Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I a ubuntu installation which has two nic,

NIC 1 -> Public facing with public ip, 74...* NIC 2 -> Internal facing with internal ip 192.168.3.1

What i am trying to get out of it is

NIC 1 will be listening on port 80 and 443 and respond back But this machine can't do any out going communication through NIC 1, it is not allowed through firewall and no gateway defined for NIC 1

All out going communication go through NIC 2's gateway.

So below is what i have configured

NIC 1 Ip 74.XXXXX Mask 255.255.255.XXX

NIC 2 IP 192.168.3.2 MASK 255.255.255.0 Gateway 192.168.3.1

Now i either do not understand correctly how to do what i want to do, or it is implemented incorrectly in linux.

Do you see anything wrong with this setup?

Also in box i do not have configured anything else other than /etc/network/interfaces file.

Also forgot to mention what is the problem i see, problem is everything seem to work but public ip is accessible only from outside router only, mean i have 74.1.1.1 ip for this box then all devices connected to that router in that subnet can access that public ip, out side of that router it's not responding.

I do not have list of ip handly so mentioned ips are from my random thought but subnet and first part is correct.

ip route

74.XXX.XXX.216/29 dev eth1  proto kernel  scope link  src 74.XXX.XXX.221
10.2.0.0/16 dev eth0  proto kernel  scope link  src 10.2.182.121
default via 10.2.182.12 dev eth0  metric 100

/etc/network/interfaces

auto eth0
iface eth0 inet static
address 10.2.182.121
netmask 255.255.0.0
gateway 10.2.182.12

auto eth1
iface eth1 inet static
address 74.XXX.XXX.221
netmask 255.255.255.248
gateway 74.XXX.XXX.217
share|improve this question

4 Answers 4

up vote 0 down vote accepted

Here is the answer

Assume you have a Linux system with more than one network interface card (NIC) — say eth0 and eth1. By default, administrators can define a single, default route (on eth0). However, if you receive traffic (i.e., ICMP pings) on eth1, the return traffic will go out eth0 by default.

share|improve this answer

Try to add default route with high metric on NIC1, it allows answering on requests, but OS will still route outgoing connections on default route with lower metric.

Also you can disable route path filtering with net.ipv4.conf.ethX.rp_filter=0 in /etc/sysctl.conf - this also can do the trick.

If you want to prevent outgoing connections on NIC_1 - use firewall.

share|improve this answer

You don't apply a gateway to an interface as such - you apply a gateway to a routing instance - generally, unless you've defined multiple routing tables, just one.

Assuming there is actually a gateway on each network, and you are just trying to define a specific behaviour (regular host traffic going out the private network, but public facing traffic sending it's return traffic to the gateway it came in on) - you need some kind of policy routing based on source address.

What's probably happening right now is traffic is coming in on the correct interface, and then, if it's a non-local address, it's going out the default route to another gateway, which is probably a firewall that's dropping the packets because it's not seeing the other half of the session. The reason it works from other devices on the same public network you are using is because they don't have to go out the default route - they have a more specific interface route to use, which gets the return traffic to where it needs to be correctly.

In linux, you should be able to handle this by creating a second routing table that specifies the gateway on the public network side, whatever it is, and then a policy routing entry that says that anything with a source address of should use that routing table rather than the system default one.

You do not want the two default gateways you have specified now - that's going to create strange behaviour - drop the public one from the configuration. It should go in it's own routing table via the iproute2 mechanism.

Google for "iproute2 policy routing" and look for "simple source routing" or somethign similar - it should get you where you want to go.

share|improve this answer

I'm not 100% sure I understand your problem, but I'll take a guess. Maybe some ascii art to describe your network would be helpful.

If I understand correctly you the NIC 1 IP to listen on 80 and 443 and respond only to incoming reuest on 80/443. You do not want NIC to be able to initiate/start any outgoing connections. All outgoing connections should be initated/started from NIC2.

I think your problem is that you have no gateway for NIC 1. If you have no gateway set for NIC1 then it will only be able to respond to hosts on the same IP network (i.e. 74.xxxxxx) and on the same physical network segment. It will not be able to pass traffic any further than that local segment.

What you need to do is have NIC2 be the default route via 192.168.3.1 . That should cause all outgoing connections, except those for 74.xxxxxxx to go via NIC2 and use 192.168.3.1 as the gateway.

You also need to add a route for the 74.xxxxxx network, that uses NIC2 as its interface and 192.168.3.1 as its gateway. That way anypackets that are destined for the 74.xxxxxx network will also go via NIC2 and the 192.168.3.1 gateway. You need to remove the route for 74.xxxxxx that uses NIC 1 or you need to have it have a less favourable metric than the route via NIC1 and 192.168.3.1 . Of course you have to make sure that the router 192.168.3.1 can get to the rest of the internet.

share|improve this answer
    
Hi Jason, that's exactly what i am trying to do, i lost you in part where how to do it. as i am a developer trying to do network administration. I posted ip route/ifconfig, i think it is now how you mentioned but it is acting strange. Could you please share quick though on commands to do what you mentioned? –  mamu Aug 28 '10 at 21:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.