Routing between internal interfaces on the same subnet

kristrev · 03-17-2009, 10:44 AM

Hello,

I am currently working on configuring a machine that has two network interfaces, and both are connected to the same subnet. I have configured the routing table so that they are able to ping/connect to both other machines on the same network and external machines. However, they are not able to connect/ping each other. For example, if I ping 192.168.101.14 from 192.168.100.250 (the two IPs) I just get "Host unreachable". Does anyone have any tips regarding how to solve this? I have attach the routing tables, please let me know if you need any more information.

Edited: I can see the ping packets in tcpdump/wireshark. The src.- and dst.-IP of the header is always equal but the destination inside the ICMP-packet is correct (for example 101.14 if pinging from 100.250). It seems that somehow Linux struggles to seperate the two interfaces.

Thanks in advance,
Kristian

Main routing table:

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.100.0   *               255.255.254.0   U     0      0        0 eth0
192.168.100.0   *               255.255.254.0   U     10     0        0 eth1
default         kasus.local     0.0.0.0         UG    0      0        0 eth0
default         kasus.local     0.0.0.0         UG    10     0        0 eth1

Code:

192.168.100.0/23 dev eth0  scope link  src 192.168.101.14 
192.168.100.0/23 dev eth1  scope link  src 192.168.100.250  metric 10 
default via 192.168.100.1 dev eth0 
default via 192.168.100.1 dev eth1  metric 10

Routing table for iface1 (used ip rule to make sure all traffic related to this interface passes through here)

Code:

192.168.100.0/23 dev eth0  scope link  src 192.168.101.14 
default via 192.168.100.1 dev eth0

Routing table for iface2 (done the same as with iface1)

Code:

192.168.100.0/23 dev eth1  scope link  src 192.168.100.250 
default via 192.168.100.1 dev eth1

baldy3105 · 03-17-2009, 04:57 PM

The process of routing is defined as forwarding an IP packet from one IP network to another IP network. You cannot, by definition, route between two interfaces on the same IP subnet. You could bridge the two interfaces, but not route them.
You can split your subnet into two - 192.168.100.0/25 on one interface and 192.168.100.128/25 on the other. Or 192.168.100.0/24 and 192.168.101.0/24, but you can't route in the scenario you describe.

kristrev · 03-17-2009, 05:08 PM

Thank you very much, I will try splitting the subnet tomorrow.

The reason I want to this, is that I want to use iptables to forward some packets that arrive on iface1 to iface2. However, currently this does not work as the two interfaces apparently are not able to communicate with each other. One thing I remembered after I left work (of course) was the "via" parameter to route, so I will try to play around with that tomorrow as well.

kristrev · 03-18-2009, 04:41 AM

After reading through my post again, I see that routing may have been the wrong choice of words. What I want to do is to forward some packets from iface1 to iface2. I have added the correct stuff to PREROUTING (modifying the destination-adress), but the packets seem to get lost in the routing table. So my correct question is, does anybody know how to enable forwarding internally in a machine between two interfaces on the same subnet?

kristrev · 03-18-2009, 10:43 AM

Turned out that rp_filter was the cause of the problem, when disabling that everything works perfectly. However, I guess that is to wise from a security perspective, so if anyone have any suggestions I am eager to hear them.