Hi all,

I’ve set up a Manjaro Linux system to route traffic to a private IP via a wired interface while keeping internet access through a wireless interface, with persistent iptables firewall rules. I’m sharing the setup here for anyone looking to achieve a similar configuration or troubleshoot theirs. Feedback welcome!

📅 Overview

• Goal: Route traffic to <PRIVATE_IP>/32 via <GATEWAY_IP> on <WIRED_INTERFACE>, with internet traffic (e.g., to 8.8.8.8) via <WIRELESS_INTERFACE>. Firewall allows ICMP to specific IPs.
• Tools: systemd-networkd for routing, iptables for firewall.
• OS: Manjaro Linux (as of April 18, 2025).

🚧 Network Routing

1. Persistent Route

Create /etc/systemd/network/20-ethernet.route:

[Route] Destination=<PRIVATE_IP>/32 Gateway=<GATEWAY_IP> GatewayOnLink=yes 

Run the following commands:

sudo mkdir -p /etc/systemd/network sudo nano /etc/systemd/network/20-ethernet.route sudo chmod 644 /etc/systemd/network/20-ethernet.route sudo systemctl restart systemd-networkd 

• Verify: ip route get <PRIVATE_IP> (should show via <GATEWAY_IP> dev <WIRED_INTERFACE>)
• Enable systemd-networkd:

​

sudo systemctl enable systemd-networkd 

🔒 Firewall Rules

ICMP Rules

Allow ICMP to/from <PRIVATE_IP> on <WIRED_INTERFACE> and 8.8.8.8 on <WIRELESS_INTERFACE>:

sudo iptables -F sudo iptables -A INPUT -i <WIRED_INTERFACE> -p icmp -s <PRIVATE_IP> -j ACCEPT sudo iptables -A OUTPUT -o <WIRED_INTERFACE> -p icmp -d <PRIVATE_IP> -j ACCEPT sudo iptables -A INPUT -i <WIRELESS_INTERFACE> -p icmp -s 8.8.8.8 -j ACCEPT sudo iptables -A OUTPUT -o <WIRELESS_INTERFACE> -p icmp -d 8.8.8.8 -j ACCEPT sudo bash -c "iptables-save > /etc/iptables/iptables.rules" 

Persistent Rules

Script: /usr/local/bin/iptables-restore.sh

#!/bin/bash /sbin/iptables-restore < /etc/iptables/iptables.rules 

Make executable:

sudo chmod +x /usr/local/bin/iptables-restore.sh 

systemd Service: /etc/systemd/system/iptables-restore.service

[Unit] Description=Restore iptables rules After=network.target [Service] Type=oneshot ExecStart=/usr/local/bin/iptables-restore.sh RemainAfterExit=yes [Install] WantedBy=multi-user.target 

Enable service:

sudo systemctl enable iptables-restore.service 

✅ Verification

• Route: ip route get <PRIVATE_IP>
• Firewall: sudo iptables -L -v -n
• Test:

​

ping <PRIVATE_IP> ping 8.8.8.8 

• Reboot and retest to confirm persistence.

🔹 Notes

• Replace <PRIVATE_IP>, <GATEWAY_IP>, <WIRED_INTERFACE>, <WIRELESS_INTERFACE> with your real values (e.g., enp0s31f6 for wired, wlp1s0 for wireless).
• If using Docker, check for conflicting rules:

​

sudo iptables -L -v -n | grep DOCKER