up vote 0 down vote favorite
share [g+] share [fb]

I have:

eth0                         eth0 
Router 1|eth1 ----  eth1|Router 2

Both eth0's are connected to the Internet. However currently the default route to reach the Internet on Router 2 is via eth1 (so it goes through router 1). Router 1 can reach the Internet fine, however I am unable to ssh to the ip on eth0 on Router 2 from the Internet.

I tried `sudo bash -c 'echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter' but that has not resolved the issue. When I do a packetdump on router 2 filtering on the source IP of the machine trying to ssh to Router 2 I see the incoming packets but no replies.

link|improve this question
78% accept rate
I'm very curious what a packet dump on R2-Eth1 shows. Dump on both interfaces, and see what the source port is on incoming connection R2-Eth0, then check the R2-Eth1 dump for anything to that port-number. It may help illuminate problems. Or, you know, show nothing. – sysadmin1138♦ Jul 21 '10 at 15:12
The dump on eth1 just shows the SYN packets keep coming in. For R2 eth1 I see nothing. – Kyle Brandt♦ Jul 21 '10 at 15:17
feedback

3 Answers

up vote 0 down vote

Some Questions:

Do you have a firewall running on router 2?

Is SSH running on Router 2?

Do you have a NAT or an access rule on Router 1?

Are the routes on both routers correct ?

link|improve this answer
Firewall: I have removed all rules for the time being. SSH: Yes, of course :-) I can ssh from Router 1 to Router 2 via the eth1s. Nat on Router 1: Yes, but only to match things that arrive from Router 2 that have an internal IP. Routes: I believe they are correct yes. Since connections initiated from Router 2 go out to the intervia via eth1 work fine. – Kyle Brandt♦ Jul 21 '10 at 14:27
Please add the routing table of both routers: $route -n And the firewall please with: $iptables -l -v -n – Fake4d Jul 21 '10 at 14:57
feedback
up vote 0 down vote

Please show your routing table. This is quite likely a routing problem :)

To get the routing table, type

route -n

link|improve this answer
feedback
up vote 0 down vote accepted

Actually it turns out my rp_filter idea is the correct solution. When I disabled it for everything on both routers the problem is resolved.

This is obviously the BIG HAMMER approach so I need to work through all the logic and figure out which ones I need to selectively disable and the put more fine grained protection around it with iptables.... To Be Continued :-)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.