Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dual linux firewall/router setup that is connected to 2 different upstream providers. Internally the default route is a failover using vrrp.

The setup looks something like this. The routes are provided to the routers via BGP.

Provider A (x.x.x.57) - Router 1 [WAN](x.x.x.58) [LAN](a.a.a.130/128)
                                                   +----- VRRP (a.a.a.129/128) [default gw]
Provider B (y.y.y.61) - Router 2 [WAN](y.y.y.62) [LAN](a.a.a.131/128)

It all works correctly in general.

However, what I've noticed is that when Router 1 is the master for the VRRP, a.a.a.131 is not able to be pinged from a client that routes through Provider A. Likewise, if Router 2 is the master we cannot ping a.a.a.130. I also cannot ssh to that address. I can however ssh or ping the WAN side of both routers at any time. Since I can reach the WAN interface of Router 2 when Router 1 is the master, and forwarding is turned on, how come I can't directly reach the LAN side of the same router when it's not the master ?

What would be the cause of that?

share|improve this question
up vote 0 down vote accepted

To answer my own question. I found the following link about reverse path filtering to be very helpful. In following it's suggestions I managed to fix the problem I was having.

Disabling reverse path filtering in complex networks

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.