Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is very strange.

Output of ip route show:

default via 192.168.1.1 dev eth0 metric 100
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.10
192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.11
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.58
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1

From the firewall logs: (slightly shortened)

Mar 8 09:17:12 vmhost kernel: [ 562.808036] ''IN-dmz-lan-face':'IN=eth1 OUT= MAC=... SRC=192.168.1.108 DST=192.168.1.58 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=28218 DF PROTO=TCP SPT=47365 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0

Notice the wacky discrepancy?

The firewall log lists eth1 at the address 192.168.1.58, but the routing table puts it at 192.168.1.10.

Somehow, eth1 and eth0 are getting swapped, or their ip addresses are.

There are no extra routing tables in play.

How can this happen? How can I fix it?


Edit (more info)

Output of ip addr | grep "inet ":

inet 127.0.0.1/8 scope host lo
inet 192.168.1.58/24 brd 192.168.1.255 scope global eth0
inet 192.168.1.10/24 brd 192.168.1.255 scope global eth1
inet 192.168.1.11/24 brd 192.168.1.255 scope global eth2
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
share|improve this question
    
Which linux version, which iptables version, which iproute2 version. –  Soham Chakraborty Mar 8 '13 at 18:22
    
1) Ubuntu 12.04, kernel 3.2.0; 2) iptables 1.4.12; 3) iproute2 ss111117 –  David Mar 8 '13 at 18:25
    
Could you add the result of : ip addr | grep "inet " –  Dom Mar 8 '13 at 18:30
    
Info added! Thanks! –  David Mar 8 '13 at 18:35

1 Answer 1

up vote 2 down vote accepted

There is no discrepancy.

IN=eth1 OUT= SRC=192.168.1.108 DST=192.168.1.58 PROTO=TCP SPT=47365 DPT=22

The firewall log lists eth1 at the address 192.168.1.58, but the routing table puts it at 192.168.1.10.

No, the firewall tell you it has received a packet from eth1 with destination 192.168.1.58. This is not surprising: anyone on your network can send any bogus packet on the interface on which your server is connected. If this is a problem, blame the sender.

Note that, however, that the Linux kernel use a weak host model by default. That mean it will accept a packet as his own if the destination address match one on any of its interface. So the kernel will accept the packet as legitimate.

This weak host model is also reflected on ARP behaviour: the kernel will answer an ARP for the 192.168.1.58 address on any of its interface by default. If all interfaces are connected to the same network segment, then someone requesting 192.168.1.58 may end up on any of your 3 interfaces. If this is not wanted, set the arp_ignore sysctl to 1.

Also, your routing tables are unusual, if not wrong. If you ask the kernel to connect to 192.168.1.108, what interface should it use ? The actual answer is given by the ip route get 192.168.1.108 command. It may not be the one you expect.

share|improve this answer
    
Aha! After asking the question, I realized that it had to be something to do with ARP and MAC address binding, but I knew nothing about host-model versus interface-model networking! Indeed, what I was trying to do may not be possible using linux ipv4. Thank you! –  David Mar 8 '13 at 22:28
    
@David: With some configuration, you can "emulate" a interface-model networking on Linux with policy routing. But you have to be more specific. –  BatchyX Mar 9 '13 at 10:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.