ip route config: access an IP in another server's netmask

molafish · 03-19-2009, 02:07 AM

I have two servers. Their IP addresses are:
server 1: xx.xx.197.242
server 2: xx.xx.198.195

With routing tables like this:
server 1:
xx.xx.198.198 dev eth0 scope link src xx.xx.198.198
xx.xx.197.240/29 dev eth0 proto kernel scope link src xx.xx.197.242
127.0.0.0/8 dev lo scope link
default via xx.xx.197.241 dev eth0 metric 1

server 2:
xx.xx.198.192/29 dev eth0 proto kernel scope link src xx.xx.198.195
127.0.0.0/8 dev lo scope link
default via xx.xx.198.193 dev eth0 metric 1

Yes, I am hosting xx.xx.198.198 on server 1.

server 2 cannot ping xx.xx.198.198, obviously because server 2 is advertising xx.xx.198.198 in server 2's netmask. So... I have tried to remove the xx.xx.198.192/29 route completely from server 2. I've also tried setting the bitmask to 255.255.255.255 (/32). Both result in server 2 being unable to ping xx.xx.198.198.

Any ideas?

acid_kewpie · 03-19-2009, 03:48 AM

add a /32 route to that ip on server 2

molafish · 03-19-2009, 04:31 AM

That doesn't seem to help:

xx.xx.198.198 via xx.xx.198.193 dev eth0 src xx.xx.198.195
cache mtu 1500 advmss 1460 hoplimit 64

Still unreachable...

acid_kewpie · 03-19-2009, 05:08 AM

Make sure the metric is lower or equal to the local interface. a locally connected interface will oten be set as metric 0, so match that, or make that interface a lower one, e.g. 5

molafish · 03-19-2009, 05:15 AM

Make the local interface's metric lower?

I think when the metric is not specified it's 0... So that means everything except my default via line is metric 0.

I tried changing the /32 route to a lower metric. That failed.

chitambira · 03-19-2009, 05:33 AM

This will obviously not work becoz of two things
1st

Quote:

xx.xx.198.198 dev eth0 scope link src xx.xx.198.198

Server 1 doesnt know how to respond to the request (thru which interface?) Best to change that route to xx.xx.198.198/32 dev eth0 scope link src xx.xx.198.198
2nd
How are you devices connected? any router between the two devices? I see both their gateways are different, so is there any inteligence in these gateways?
Is 198.198 a subinterface(alias) on server 1 's eth0?

This is what happens, so i want you to finish it off;
When server 2 pings 198.198, the request goes thru 198.193 (then what...?)
assuming server 1 gets the request, it responds via its gatewa i.e 197.241, but does 197.241 know how to get to 198.192/29? How are the routes sorted on these gateways?

molafish · 03-19-2009, 05:58 AM

FYI server 1 works fine to and from the internet.

Quote:

Originally Posted by chitambira

Server 1 doesnt know how to respond to the request (thru which interface?) Best to change that route to xx.xx.198.198/32 dev eth0 scope link src xx.xx.198.198

Forgive me but isn't xx.xx.198.198 the same as xx.xx.198.198/32?

Quote:

Originally Posted by chitambira

2nd
How are you devices connected? any router between the two devices?

They are on the LAN ports of a router. The pertinent segment of its routing table is:

Code:

xx.xx.197.240  /fffffff8 --> 0.0.0.0         ETHERNET/0   1 NW FW DIR PRM RP2 
xx.xx.197.241  /ffffffff --> 0.0.0.0         ETHERNET/0   0 ME 
xx.xx.198.192  /fffffff8 --> 0.0.0.0         ETHERNET/0:1 1 NW FW DIR PRM RP2 
xx.xx.198.193  /ffffffff --> 0.0.0.0         ETHERNET/0:1 0 ME

Quote:

Originally Posted by chitambira

I see both their gateways are different, so is there any inteligence in these gateways?

I don't know how to answer this other than that there are no other meaningful routes in the router pertaining to these netmasks.

Quote:

Originally Posted by chitambira

Is 198.198 a subinterface(alias) on server 1 's eth0?

Yes exactly. Configured via

Code:

ifconfig eth0:1 xx.xx.198.198
route add -host xx.xx.198.198 dev eth0:1

Quote:

Originally Posted by chitambira

This is what happens, so i want you to finish it off;
When server 2 pings 198.198, the request goes thru 198.193 (then what...?)

Right now, of course, nothing. But ideally:

Code:

198.198
198.193
197.241

This is the direct reverse of a currently working traceroute from server 1 to server 2:

Code:

traceroute to xx.xx.198.195 (xx.xx.198.195), 30 hops max, 38 byte packets
 1  xx.xx.197.241  0.374 ms  0.381 ms  0.262 ms
 2  xx.xx.198.195  0.459 ms  0.524 ms  0.373 ms

Quote:

Originally Posted by chitambira

assuming server 1 gets the request, it responds via its gatewa i.e 197.241, but does 197.241 know how to get to 198.192/29? How are the routes sorted on these gateways?

See the router's ip table above for those routes. The router can pass packets off between the gateways, at least at the moment from server 1 to server 2...

molafish · 03-19-2009, 06:03 AM

This is the entire router's ip table:

Code:

IP route   /  Mask   --> Gateway         Interface    Hops Flags
0.0.0.0        /00000000 --> internet        ATM-VC/1     1 NW FW PRM DOD RP1 RP2 
xx.xx.192.232  /fffffff8 --> internet        ATM-VC/1     1 NW FW DIR PRM PRV 
xx.xx.192.236  /ffffffff --> internet        ATM-VC/1     0 ME 
xx.xx.197.240  /fffffff8 --> 0.0.0.0         ETHERNET/0   1 NW FW DIR PRM RP2 
xx.xx.197.241  /ffffffff --> 0.0.0.0         ETHERNET/0   0 ME 
xx.xx.198.192  /fffffff8 --> 0.0.0.0         ETHERNET/0:1 1 NW FW DIR PRM RP2 
xx.xx.198.193  /ffffffff --> 0.0.0.0         ETHERNET/0:1 0 ME 
xx.xx.22.0    /ffffff00 --> recovery        ATM-VC/2     1 NW FW DIR PRM PRV 
xx.xx.22.22   /ffffffff --> recovery        ATM-VC/2     0 ME 
192.168.1.0    /ffffff00 --> 0.0.0.0         ETHERNET/0:2 1 NW FW DIR PRM RP1 RP2 
192.168.1.1    /ffffffff --> 0.0.0.0         ETHERNET/0:2 0 ME

chitambira · 03-19-2009, 10:16 AM

Quote:

xx.xx.198.192 /fffffff8 --> 0.0.0.0 ETHERNET/0:1 1 NW FW DIR PRM RP2

This route means includes 198.198 so the ping request to 198.198 does not cross over to the 197.240/29 network (in which actually 198.198 resides)

You may be need to consider redoing your network (why do you need to assign an ip for another network within your network)
you can assign it a private IP or any other network, but otherwise your network structure here is not best practice.

molafish · 03-19-2009, 11:38 AM

Quote:

Originally Posted by chitambira

You may be need to consider redoing your network (why do you need to assign an ip for another network within your network)
you can assign it a private IP or any other network, but otherwise your network structure here is not best practice.

Granted. This is only temporary while I move over services slowly from server 1 to server 2.

I suppose I should have better luck adding a temporary route in the router for 198.198.