Let us assume we use for our workstations IP addresses from network 192.168.100.0/24. The IP addresses are assigned as follows:
- 192.168.100.1-127 are used for Group A workstations
- 192.168.100.128-253 are used for Group B workstations
- 192.168.100.254 is used for the router.
Now, when we have workstations divided into groups, we can refer to them using subnet addressing:
- Group A is 192.168.100.0/25, i.e., addresses 192.168.100.0-127
- Group B is 192.168.100.128/25, i.e., addresses 192.168.100.128-255
If you do not understand this, take the TCP/IP Basics course, or, look for some resources about subnetting on the Internet!We need to add two IP Firewall Mangle rules to mark the packets originated from Group A or Group B workstations.
For Group A, specify
- Chain prerouting and Src. Address 192.168.100.0/25
- Action mark routing and New Routing Mark GroupA.
It is a good practice to add a comment as well. Your mangle rules might be interesting for someone else and for yourself as well after some time.
For Group B, specify
- Chain prerouting and Src. Address 192.168.100.128/25
- Action mark routing and New Routing Mark GroupB
All IP traffic coming from workstations is marked with the routing marks GroupA or GroupB. We can use these marks in the routing table.
Next, we should specify two default routes (destination 0.0.0.0/0) with appropriate routing marks and gateways:
Žádné komentáře:
Okomentovat