Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I had/have an interesting problem today regarding routing with linux.

My expectation: to be able to assign multiple public ips to an interface and have one default gateway. packets sent to a particular ip will respond with that ip through the particular gateway the packet was received on, while any origination traffic would go through the default gateway. Here is the setup

ifconfig eth0 x.x.x.x/29
ifconfig eth0:1 y.y.y.y/29
route add default gateway y.y.y.g

Packets originating at this machine going out would have ip y.y.y.y and exit through y.y.y.g. If a packet was received on x.x.x.x it would be replied to via x.x.x.g even though x.x.x.g is not the default route.

Actual results: This worked fine for me until today. Today based my experience with above setup I added z.z.z.z to the mix thinking I could just assign another ip and the same results would apply. Totally not what happened and I do not understand why. As soon as I added z.z.z.z with

ifconfig eth0:2 z.z.z.z

i was able to manually ping the new network gateway at z.z.z.g, but external packets were not responded to. The other two routes worked fine as described before. In my experimentation I set z.z.z.g as my default route. This caused all originating traffic to originate from z.z.z.z as expected and external traffic sent to z.z.z.z worked fine. However x.x.x.x and y.y.y.y completely stopped responding to external traffic, but I could manually originate traffic from either and it would route fine through their respective gateways. In no way shape or form could I get z.z.z.z to play nice with any other ip or route combinations, although the original two worked just fine together without z.z.z.z.

What could cause this behavior ? (FYI iptables was not the issue I made sure of that. All ips are public and no NAT involved)

share|improve this question
1  
Don't have expectations till you've learned how IP networking works. –  poige Oct 11 '11 at 2:10
    
route print and compare output for 2 and 3 aliases. Can't say more without data –  Lazy Badger Oct 11 '11 at 3:59
1  
You are expecting a router to send packets back to their source. That's not how routing works, nor would that make sense. Your computer will send packets on the best route to their destination. If that's not appropriate for your situation (as it isn't here), you have to specifically configure something unusual (with iptables). You need source-based routing. –  David Schwartz Oct 11 '11 at 6:33

1 Answer 1

up vote 0 down vote accepted

Basically, you can't have the routing as you describe without using iptables.

Even if you use iptables, you can't tell from which interface alias a packet is coming from (unless the packet source address is from the same network address).

You also can't control what source address a packet will have coming out from an interface without using NAT.

Last, but not least, if you want to route internet traffic (not local network) you need VLAN to create real interface alias.

share|improve this answer
    
Your points are mostly valid, but outgoing ip addresses for sockets that do not explicitly bind to a specific address can be set via the ip route command like this: ip route 192.168.0.0/16 via 192.168.1.1 src 192.168.1.12. –  the-wabbit Oct 11 '11 at 8:13
    
I suppose you can do that for local network traffic but since the op wanted to assign public IP, I assume the traffic he wants to route will have 0.0.0.0 prefix and you can't have more than 1 default route. You can use nexthop but src doesn't work with nexthop. –  imel96 Oct 12 '11 at 2:10
    
Thanks for all the comments and sorry for the long respond time. Iptables was the answer to achieve properly the effect I described with the first two links. It was quite simply luck that it was routing as I described. With the addition of the better connection all packets wanted to go out that way. But this causes the return packets to be seen as invalid. Iptables allowed me to place rules to inspect the inbound destination and ensure the responding source ip matched what was expected. Thanks again I learned a lot –  Ketema Nov 3 '11 at 1:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.