Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My new employer has two subnets, x.y.74.* (with default gateway x.y.74.33) and x.y.75.* (with default gateway x.y.75.1).

The .75.* subnet is reserved for servers, i.e. machines that offer services to the outside Internet. The .74.* subnet is for machines that only need read-access to the Internet.

From x.y.74.62, I need to access x.y.75.3 in order to make automated backups. Unfortunately, if I try to ssh to .75.3, I get a "No route to host" error. Mysteriously, establishing a ssh connection to .75.4 works perfectly.

Both .75.3 and .75.4 have the same routing table and the same ARP table. Neither one is using a firewall.

How can it be that I can reach one server, but not the other?

And more importantly, what else can I try to make .75.3 reachable?

share|improve this question
Maybe you should ask the network/system administrator at your new company. Also, what is read-access to the internet? – joeqwerty Feb 23 '12 at 11:49
@joeqwerty: I found that "read-access" bit to be rather humorous, myself. – Evan Anderson Feb 23 '12 at 11:52
By "read-access", I'm referring to computers that have access to the Internet, but aren't allowed to offer services to the Internet, like e.g. ftp. Sorry for my bad English, I've been learning it from books and seem to lack first-hand experience with native speakers. – Philip Feb 23 '12 at 12:07
The first question you have to answer is this: What is supposed to make this work? Then you can move on to the second question: Why isn't it? – David Schwartz Feb 23 '12 at 12:11
Please tell me X is 10, 192 or 172. :) – Kyle Smith Feb 23 '12 at 12:11
up vote 2 down vote accepted

You don't mention subnet masks anywhere and, while I can likely guess that they're both /24's, I can't go w/o telling you that you need to describe networks with both the network ID and subnet mask (saying "x.y.75.*" isn't the accepted way of saying "x.y.75.0/24").

It sounds like the routing device between these two networks is making decisions about the traffic it allows (as stated by your phrase "read-access to the Internet", which I take to mean "machines that don't host Internet-facing services but have need to access the Internet, likely through a NAT / firewall device"). I'm guessing that there are access control lists (ACLs) in this routing device that are blocking your traffic. That's the most likely explanation for how you can reach one server but not the other from your host.


More generally I mean the device that is acting as the default gateway for each host in question, as well as any devices between those gateway devices. My guess is that they're one in the same (that is, both hosts are using the same physical device for their default gateway) they don't have to be, and there could be interstitial devices that have an effect on the permitted traffic flow. A host-based firewall rule could be at play, too.

share|improve this answer
Sorry, the netmask for .75.* is, while the netmask for .74.* is By "routing device", do you mean one of the default gateways? – Philip Feb 23 '12 at 12:03
He means BOTH the default gateways, as these point AT EACH OTHER. – adaptr Feb 23 '12 at 13:09

What routes between these two networks ?

That is where any routing problems lie; you cannot route directly from host A to host B when they do not share a subnet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.