089\u308c\u308b\u3002 <\/div>\n<div>pbr.sh<\/div>\n<pre>#!\/bin\/sh<br \/>## create rules for pbr<br \/><br \/>ip rule add from 192.168.10.40 table rt10 priority 100 <br \/>ip rule add from 192.168.1.40 table rt100 priority 101 <br \/><br \/>## create default route for each routing tables<br \/>ip route add default via 192.168.10.1 dev ens192 table rt10<br \/>ip route add default via 192.168.1.1 dev ens224 table rt100<br \/><\/pre>\n<div>\/etc\/systemd\/system\/pbr.service<\/div>\n<pre>[Unit]<br \/>Description = PBR setting script<br \/>After = network-online.target    # NIC\u304c\u30aa\u30f3\u30e9\u30a4\u30f3\u306b\u306a\u3089\u306a\u3044\u3068\u30b3\u30de\u30f3\u30c9\u304c\u5931\u6557\u306b\u7d42\u308f\u308b\u305f\u3081<br \/><br \/>[Service]<br \/>ExecStart = \/root\/pbr.sh<br \/>Type = simple<br \/><br \/>[Install]<br \/>WantedBy = multi-user.target<br \/><br \/><\/pre>\n<div><\/div>\n<div>\u3053\u3053\u307e\u3067\u6e96\u5099\u3067\u304d\u305f\u3089<\/div>\n<pre># systemctl enable pbr.service<br \/># systemctl start pbr.service<br \/><\/pre>\n<div>\u3067\u5b8c\u4e86\u3002<\/div>\n<div><\/div>\n<div>  \u305f\u3060\u3053\u3053\u307e\u3067\u3084\u3063\u3066\u304a\u304d\u306a\u304c\u3089\uff0cnmcli\u3092\u4f7f\u3048\u3070\u30b3\u30de\u30f3\u30c91\u884c\u3067\u7d42\u308f\u308b\u3053\u3068\u304c\u5206\u304b\u3063\u305f\u3002 <\/div>\n<div><\/div>\n<h3 style=\"text-align: left;\">nmcli\u3092\u4f7f\u3046\u65b9\u6cd5<\/h3>\n<div><\/div>\n<div>ens192\u306e\u8a2d\u5b9a<\/div>\n<pre>nmcli con add type ethernet con-name ens192 ifname ens192 ipv4.method manual ipv4.addresses 192.168.10.40\/24 ipv4.routes \"0.0.0.0\/1 192.168.10.1 table=100, 128.0.0.0\/1 192.168.10.1 table=100\" ipv4.routing-rules \"priority 100 from 192.168.10.40 table 100\"<br \/><\/pre>\n<div><\/div>\n<div>ens224\u306e\u8a2d\u5b9a<\/div>\n<pre>nmcli con add type ethernet con-name ens224 ifname ens224 ipv4.method manual ipv4.addresses 192.168.1.40\/24 ipv4.routes \"0.0.0.0\/1 192.168.1.1 table=101, 128.0.0.0\/1 192.168.1.1 table=101\" ipv4.routing-rules \"priority 101 from 192.168.1.40 table 101\"<br \/><\/pre>\n<div><\/div>\n<div>\u4ee5\u4e0a\u3002\u8d85\u7c21\u5358\u3002\u518d\u8d77\u52d5\u5f8c\u3082\u3053\u308c\u3067\u5bfe\u5fdc\u3057\u3066\u3044\u308b\u3002<\/div>\n<div><a href=\"https:\/\/access.redhat.com\/documentation\/ja-jp\/red_hat_enterprise_linux\/8\/html\/configuring_and_managing_networking\/configuring-policy-based-routing-to-define-alternative-routes_configuring-and-managing-networking\" target=\"_blank\" rel=\"noopener noreferrer\">RHEL\u306e\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u306b\u3088\u308b\u3068\uff0cnmcli\u306f0.0.0.0\/0\u306e\u8868\u8a18\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u306a\u3044\u3068\u306e\u3053\u3068\u3067\uff0c0.0.0.0\/1\u3068128.0.0.0\/1\u306e2\u3064\u5b9a\u7fa9\u3092\u5165\u308c\u30660.0.0.0\/0\u3092\u30ab\u30d0\u30fc\u3057\u306a\u304f\u3066\u306f\u306a\u3089\u306a\u3044\u3068\u306e\u3053\u3068\u3002\u3053\u306e\u70b9\u3068\u30c6\u30fc\u30d6\u30eb\u3092\u540d\u524d\u6307\u5b9a\u304c\u3067\u304d\u305a\u756a\u53f7\u3067\u8a18\u8ff0\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e\u304c\u3084\u3084\u308f\u304b\u308a\u306b\u304f\u3044\u3002<\/div>\n<div><\/div>\n<div>\u3061\u306a\u307f\u306bIF\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306f\u4ee5\u4e0b\u306b\u3042\u308b\u3002<\/div>\n<div>\/etc\/NetworkManager\/system-connections\/ens192.nmconnection&nbsp;<\/div>\n<div>\n<div>\/etc\/NetworkManager\/system-connections\/ens224.nmconnection&nbsp;<\/div>\n<div><\/div>\n<\/div>\n<div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>AWS\u3067\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u7acb\u3061\u4e0a\u3052\u305f\u3068\u304d\uff0c2\u3064\u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u306b\u6240\u5c5e\u3055\u305b\u4e00\u65b9\u306f\u793e\u5185\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\uff0c\u4e00\u65b9\u306f\u30e1\u30f3\u30c6\u30ca\u30f3\u30b9\u7528\u306b\u5916\u90e8(\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8)\u304b\u3089SSH\u30a2\u30af\u30bb\u30b9\u7528\u306b\u3068\u69cb\u6210\u3059\u308b\u3053\u3068\u304c\u3042\u308b\u3002 \u3053\u306e\u5834\u5408\uff0c\u305d\u308c\u305e\u308c\u306eNIC\u306b\u7740\u4fe1\u3057\u305f\u30c8\u30e9\u30d5\u2026 <span class=\"read-more\"><a href=\"https:\/\/wp.zassoul.com\/?p=479\">\u7d9a\u304d\u3092\u8aad\u3080 &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":195,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,13,15,14,8],"tags":[],"class_list":["post-479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it","category-linux","category-network","category-pbr","category-8"],"_links":{"self":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=479"}],"version-history":[{"count":1,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/479\/revisions"}],"predecessor-version":[{"id":616,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/posts\/479\/revisions\/616"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=\/wp\/v2\/media\/195"}],"wp:attachment":[{"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.zassoul.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}