Apex

Overview

Apex is a lab workstation in E4-07-11. Access via apex.nus.edu.sg (10.246.87.232).

It has two network interfaces:

• WiFi (wlo1) — default route, internet, Tailscale
• Ethernet (enp6s0) — NUS campus network, inbound SSH/ping

Because traffic arrives on Ethernet but the default route goes via WiFi, dual policy routing is needed to avoid asymmetric routing failures.

Network Configuration

Setting	Value
Hostname	apex.nus.edu.sg
Ethernet IP	10.246.87.232 (enp6s0)
WiFi IP	172.24.x.x (wlo1, dynamic)
Campus gateway	10.246.80.1
Routing table	100 campus

Traffic Routing

Traffic	Interface	Route
Internet / Tailscale	wlo1	table main (default)
Campus inbound (SSH, ping)	enp6s0	table campus
Replies to campus traffic	enp6s0	table campus (via source rule)

Setup Summary

Step	What	Command / Config
1	Disable default route on Ethernet	nmcli connection modify enp6s0 ipv4.never-default yes
2	Add routing table	Add 100 campus to /etc/iproute2/rt_tables
3a	Source-based rule	ip rule add from 10.246.87.232 lookup campus
3b	Interface-based rule	ip rule add iif enp6s0 lookup campus
4	Campus default route	ip route add default via 10.246.80.1 dev enp6s0 table campus

Both rules (3a + 3b) are required — iif alone misses locally generated replies, from alone misses forwarded traffic.

Persistence

Create /etc/NetworkManager/dispatcher.d/10-enp6s0-policy-routing:

#!/bin/bash
IFACE="$1"
 
if [ "$IFACE" = "enp6s0" ]; then
  ip route replace default via 10.246.80.1 dev enp6s0 table campus
  ip rule show | grep -q "from 10.246.87.232 lookup campus" || \
    ip rule add from 10.246.87.232 lookup campus
  ip rule show | grep -q "iif enp6s0 lookup campus" || \
    ip rule add iif enp6s0 lookup campus
fi

chmod +x /etc/NetworkManager/dispatcher.d/10-enp6s0-policy-routing

Verification

ip rule
# Expected:
# from 10.246.87.232 lookup campus
# from all iif enp6s0 lookup campus
 
ip route show table campus
# Expected: default via 10.246.80.1 dev enp6s0

See Also

• NUS Network Configuration