Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dual linux firewall/router setup that is connected to 2 different upstream providers. Internally the default route is a failover using vrrp.

The setup looks something like this. The routes are provided to the routers via BGP.

Provider A (x.x.x.57) - Router 1 [WAN](x.x.x.58) [LAN](a.a.a.130/128)
                                                   +----- VRRP (a.a.a.129/128) [default gw]
Provider B (y.y.y.61) - Router 2 [WAN](y.y.y.62) [LAN](a.a.a.131/128)

It all works correctly in general.

However, what I've noticed is that when Router 1 is the master for the VRRP, a.a.a.131 is not able to be pinged from a client that routes through Provider A. Likewise, if Router 2 is the master we cannot ping a.a.a.130. I also cannot ssh to that address. I can however ssh or ping the WAN side of both routers at any time. Since I can reach the WAN interface of Router 2 when Router 1 is the master, and forwarding is turned on, how come I can't directly reach the LAN side of the same router when it's not the master ?

What would be the cause of that?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

To answer my own question. I found the following link about reverse path filtering to be very helpful. In following it's suggestions I managed to fix the problem I was having.

Disabling reverse path filtering in complex networks

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.