LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 03-12-2008, 08:00 PM   #1
commx
LQ Newbie
 
Registered: Sep 2003
Distribution: Arch
Posts: 16

Rep: Reputation: 0
Network routing issue


Hi Guys.

I've got a debian server, connected to another LAN via VPN.
On the debian server, a ping to the other end of the VPN works properly.

Debian server (10.0.5.1) pings to VPN end point (10.0.1.1) - works.

Now, im using that server as gateway for the windows computers on the LAN. Pinging 10.0.1.1 from these computer wont work. I cant explain, but i think its a routing issue. What I have to do to get it working?

Thanks!
 
Old 03-12-2008, 11:06 PM   #2
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Rep: Reputation: 35
You probably need a static route in your route table on the Debian server. Please post the route table on this server (which you can get with the command netstat -rn), so that we can be sure of exactly what the situation is, and can recommend a fix.
 
Old 03-13-2008, 06:41 AM   #3
commx
LQ Newbie
 
Registered: Sep 2003
Distribution: Arch
Posts: 16

Original Poster
Rep: Reputation: 0
Code:
Destination     Router          Genmask         Flags   MSS Window  irtt Iface
10.0.3.137      0.0.0.0         255.255.255.255 UH        0 0          0 tun0
217.0.116.206   0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
10.0.3.128      10.0.3.137      255.255.255.224 UG        0 0          0 tun0
10.0.5.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
10.0.3.0        0.0.0.0         255.255.255.0   U         0 0          0 eth0
10.0.0.0        10.0.3.137      255.255.0.0     UG        0 0          0 tun0
0.0.0.0         0.0.0.0         0.0.0.0         U         0 0          0 ppp0
eth0 (10.0.3.212) is used to connect to the ADSL modem.
eth1 (10.0.5.1) is used as LAN gateway.
ppp0 is the ADSL connection.

Last edited by commx; 03-13-2008 at 06:46 AM.
 
Old 03-13-2008, 09:46 AM   #4
datopdog
Member
 
Registered: Feb 2008
Location: JHB South Africa
Distribution: Centos, Kubuntu, Cross LFS, OpenSolaris
Posts: 806

Rep: Reputation: 41
Your network design is flawed, The route to 10.0.0.0/16 does technically swallow the other networks which are /24's The kernel may be unable to make a correct routing decision because of this.
 
Old 03-13-2008, 10:19 AM   #5
commx
LQ Newbie
 
Registered: Sep 2003
Distribution: Arch
Posts: 16

Original Poster
Rep: Reputation: 0
Well, that might be true, I changed it, but it doesent work.

I tried to ping from a LAN computer (10.0.5.21) to the VPN end point server (10.0.1.1) - that doesnt work.
Pinging from server (10.0.5.1) to VPN end point (10.0.1.1) works.
Pinging from VPN end point (10.0.1.1) to LAN computer (10.0.5.21) works too. That means - traffic is not relayed from LAN to the VPN end point.

I need to route any traffic from 10.0.5.0/24 over the VPN tunnel, so the Windows Clients on the LAN can reach the VPN end point.
 
Old 03-13-2008, 10:29 AM   #6
datopdog
Member
 
Registered: Feb 2008
Location: JHB South Africa
Distribution: Centos, Kubuntu, Cross LFS, OpenSolaris
Posts: 806

Rep: Reputation: 41
Just for clarity please state when networks (LAN's) are on either side of the tunnel, because by saying tunnel end point i assume you are talking about the interface that is on the router on there otherside but what is the LAN behind that tunnel ?

Please note also that the routes need to be created on both sides the packets you send to the other LAN need to know how to come back to this LAN.
 
Old 03-14-2008, 12:15 AM   #7
dkm999
Member
 
Registered: Nov 2006
Location: Seattle, WA
Distribution: Fedora
Posts: 407

Rep: Reputation: 35
I have several observations, some of which may help clear up your routing issue.

First, routes are considered in the order they appear in the routing table; only if several offer a way to reach the desired destination is any weighting taken into consideration. As far as I can see, you have no way specified for anyone to reach addresses in the range 10.0.1.x/24, except for the inclusive 10.0.x.x/16 entry that datopdawg has noted as problematic.

If you are sure that you did the ping experiment showing that the Debian box could reach the other end of the tunnel by specifying a destination address rather than a name, then this indicates that the 10.0.x.x/16 route entry is the one that was used.

Yet machines beyond the Debian box on net 10.0.5.x are not able to ping 10.0.1.1 address. You say you are using the Debian box as a gateway for those machines; does that mean that they have a default route to the LAN interface on the Debian box (10.0.5.1?) Windows calls this a default gateway. And just for completeness, does the Debian box have forwarding turned on (/proc/sys/net/ipv4/ip_forward = 1), and are there any iptables rules in the FORWARD chain? Either of these could be blocking the ping packets.

I would agree that you should remove the 10.0/16 route, and I would replace it with an explicit route:
Code:
route add -net 10.0.1.0 255.255.255.0 dev tun0
If this still does not work, I would recommend using tcpdump to find out what the Debian box is actually doing with the packets from your windows box. You can specify that tcpdump will only report on packets with a source or destination address equal to that of the windows box under test; be sure to specify -i any or tcpdump will not listen on all your interfaces.
 
  


Reply

Tags
routing, vpn


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
New Network Device Routing Issue cronicded Linux - Networking 2 04-30-2007 08:19 PM
Routing issue guanyu Linux - Networking 1 09-10-2006 06:55 AM
SuSe 9.0 and multiple network adapters(possible routing issue) exabrial Linux - Networking 3 03-21-2004 05:18 PM
routing issue tanmaya Linux - Networking 1 10-13-2002 10:36 AM
Routing Issue jrmann1999 Linux - Networking 1 01-15-2002 10:58 AM


All times are GMT -5. The time now is 10:03 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration