Why can't I access the server in the other network different ip class.

igor012 · 11-13-2015, 10:56 AM

Hello,

We have two subnets connected to a core-switch.

Code:

Network 1 : 192.168.1.0/24
Network 2 : 10.1.1.0/24

The ip forwarding between those two networks is done by the core-switch.

The main issue we are encountering is that the dns server is not accessible from any computer in the network 2. But every other server is.

Code:

dns-server (Linux) 
eth0 : 192.168.1.1 (default gateway 192.168.1.254)
eth1: 10.1.1.10 (static route 10.1.1.0/24 via 10.1.1.1 dev eth1)

When pinging from network2 the dns server (by name) it tries to reach the 192.168.1.1 interface but I get no reply.

Here is a part of the tcpdump command ran on the dns.

Code:

tcpdump -vv -i eth0 -e icmp
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
17:44:09.536119 00:04:96:6d:16:f6 (oui Unknown) > 00:14:5e:19:cd:0f (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 63, id 49422, offset 0, flags [DF], proto ICMP (1), length 84)
    pc1.company.com > dns.company.com: ICMP echo request, id 3635, seq 1, length 64
17:44:10.536080 00:04:96:6d:16:f6 (oui Unknown) > 00:14:5e:19:cd:0f (oui Unknown), ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 63, id 49904, offset 0, flags [DF], proto ICMP (1), length 84)
    pc1.company.com > dns.company.com: ICMP echo request, id 3635, seq 2, length 64
17:44:13.281088 40:f2:e9:6c:84:b8 (oui Unknown) > 00:14:5e:19:cd:0f (oui Unknown), ethertype IPv4 (0x0800), length 590: (tos 0xc0, ttl 64, id 1091, offset 0, flags [none], proto ICMP (1), length 576)

The packets arrive on eth0.

How can I forward them to the other interface (eth1) and get the reply?

I have tried many iptables rules, and still I don't manage to make it work?

Any ideas ?

Thank you

smallpond · 11-13-2015, 02:15 PM

What's the output of "route -n"?

smallpond · 11-13-2015, 02:21 PM

When you send a packet from 10.1.1.x, the switch forwards it to 192.168.1.1. The server sees it, processes it and sends the reply to 10.1.1.x. Because you have two network cards, the reply goes out eth1 with the src address 10.1.1.10. Your host at 10.1.1.x is waiting for a reply from 192.168.1.1 so it doesn't match.

By having both the switch and the server on both networks you have created a routing loop. Just disable eth1 on the server.

igor012 · 11-16-2015, 10:11 AM

Hello,
We managed to make it work, setting the net.ipv4.conf.ethX.rp_filter to zero.

Code:

sysctl -a | grep -i "eth.\.rp_fil"
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth1.rp_filter = 0