Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have:

eth0                         eth0 
Router 1|eth1 ----  eth1|Router 2

Both eth0's are connected to the Internet. However currently the default route to reach the Internet on Router 2 is via eth1 (so it goes through router 1). Router 1 can reach the Internet fine, however I am unable to ssh to the ip on eth0 on Router 2 from the Internet.

I tried `sudo bash -c 'echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter' but that has not resolved the issue. When I do a packetdump on router 2 filtering on the source IP of the machine trying to ssh to Router 2 I see the incoming packets but no replies.

share|improve this question
    
I'm very curious what a packet dump on R2-Eth1 shows. Dump on both interfaces, and see what the source port is on incoming connection R2-Eth0, then check the R2-Eth1 dump for anything to that port-number. It may help illuminate problems. Or, you know, show nothing. –  sysadmin1138 Jul 21 '10 at 15:12
    
The dump on eth1 just shows the SYN packets keep coming in. For R2 eth1 I see nothing. –  Kyle Brandt Jul 21 '10 at 15:17
add comment

3 Answers

Some Questions:

Do you have a firewall running on router 2?

Is SSH running on Router 2?

Do you have a NAT or an access rule on Router 1?

Are the routes on both routers correct ?

share|improve this answer
    
Firewall: I have removed all rules for the time being. SSH: Yes, of course :-) I can ssh from Router 1 to Router 2 via the eth1s. Nat on Router 1: Yes, but only to match things that arrive from Router 2 that have an internal IP. Routes: I believe they are correct yes. Since connections initiated from Router 2 go out to the intervia via eth1 work fine. –  Kyle Brandt Jul 21 '10 at 14:27
    
Please add the routing table of both routers: $route -n And the firewall please with: $iptables -l -v -n –  Fake4d Jul 21 '10 at 14:57
add comment

Please show your routing table. This is quite likely a routing problem :)

To get the routing table, type

route -n

share|improve this answer
add comment
up vote 0 down vote accepted

Actually it turns out my rp_filter idea is the correct solution. When I disabled it for everything on both routers the problem is resolved.

This is obviously the BIG HAMMER approach so I need to work through all the logic and figure out which ones I need to selectively disable and the put more fine grained protection around it with iptables.... To Be Continued :-)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.