1

I am setting up a second network interface on a static IP and its not working as it should.

I am able to make outbound connections without any problem like

ping -i 66.249.80.104

but when an external ip pings my server I receive the packet but the reply says unreachable

tcpdump -i eth1        
08:23:50.427576 IP external.com > 44c3e65d.static: ICMP echo request, id 65388, seq 0, length 64
08:53:55.084512 arp who-has 44c3e65d.static tell 44c3e65a.static
08:53:55.084518 arp reply 44c3e65d.static is-at 00:15:17:27:80:e1 (oui Unknown)
08:23:50.428775 44c3e65a.static > 44c3e65d.static: ICMP external.com protocol 1 port 63628 unreachable, length 92

I also see a lot of this in my tcpdump

08:54:47.404489 802.1d config 8000.00:1c:57:f1:10:8a.8002 root 8000.00:1c:57:f1:10:8a pathcost 0 age 0 max 20 hello 2 fdelay 15 

I don't have iptables turned on and if I ping that static ip from another computer on my internal network it works just fine.

I am not a sysadmin so I am not quite sure how to go about troubleshooting this. I would appreciate any help :)

1
  • The interfaces are in the same VLAN? Jan 27, 2010 at 1:48

2 Answers 2

1

It was an issue with the gateway

Using 'route' gave me

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
68.0.0.0        *               255.0.0.0       U     0      0        0 eth1
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

so there was no gateway configured for eth1 so I did

route add -net default gw 68.195.x.x dev eth1

and then got

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
68.0.0.0        *               255.0.0.0       U     0      0        0 eth1
default         44c3e659.st     0.0.0.0         UG    0      0        0 eth1
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

I understand why it wasn't able to respond to the external ping but I am a little confused on how I was able to do successful ping on an external server? My Guess is that it used eth0 even though I explicitly told it to use eth1

0

Does the second interface have a default gateway configured? If not, that's probably the problem.

6
  • 1
    You do not need a default gateway for each interface. Actually you need only a default gateway, unless you want to do load balancing of the upstream traffic via those 2 routes. Jan 27, 2010 at 1:42
  • @Mircea: If an external ICMP echo request comes in to the ip address of the second NIC and it does not have a DG configured, how will the ICMP echo reply be sent back? The source address of the ping will be an external address, the second NIC will see this external address as the source, know that it's not on the local network, and fail as it can't send the reply back because it has no gateway to send the reply through. The port unreachable in this case would in essence be the same as a destination unreachable, because the second NIC has no way to send the reply. Am I off-base?
    – joeqwerty
    Jan 27, 2010 at 1:54
  • 1
    The routing table is not bound to an interface. That means that the packet will use the first interface and will use the default gateway. It is not the NIC who will do the routing, but the network stack from the OS. What I found interesting is that the source IP for the ICMP port unreachable is not the same as the destination for the ping. Jan 27, 2010 at 2:51
  • I have to admit, I haven't worked with dual-homed machines but shouldn't the ping reply exit out of the interface that the ping request came in on? If so, doesn't the NIC need a DG or default route for all non-local traffic?
    – joeqwerty
    Jan 27, 2010 at 3:38
  • joeqwerty: In general, packets leave from whatever interface is closest to the destination, as determined by the routing table. There is no guarantee that the network path from A to B is the same as the one from B to A (essentially, there is no guarantee that there is symmetric routing in the network). However, odd things can happen when you have asymmetric routing.
    – Vatine
    Jan 27, 2010 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .