Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have this challenge, and I've searched the internet high and low. Learned a lot - but Im still having some issues regarding my two gateway setup, which I really want to accomplish.

I have two gateways, for various reasons and I am trying to get the two NICs to behave. My problem is with the secondary Gateway (Gateway2), since everything works with Gateway1 and eth0, default route and everything.

So first off, my setup looks somewhat like this:

NAT (in) = Cisco ASA NAT (out)= Zyxel whatever


NAT (in) - - - - - - - - - - Ubuntu Box 12.04 - - - - - - - - - - - - NAT (out)

Gateway1 <-> (eth0) || (eth1) <->

. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gateway2

So I went to:

1. Create new table : "1 zyxelwan"

within "/etc/iproute2/rt_tables"

2. Create routing policy for table (zyxelwan)

 ip route add dev eth1 src table zyxelwan

 ip route add default via dev eth1 table zyxelwan

3. Set the IP rules which makes use of the newly-created routing table:

 ip rule add from table zyxelwan

 ip rule add to table zyxelwan

I have left out other configurations (for now) to ensure that I was running lighest-possible-config. And it is as if my ip rules are being completely ignored, see here some of the outputs I get after the above mentioned steps.

 route -n

 Kernel IP routing table

 Destination    Gateway         Genmask        Flag Metric  Ref     Use Iface         UG  100      0        0 eth0   U     0      0        0 eth0   U     0      0        0 eth1

Cannot see the table Ive configured, but if I try to apply the routing commands to the table again, I get "file already exists". So the config should be there somewhere.

But when I try to tracepath i.e., I get this result:


 1:                                            0.161ms pmtu 1500

So I tried to delete the gateway, from which it tried to send the traffic ( - with this result (This should seems to be regardless my ip rules & table).:


 1:  send failed

 Resume: pmtu 65535

And if I write the route, ommiting the table, and replace the previous default route with:

 route add default via dev eth1

It will ofc work,but id really like being able to SSH/VPN into the Ubuntubox from my Cisco Gateway and then access the network on my Zyxel Gateway - Am I missing something dreadfully obvious, or are you smart ppl out there able to point me in the right direction?

I was thinking according my ip rules, it could be as if it only "listens" for traffic, and will direct it out the same interface - according to the table/ip rules - and the solution might just have been "switching the cables around"?

Anyhow, thank you in advance for any suggestions :)

share|improve this question
The more I look at the config and setup - Im drawn to the conclusion, that I might have to create the routing table for the eth0 -> Cisco part of the network, to achieve what I want: The ability to NAT and then SSH/VPN into the ubuntu box, from the Cisco WAN and then use default gateway and network etc. of the Zyxel(With the possibility of having to setup another routing table for eth1 - Zyxel Gateway2, aswell?). But it would be nice if someone could confirm my suspecion, since Im am not currently available at the system :) – user1426797 May 30 '12 at 21:02
up vote 1 down vote accepted

I resolved the issue, by forcing a bind on the local ip of eth0, of OpenVPN - afterwards, I created another routing table for eth0. I then added a default gateway for eth1 as well, the regular way - no table :)

Thank you for having taken time to look at my original post :)

share|improve this answer

The old route command isn't able to properly represent any of the fancy stuff you are doing with the new ip route command. To show the routing configuration, use ip route list table [xx|all] instead of route.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.