Forwarding & Routing

A firewall placed between two networks needs to FORWARD packets between them.

[Internet] → eth0 → [Firewall] → eth1 → [Internal LAN]

Linux: enable forwarding via sysctl:

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables FORWARD chain:

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT     # outbound from LAN
iptables -A FORWARD -i eth0 -o eth1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT   # return traffic
iptables -A FORWARD -j DROP                        # default deny

Routing decisions:

• Per-destination, the kernel looks up its routing table.
• Picks an outgoing interface + next hop.
• Routes can be static (configured) or dynamic (BGP, OSPF).

Routes in Linux:

ip route add 192.168.1.0/24 via 10.0.0.1 dev eth1
ip route add default via 10.0.0.1

Multi-homed routing: more than one upstream.

• Source-based routing.
• Load balancing.
• Failover.

Policy-based routing:

• Different routes per source IP / port / mark.

Marking packets:

• iptables -A PREROUTING -t mangle -m mark --mark 0x1.
• Used for QoS, custom routing.

ICMP redirects:

• Router sends "use this other gateway" message.
• Useful for misconfigured networks; security risk.
• Modern firewalls: usually ignore.

Asymmetric routing:

• Reply goes via different path than request.
• Conntrack confused: doesn't see reply.
• Solutions: stateless filters or symmetric routing.

VRRP / HSRP:

• Virtual IP shared between two routers.
• Active fails over to standby.
• Common in firewall HA setups.

Modern: ECMP (Equal-Cost Multi-Path) for load distribution.