Static Route Problem

chort · 11-13-2006, 04:57 PM

Well then it's definitely not iptables blocking the traffic, but it still doesn't seem like it's being forwarded. I'm pretty puzzled at the moment. It must be something blindingly obvious.

sal_paradise42 · 11-13-2006, 09:16 PM

I don't see any ICMP redirects generated from 192.168.22.48 on your capture. This is kind of old, if its suppose to forward a packet out the same interface the request came from it just drops it and sends back an ICMP redirect to the source host.
Why not instead create a static route from host a to network B
from Network A computer

"route -add net 192.168.33.192 netmask 255.255.255.192 192.168.22.209"

and on Network B computer make sure it has a route back to that network

"route -add net 192.168.22.0 netmask 255.255.255.0 192.168.33.193"

This way you don't have to depend on the icmp redirect which a lot of machines will ignore now a days anyway.

Cypher12 · 11-14-2006, 08:44 AM

Hello,

Thanks for helping out. I guess the main reason why I do not want to place a static route between each computer on Network A to the LinuxBox2, and vice vera for each computer on Network B ... is simply because there are quite a large numper of computers were dealing with here on both subnets.

To be even more honest ... now its just a matter of curiousity (and frustration). Its rather problematic and tedious too ... I know some 3 comm router's which were able to do ICMP redirects ... and I hate to think of Linux as having a limitation (which I'm sure it doesn't) ... I'm sure my Linux boxes can allow these two subnets to communicate .. I just still don't know how.

I will continue to keep the post updated.
Thanks and Take Care

sal_paradise42 · 11-14-2006, 10:07 AM

Yeah I would think that the redirect will be making it back. Its just a sign of poor design, if you are ok with that then its all good.
Try clearing your iptables on all the participating hosts. Host A, Router A, Router B, Host B.
iptables -F

and do another tcpdump on Host A.
"tcpdump -i <eth*> -vvv -n -s 1514 icmp"

eth* will be your outgoing interface.

Oh yeah and I am trying to create a redirect scenario with my Linux router, and it does not seem to be sending a redirect ICMP message back either. Maybe something builtin that does not generate it.

Cypher12 · 11-14-2006, 12:48 PM

Hello,

I just read your post and flushed iptables for client A, LinuxBox1, LinuxBox2, and client B.

** While perfoming a ping from my Network A computer (IP 192.168.22.230)

*************************************
* From client A (ip: 192.168.22.230)*
*************************************

Code:

prompt# ping 192.168.33.193
PING 192.168.33.193 (192.168.33.193) 56(84) bytes of data.

** No output produced here .. but also note it is not syaing "No route to host" eitheir.

*************************************
* Also from client A (ip: 192.168.22.230)*
*************************************

Code:

prompt# /usr/sbin/tcpdump -i eth0 -vvv -n -s 1514 icmp
13:20:16.206919 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 511, length 64
13:20:17.206959 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 512, length 64
13:20:18.207003 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 513, length 64

** This happens repeatedly .. still no sign of an icmp redirect, nor a echo-reply

**********************************
* Linux Box 1 (ip: 192.168.22.48)*
**********************************

Code:

prompt# /usr/sbin/tcpdump -i eth0 -vvv -n -s 1514 icmp
14:03:49.484485 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 563, length 64
14:03:50.484755 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 564, length 64
14:03:51.485050 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 565, length 64
14:03:52.485326 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 566, length 64
14:03:53.485624 IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.22.230 > 192.168.33.193: ICMP echo request, id 6439, seq 567, length 64

**********************************
* Linux Box 2 (ip: 192.168.22.48)*
**********************************

Code:

prompt# /usr/sbin/tcpdump -i eth0 -vvv -n -s 1514 icmp
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1514 bytes
12:20:16.670938 IP (tos 0xc0, ttl  64, id 20556, offset 0, flags [none], length: 106) 192.168.22.209 > 192.168.22.143: icmp 86: 192.168.22.209 udp port 137 unreachable for IP (tos 0x0, ttl 128, id 42681, offset 0, flags [none], length: 78) 192.168.22.143.137 > 192.168.22.209.137: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST

I don't even know how to read this one ... I'm pinging from 192.168.22.230 to 192.168.33.193 ... its should be going thru the gateway 192.168.22.48. For example:

Code:

     ping             gateway               eth0                  eth1
192.168.22.230 ---> 192.168.22.48 ---> 192.168.22.209 ----->192.168.33.193

Why do I have a 192.168.22.209 > 192.168.22.143 ... Regardless I guess I can just equate that to other network activity on this network, afterall other people are using it right now.

Thanks again for your time
Take Care

sal_paradise42 · 11-14-2006, 02:34 PM

hmm, I just tried this with FreeBSD as the router and it works:

[root@linux ~]# ping 5.5.5.4
PING 5.5.5.4 (5.5.5.4) 56(84) bytes of data.
From 192.168.1.115: icmp_seq=0 Redirect Host(New nexthop: 192.168.1.50)
From 192.168.1.115: icmp_seq=0 Redirect Host(New nexthop: 192.168.1.50)

so it looks like a problem with Linux, I found this it pretty much says that with Iptbles (netfilter) in your kernel icmp redirect does not work. that might be the problem, you should use FreeBSD as your router

Cypher12 · 11-15-2006, 02:14 PM

Hello,

I am posting this to complete the post .. that is this problem has been solved:

Steps for Solution

** The key here to getting my network to work was simply by properly configuring some config files since I really need those ICMP redirects.

**************************************************************************************************** ****
# /etc/sysctl.conf for GentooBox 1 & 2 -- the machines basically acting as the routers
**************************************************************************************************** ****

Code:

## Enabled Kernel Parameters ##
# Forwarding
   net.ipv4.conf.all.forwarding = 1
# Source Route Verification
    net.ipv4.conf.default.rp_filter = 1
# Reverse Path
    net.ipv4.conf.all.rp_filter = 1
# ICMP Redirect-Acceptance
    net.ipv4.conf.all.accept_redirects = 1
# ICMP Redirect-Sending
    net.ipv4.conf.all.send_redirects = 1
# Secure Redirects
    net.ipv4.conf.all.secure_redirects = 1

**********************************************************
# /etc/sysctl.conf for Client Machines
**********************************************************

Code:

## Enabled Kernel Parameters ##
# Forwarding
   net.ipv4.conf.all.forwarding = 0
# Source Route Verification
    net.ipv4.conf.default.rp_filter = 1
# Reverse Path
    net.ipv4.conf.all.rp_filter = 1
# ICMP Redirect-Acceptance
    net.ipv4.conf.all.accept_redirects = 1
# ICMP Redirect-Sending
    net.ipv4.conf.all.send_redirects = 0
# Secure Redirects
    net.ipv4.conf.all.secure_redirects = 1

To sum it up .. there is a net.ipv4.conf.all.send_redirects kernel parameter that exisits and needed to be enabled (set to 1).. once that was .. I already had the net.ipv4.conf.all.accept_redirects in my /etc/sysctl.conf. Each parameter is pretty straight forward. To summarize ... my two Gentoo Boxes need to be able to generate the redirects ... while equivalently my clients in both Network A and Network B need to accept them when are sent.

Thanks again
Take Care

sal_paradise42 · 11-15-2006, 04:21 PM

nice job

UhhMaybe · 05-22-2007, 09:13 AM

Thank you for taking the time to post the solution. It needs to be happening more often here in the forums.