Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am setting up a second network interface on a static IP and its not working as it should.

I am able to make outbound connections without any problem like

ping -i 66.249.80.104

but when an external ip pings my server I receive the packet but the reply says unreachable

tcpdump -i eth1        
08:23:50.427576 IP external.com > 44c3e65d.static: ICMP echo request, id 65388, seq 0, length 64
08:53:55.084512 arp who-has 44c3e65d.static tell 44c3e65a.static
08:53:55.084518 arp reply 44c3e65d.static is-at 00:15:17:27:80:e1 (oui Unknown)
08:23:50.428775 44c3e65a.static > 44c3e65d.static: ICMP external.com protocol 1 port 63628 unreachable, length 92

I also see a lot of this in my tcpdump

08:54:47.404489 802.1d config 8000.00:1c:57:f1:10:8a.8002 root 8000.00:1c:57:f1:10:8a pathcost 0 age 0 max 20 hello 2 fdelay 15 

I don't have iptables turned on and if I ping that static ip from another computer on my internal network it works just fine.

I am not a sysadmin so I am not quite sure how to go about troubleshooting this. I would appreciate any help :)

share|improve this question
    
The interfaces are in the same VLAN? –  Mircea Vutcovici Jan 27 '10 at 1:48

2 Answers 2

It was an issue with the gateway

Using 'route' gave me

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
68.0.0.0        *               255.0.0.0       U     0      0        0 eth1
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

so there was no gateway configured for eth1 so I did

route add -net default gw 68.195.x.x dev eth1

and then got

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
68.0.0.0        *               255.0.0.0       U     0      0        0 eth1
default         44c3e659.st     0.0.0.0         UG    0      0        0 eth1
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0

I understand why it wasn't able to respond to the external ping but I am a little confused on how I was able to do successful ping on an external server? My Guess is that it used eth0 even though I explicitly told it to use eth1

share|improve this answer

Does the second interface have a default gateway configured? If not, that's probably the problem.

share|improve this answer
1  
You do not need a default gateway for each interface. Actually you need only a default gateway, unless you want to do load balancing of the upstream traffic via those 2 routes. –  Mircea Vutcovici Jan 27 '10 at 1:42
    
@Mircea: If an external ICMP echo request comes in to the ip address of the second NIC and it does not have a DG configured, how will the ICMP echo reply be sent back? The source address of the ping will be an external address, the second NIC will see this external address as the source, know that it's not on the local network, and fail as it can't send the reply back because it has no gateway to send the reply through. The port unreachable in this case would in essence be the same as a destination unreachable, because the second NIC has no way to send the reply. Am I off-base? –  joeqwerty Jan 27 '10 at 1:54
1  
The routing table is not bound to an interface. That means that the packet will use the first interface and will use the default gateway. It is not the NIC who will do the routing, but the network stack from the OS. What I found interesting is that the source IP for the ICMP port unreachable is not the same as the destination for the ping. –  Mircea Vutcovici Jan 27 '10 at 2:51
    
I have to admit, I haven't worked with dual-homed machines but shouldn't the ping reply exit out of the interface that the ping request came in on? If so, doesn't the NIC need a DG or default route for all non-local traffic? –  joeqwerty Jan 27 '10 at 3:38
    
joeqwerty: In general, packets leave from whatever interface is closest to the destination, as determined by the routing table. There is no guarantee that the network path from A to B is the same as the one from B to A (essentially, there is no guarantee that there is symmetric routing in the network). However, odd things can happen when you have asymmetric routing. –  Vatine Jan 27 '10 at 12:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.