Hi

I want to redesign my homelab. Here is my zone-concept:

My Unraid server has all the VLANs configured. E.g. I have a guest VM in VLAN-40, HomeAssistant in VLAN-20, multiple Dockers in VLAN-30, and VMs in VLAN-100.

My goal is to limit Unraid's SMB and NFS service to VLAN-30 and Unraid's management (ssh, HTTP, HTTPS) to VLAN-10. I can easily implement these restrictions in the firewall.

However I also need policy based routing in Unraid in order to route outgoing packets accordingly, in other words Unraid needs to use a different default GW depending on the service (source interface).

Unraid IP config:

• VLAN-10: 192.168.10.40/23, default-GW: 192.168.10.10 (VIP of "opensense cluster")

• VLAN-30: 192.168.30.40/23, default-GW: 192.168.30.10 (VIP of "opensense cluster")

From the "guests zone" (VLAN-40) Unraid can only be accessed via the "apps-zone" (VLAN-30). Unraid's default route therefore needs to point to 192.168.30.10. This is where Unraid's default GW points to.

However from the "homeland zone" (VLAN-100) Unraid can be accessed via the "apps-zone" (SMB, NFS) and the "mgmt-zone" (SSH, HTTP, HTTPS). Since Unraid's default GW points to 192.168.30.10, the FW will drop SSH, HTTP and HTTPS packets (spoofing since the packets arrive on the wrong interface - VLAN-30 instead of VLAN-10 ).

I need Policy Based Routing (PBR) on Unraid in order to fix this. Whenever Unraid uses 192.168.10.40 as it's source IP, it's default GW for routing needs to be 192.168.10.10 and not 192.168.40.10!

Is the following config correct, am I missing something, is there another way to configure this and what do I have to do to make the config persistent over reboots?

1) modify (create) /etc/iproute2/rt_tables edit: why does this not exist in Unraid?

# 
# reserved values
# 
255    local
254    main
253    default
0      unspec
# 
# local
# 
# my routing table for MGMT VLAN
10     MGMT
# my routing table for APP VLAN
30     APP

2) populate the new routing tables:

ip route add default via 192.168.10.10 table MGMT
ip route add default via 192.168.30.10 table APP

3) add rules for the kernel to decide when to use which routing table:

ip rule add from 192.168.10.40/32 table MGMT
ip rule add from 192.168.30.40/32 table APP

Thank you very much!

Edited September 11, 2025Sep 11 by Tom082

Why can I not create additional routing tables in Unraid?

I found this tutorial but sadly it seems even though the tutorial is for Slackware, Unraid does not support this? Why? Is there another way to do this and if so how?

Anyone?

Do I have to install another packet do get this functionality? If so which one and how can I do this on Unraid?

Any hints and help is highly appreciated, even if it's just a confirmation that this is not supported by Unraid (then at least like I can stop looking for a solution) for some reason. Thank you!

Edited September 15, 2025Sep 15 by Tom082

On 9/15/2025 at 8:25 AM, Tom082 said:

Anyone?

Do I have to install another packet do get this functionality? If so which one and how can I do this on Unraid?

Any hints and help is highly appreciated, even if it's just a confirmation that this is not supported by Unraid (then at least like I can stop looking for a solution) for some reason. Thank you!

This is my configuration:

# Crete separate routing tables per interface

echo "1 vlan13" >> /etc/iproute2/rt_tables

echo "2 vlan1" >> /etc/iproute2/rt_tables

# Add route to tables

ip route add 10.0.13.0/24 dev br0.13 table vlan13

ip route add default via 10.0.13.1 table vlan13

ip route add 192.168.2.0/24 dev br0 table vlan1

ip route add default via 192.168.2.1 table vlan1

# Add rules based on the origin to use the correct table

ip rule add from 10.0.13.2/32 table vlan13

ip rule add from 192.168.2.50/32 table vlan1

Modify it for your use case, test it in a shell and when it works for you, just save it in /boot/config/go and reboot.

@pacmac Thank you very much. Your config is basically identical with my configs from the opening post in this thread, yet for me this did not work when I tried.
I tried again today and now this works. The only difference between then and now I see is the Unraid version and now I'm running the stock Unraid Kernel (I was using Thor-Kernel before).

root@blackbox:~# echo "10 MGMT" >> /etc/iproute2/rt_tables
root@blackbox:~# echo "30 APP" >> /etc/iproute2/rt_tables
root@blackbox:~# ip route add default via 192.168.10.10 table MGMT
root@blackbox:~# ip route add default via 192.168.30.10 table APP
root@blackbox:~# ip rule add from 192.168.10.0/23 table MGMT
root@blackbox:~# ip rule add from 192.168.30.0/23 table APP

root@blackbox:~# cat /etc/iproute2/rt_tables
10 MGMT
30 APP

root@blackbox:~# ip route show table MGMT
default via 192.168.10.10 dev shim-br0.10 

root@blackbox:~# ip route show table APP
default via 192.168.30.10 dev shim-br0.30

root@blackbox:~# ip rule list 
0:      from all lookup local
32764:  from 192.168.30.0/23 lookup APP
32765:  from 192.168.10.0/23 lookup MGMT
32766:  from all lookup main
32767:  from all lookup default

root@blackbox:~# ip -br a | grep br0.
br0              UP             192.168.1.100/24 
br0.10           UP             192.168.10.40/23 metric 1 
br0.30           UP             192.168.30.40/23 metric 1

root@blackbox:~# ip route get 8.8.8.8 from 192.168.30.40
8.8.8.8 from 192.168.30.40 via 192.168.30.10 dev shim-br0.30 table APP uid 0 
    cache 

root@blackbox:~# ip route get 8.8.8.8 from 192.168.10.40
8.8.8.8 from 192.168.10.40 via 192.168.10.10 dev shim-br0.10 table MGMT uid 0 
    cache

root@blackbox:~# ping -I 192.168.10.40 8.8.8.8 -c 3
PING 8.8.8.8 (8.8.8.8) from 192.168.10.40 : 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=7.12 ms

root@blackbox:~# ping -I 192.168.30.40 8.8.8.8 -c 3
PING 8.8.8.8 (8.8.8.8) from 192.168.30.40 : 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=12.0 ms

root@blackbox:~# traceroute -s 192.168.10.40 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  192.168.10.11 (192.168.10.11)  0.985 ms  0.969 ms  0.964 ms

root@blackbox:~# traceroute -s 192.168.30.40 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  192.168.30.11 (192.168.30.11)  1.973 ms  1.928 ms  1.921 ms

Thank you so much for your post. This motivated me to re-visit and try again!

Edited December 8, 2025Dec 8 by Tom082