Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let me start with a crude network diagram.

Internal Layer 3 switch (Multiple VLANS, including network) --> Internal network ( --> eth1( 10.04 VM-eth0( --> NATed network ( --> ASA --> ISP.

Here's the problem I'm having on two different servers. I built the servers with only one interface, eth0, which is connected to the inside interface of the ASA. I then added another interface for the internal network. I had a gateway set on eth0 and not on eth1 in /etc/network/interfaces. I could access the server externally, but not internally. If I removed the gateway from eth0 and set one for eth1, of course I could access it from internal, but not external.

I tried to set some policy based routing, so that any traffic from the inside network (multiple vlans - would be routed back out eth1, but it did not work. Obviously I'm missing some piece of this puzzle, and have likely mis-configured these servers. Could someone help me get this to work so that I can access the server from both externally and internally. I'm getting frustrated at having to use a 3G connection to SSH into my servers to configure!!

Here's my /etc/network/interfaces config:

# This file describes the network interfaces available on your system

 auto loopback network interface
  iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static


#       gateway

auto eth1
iface eth1 inet static



auto eth0
iface eth0 inet static



and my kernel routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface     *        U     0      0        0 eth0    *        U     0      0        0 eth1
default         UG    100    0        0 eth1

I had tried enabling IPv4 forwarding in /etc/sysctl.conf, but that didn't work either.

If anything else is needed, just let me know.

Thanks for your help.

EDIT - added kernel routing table after setting static route suggested by faker

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 eth0   UG    0      0        0 eth1   U     0      0        0 eth1         UG    100    0        0 eth0
share|improve this question
This sounds like a problem I've had before. Never really figured it out, though I think in my case it was a hardware limitation. I think I solved it for me by adding a physical nic to the virtual host and using that for the VMs. What is your host platform? ESX? – Doc Jun 24 '11 at 18:58
I've got this machine running on an ESXi 4.1 box managed by vSphere. – fourleggedfish Jun 24 '11 at 19:48
up vote 0 down vote accepted

If I understood everything correctly:

You can obviously only have one default gateway.
You want to have the default gateway on eth0 (which is your external network, right?).

To reach the internal networks you need to setup a static route like:
route add -net 172.16.X.0 netmask gw dev eth1

Test if it works, and make it permanent then (not sure how that's done in Ubuntu).

And btw. you have eth0 twice setup in /etc/network/interfaces.

share|improve this answer
Thanks for the reply faker- I tried the static route to no avail. External works, but still no internal. Oh, and the double eth0 was just me copying it twice from the config - ignore that! – fourleggedfish Jun 24 '11 at 19:46
Actually this did work - I just hadn't added static routes for all other subnets in the internal network. I had originally tried to set a route add statement with -net and a netmask of /16, but traffic did not route internally. Using Alex's suggestion to add each subnet specifically did the trick. Thanks all! – fourleggedfish Jun 27 '11 at 14:42
Bear in mind though that if you add in a static route for the 172 range you risk locking down access to devices within that network to the speed of the routing interface. It'd be best to remove any routing entries for local subnets to be sure it works properly – Alex Berry Jun 27 '11 at 15:44

I think taker is on the right lines with the static routes, however he's specifying a route to the subnet the server is in which is incorrect. I think what you need to do is set your gateway to and then create a static route for each of your subnets (vlans) using the 172 router address as its gateway. If you need a more detailed explanation of what commands to type please list all your subnets and I'll try to create a routing table for you on my computer in the morning, on my phone at the moment so its a little tricky!

share|improve this answer

A bit confusing, but it sounds like you need to reach your VM from the host server and vice-versa.

In the VM, add the static route

route add -net netmask

On the host:

route add -net netmask

I am likely wrong, though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.