Source port routing

Sometimes, you may want some services (i.e. web) to be routed through a different interface. Here is a quick setup with some common problems.


  • – your additional gateway, through which you only want to route web traffic (TCP port 80),
  • – server which needs source port routing altered,
  • tun0 – device on which will be used for source port routing.

Now, we’re ready to start configuration:

  • first, add a new routing table to /etc/iproute2/rt_tables – we’ll call it “http” and it will be table “1” – with it, your /etc/iproute2/rt_tables file should look much like below:
  • assuming the peer through which you want to push http traffic is behind tun0 interface and has address, we have to manipulate routing with the two rules below:

Basically, they mean that “http” table traffic need to go through tun0,, and packets marked with “1” value should get there.

  • we also need to mark the packets – we’ll use iptables for that:

This means that in the mangle table, locally-generated packets with source which would by default go through eth0, will be marked with “1” value.

Still doesn’t work? Check these things below:

  • rp_filter has to be set to 0 for given interfaces – 0 is the default value set by the Linux kernel, but some distributions (i.e. Ubuntu, Mandriva) alter it and set it to 1; just adding that to /etc/sysctl.conf should do the trick to make sure this value is set to 0 after reboot:

If you’re not rebooting any time soon, see what these value currently are with:

  • there has to be direct, not routed traffic between the hosts – for example, if you have more than one hop, source port routing will not work:

It has to look like below:

  • not sure what you have to change on your new gateway ( in this example)? The below should be enough:

  • note that web traffic should also come from

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.