Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a red hat 6.3 machine with 2 physical nics installed. I also have a virtual adapter on eth0 as well.

eth1 is 10.3.80.215 - this is the network that has infrastructure servers for vmware (vcenter,etc)

eth0 is 10.231.1.2 which is the http connection for the my vcloud director server.

eth0:0 is 10.231.1.3 which is the console proxy connection.

I can ping any of the ips from anywhere except I can not ping the 10.231 addresses from any machines on the 10.3.80 subnet .

Any ideas of how to get this to work?

here is the ifconfig and the route table.

ifconfig

eth0      Link encap:Ethernet  HWaddr 00:0C:29:E3:CD:29  
          inet addr:10.231.1.2  Bcast:10.231.1.255  Mask:255.255.255.0
          inet6 addr: fe80::xxx:xxxx:fee3:cd29/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:710145 errors:0 dropped:0 overruns:0 frame:0
          TX packets:636043 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:146272731 (139.4 MiB)  TX bytes:340604630 (324.8 MiB)

eth0:0    Link encap:Ethernet  HWaddr 00:0C:29:E3:CD:29  
          inet addr:10.231.1.3  Bcast:10.231.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth1      Link encap:Ethernet  HWaddr 00:0C:29:E3:CD:33  
          inet addr:10.3.80.215  Bcast:10.3.80.255  Mask:255.255.255.0
          inet6 addr: fe80::xx:xxxx:fee3:cd33/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:26643771 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6416677 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4879371482 (4.5 GiB)  TX bytes:1349011239 (1.2 GiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:121636 errors:0 dropped:0 overruns:0 frame:0
          TX packets:121636 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:12040727 (11.4 MiB)  TX bytes:12040727 (11.4 MiB)

route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.231.1.0      *               255.255.255.0   U     0      0        0 eth0
10.3.80.0       *               255.255.255.0   U     0      0        0 eth1
link-local      *               255.255.0.0     U     1002   0        0 eth0
link-local      *               255.255.0.0     U     1003   0        0 eth1
default         10.231.1.1      0.0.0.0         UG    0      0        0 eth0
share|improve this question
    
Are you trying to use this machine to route the traffic between the different subnets? If so, we will need to see the output of iptables -nvL --line-numbers and iptables -nvL --line-numbers -t nat. –  Scrivener Jan 22 '13 at 16:22
    
I am not trying to route using it really, that is the way that vmware recommended i set it up so all backend traffic goes over the .80 NIC and the front end stuff goes over the 10.231.1.2 NIC. –  Drew Jan 22 '13 at 16:24
1  
from one of the clients in the 10.3.80 network run tracepath 10.231.1.3 and show us the output –  BluesRhythm Jan 22 '13 at 16:26
    
iptables -nvL --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination –  Drew Jan 22 '13 at 16:26
    
# iptables -nvL --line-numbers -t nat Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination –  Drew Jan 22 '13 at 16:28

3 Answers 3

Perhaps you have reverse path filtering enabled. Check /proc/sys/net/ipv4/conf/*/rp_filter and make sure it is 0 (disabled) (or 2, loose) for eth0 and eth1. The default has changed from RHEL5 to RHEL6. See http://blog.yibi.org/2012/01/05/reverse-path-filtering-in-rhel-6

share|improve this answer
    
I changed the value of rp_filter to a 2 and it worked!!!! fantastic answer, thank you so much –  Drew Jan 23 '13 at 14:31

You may have to have forwarding on. cat /proc/sys/net/ipv4/ip_forward, if it is 0, the server isn't forwarding packets between interfaces. You can set it with /etc/sysctl.conf:

net.ipv4.ip_forward = 0

Or you can immediately change the value by running:

echo "1" > /proc/sys/net/ipv4/ip_forward.

See if that does the trick.

share|improve this answer
    
I changed the IP_Forward value from 0 to 1. I restarted the linux server, but still cannot ping from the .80 where in the sysctl.conf file would I add that line? –  Drew Jan 22 '13 at 16:38
    
nevermind, sorry I see it, I will make the change now –  Drew Jan 22 '13 at 16:40
    
I made the change o the sysctl.conf file, and rebooted. IP_forward shows as a 1 now but I can still not ping or connect from the .80 subnet machines –  Drew Jan 22 '13 at 16:47
1  
@Drew you've been playing with Microsoft servers too long - the 'echo' method effects changes immediate, the sysctl.conf implements the changes at the next reboot - you don't need to reboot your server to enable the change. Do the connecting clients have a route to 10.231.* via 10.3.80.215 ? –  symcbean Jan 22 '13 at 16:55
1  
and yes, far too long with microsoft..... –  Drew Jan 22 '13 at 17:16

It might be caused by the the reverse path filtering introduced in redhat 6 & above. You might want to check the following post for resolution:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.