To use a virtual server as a gateway for a network interface:
- Go to Control Panel > Virtual Servers > Label > Networking > Firewall. On the page that loads the Default firewall rules section displays the list of network interfaces for which this VS can function as a gateway.
- Select the command for the network interface, it can be either ACCEPT or DROP. If you select the DROP option, the Use as Gateway slider will become inactive, but you can save the configuration and all the traffic from the network interface will be dropped.
- Move the Use as Gateway slider to the right if you want the VS to function as a gateway for the network interface.
-
Click the Save Default Firewall Rules button to apply changes.
The configurations in steps 5 and 6 are only examples that were tested on CentOS 6. You can use them at your own risk. You may require different configurations for other operating systems.
-
Add the following commands in the console of the gateway VS:
echo
1
> /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s IP_range ! -d IP_range -o public_network_interface_name -j MASQUERADE
iptables -I FORWARD -i private_network_interface_name -o public_network_interface_name -j ACCEPT
iptables -I FORWARD -o public_network_interface_name -i private_network_interface_name -j ACCEPT
Where you need to indicate the range of IPs for which the VS will serve as a gateway and the name of the public and private network interfaces for the gateway VS. The IP range should contain only the IPv4 IPs (e.g. 10.10.10.0/24).
-
Add the following commands in the console of the VS that is to send traffic through the gateway VS:
route delete -net
default
route add -net
default
gw gateway_VS_IP
Where you need to indicate the IP of the gateway VS for this server.
When you set default firewall rules for a VS two additional iptables rules are added on the compute resource on which the VS is built. The iptables rules will contain the range of IPs for which the VS will serve as a gateway and the identifier of the gateway VS:
iptables -A FORWARD -s IP_range ! -d IP_range -m physdev --physdev-out gateway_VS_identifier -j gateway_VS_identifier iptables -A FORWARD ! -s IP_range -d IP_range -m physdev --physdev-in gateway_VS_identifier -j ACCEPT gateway_VS_identifier |