This article can be stored under the category note to self as I was not able to figure out the solution till late in the afternoon, I’m trying to write it in English in the hope to be useful to more people.

The problem
A gateway between two LANs, with the internal LAN split in VLANs using tagging from the host.

As ASCII art this is the network schema:

Office LAN | eth0
|---------------|
| |
| Linux gateway |
| |
|---------------|
| eth1 eth1.120 eth1.150
Laboratory LAN |
| bond0 bond0.120 bond0.150
|--------------|
| |
| Linux Server |
| |
|--------------|


To test our applications we set up different tagged VLANs in the laboratory network, until yesterday our applications running in the office LAN just connected to applications listening on physical interfaces and a simple forwarding iptables rule on the Linux gateway was enough. Yesterday we changed our testing configuration so we need services running on bond0.120 and bond0.150 to be reached from office LAN.

The solution

1. Add eth1.120 and eth1.150 to the gateway
2. Add addresses 192.168.120.18 to eth1.120 and 192.168.150.18 to eth1.150
3. Add forwarding rule to the gateway for new networks
4. Add 2 routing tables to the server
5. Add policy rules to use the new tables

To add the 2 new tables I just issued, as root, the following commands:

[ccNB_bash]echo 2 120 >> /etc/iproute2/rt_tables
echo 3 150 >> /etc/iproute2/rt_tables[/ccNB_bash]

Then I added the 2 default routes to the relative tables using the following commands:

[ccNB_bash]ip route add default via 192.168.120.18 dev bond0.120 table 120
ip route add default via 192.168.150.18 dev bond0.150 table 150[/ccNB_bash]

[ccNB_bash]ip rule add from 128.171.158.6 table 120 priority 1000
ip rule add from 128.171.159.253 table 150 priority 1000[/ccNB_bash]

To make this tables and rules permanent I created the following 4 files in /etc/sysconfig/network-scripts

1. route-bond0.120
2. route-bond0.150
3. rule-bond0.120
4. rule-bond0.150

The content of each file follows even if can be easily guessed:

route-bond0.120:
[ccNB_bash]default via 192.168.120.18 dev bond0.120 table 120[/ccNB_bash]
route-bond0.150:
[ccNB_bash]default via 192.168.150.18 dev bond0.150 table 150[/ccNB_bash]
rule-bond0.120:
[ccNB_bash]from 128.171.158.6 table 120 priority 1000[/ccNB_bash]
rule-bond0.150:
[ccNB_bash]from 128.171.159.253 table 150 priority 1000[/ccNB_bash]