Send one subnet out a chosen uplink#
You will end up with chosen traffic — one subnet, one protocol, one destination — always leaving through one uplink, whichever uplink the router otherwise prefers. "The cameras go out through LTE" is this.
Unlike load balancing, this is deterministic: the traffic that matches goes out that way every time, and nothing spreads it.
Before you start#
- The operator role and a licence.
- Two uplinks, both working.
- The traffic you want to pin, described as a source, a destination, a protocol or a port.
Step 1 — Add the rule#
Network → High availability → Uplinks, Policy routing → Add rule.
- Send through: the uplink.
- From address, To address: an address, a network such as
192.0.2.0/24, or a range. A leading!matches everything else. - Protocol and To port: a port needs TCP or UDP.
- Description: what the rule is for — cameras through LTE.
Step 2 — Choose where it applies#
Arriving on is the set of interfaces whose incoming traffic the policy looks at — usually the LAN or the VLAN the traffic comes from. Traffic has to arrive on one of them for the rule to be consulted. It is the policy's, so it applies to every rule in it.
Step 3 — Apply with auto-revert#
If the rule matches more than you meant — a network that covers your own workstation, say — the traffic you are using goes out through the other uplink, and whether that still reaches you depends on what is at the far end. Apply it from the Commit Bar with Apply with auto-revert.
Check it worked#
From a host inside the pinned subnet, look up your public address on a what-is-my-address site: it should be the chosen uplink's, while a host outside the subnet sees the other one.
The Policy routing panel lists the rule with the uplink it sends through; a rule whose uplink has gone shows No uplink.
Things that will bite#
A pinned subnet does not fail over. If the chosen uplink goes down, the traffic still goes there. That is the point of a deterministic rule, and its cost.
Return traffic follows the routing table, not the rule. For traffic the router originates or receives that is usually fine; for a hairpinned service it can be a surprise.
The chosen uplink needs its own source NAT, or the pinned traffic leaves with a private address. See Masquerade behind each uplink.
Undoing it#
Click the rule and Delete rule, or switch Rule enabled off to keep it for later. The routing table the page keeps for the uplink goes with the last rule that used it.