Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The situation:

DomU: Debian SID

/etc/network/interfaces

auto eth0
iface eth0 inet static
 address x.x.x.55
 gateway x.x.x.49
 netmask 255.255.255.255
 pointopoint x.x.x.49

Ping DomU -> x.x.x.49 (aka Dom0)

PING x.x.x.49 (x.x.x.49) 56(84) bytes of data.
64 bytes from x.x.x.49: icmp_req=1 ttl=64 time=0.107 ms

Ping DomU -> 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
34 packets transmitted, 0 received, 100% packet loss, time 33263ms

tcpdump -Kn

21:03:30.316328 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4904, seq 3, length 64
21:03:31.324344 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4904, seq 4, length 64
21:03:32.332338 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4904, seq 5, length 64
21:03:33.340323 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4904, seq 6, length 64
21:03:34.348343 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4904, seq 7, length 64

Dom0: Debian Wheezy with Xen 4.1

/etc/network/interfaces

auto eth0
iface eth0 inet static
 address x.x.x.49
 gateway x.x.x.33
 netmask 255.255.255.255
 pointopoint x.x.x.33

sysctl -a

net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.proxy_arp = 1
net.ipv6.conf.eth0.forwarding = 1
net.ipv4.conf.vif1/0.proxy_arp = 1

iptables -L -n (rules automatically added by vif-route)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-out vif1.0 --physdev-is-bridged
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-in vif1.0 --physdev-is-bridged udp spt:bootpc dpt:bootps
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-out vif1.0 --physdev-is-bridged
ACCEPT     all  --  x.x.x.55             0.0.0.0/0            PHYSDEV match --physdev-in vif1.0 --physdev-is-bridged

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

cat /etc/xen/xend-config.sxp | grep -e script

# (network-script network-bridge)
# (network-script 'network-bridge netdev=eth1')
# (network-script 'network-bridge bridge=<name>')
#(vif-script vif-bridge)
(network-script network-route)
(vif-script     vif-route)
#(network-script network-nat)
#(vif-script     vif-nat)
#(resource-label-change-script '')

Ping Dom0 -> DomU

PING x.x.x.55 (x.x.x.55) 56(84) bytes of data.
64 bytes from x.x.x.55: icmp_req=1 ttl=64 time=0.148 ms

tcpdump -Kn | grep 55

21:01:36.545890 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4880, seq 4, length 64
21:01:36.551504 IP 8.8.8.8 > x.x.x.55: ICMP echo reply, id 4880, seq 4, length 64
21:01:37.545838 IP x.x.x.55 > 8.8.8.8: ICMP echo request, id 4880, seq 5, length 64
21:01:37.550473 IP 8.8.8.8 > x.x.x.55: ICMP echo reply, id 4880, seq 5, length 64

Question

What can it be that Dom0 does not forward the incoming TCP packages to my DomU?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Solution

Well, as it turned out, all of the settings above are perfectly correct. The problem was, that my hoster assigned a dedicated MAC adress to the additional IP. Therefore Dom0 discarded the package right away, because it thought, that it isn't a package for itself.

After removing this virtual MAC, the packages got accepted perfectly and routed through the whole system.

Therefore

If you encounter strange package drops on your internet ethernet device (eth0 in my case), make sure everything else if correct, and make shure the MAC address is the same as of your main address, i.e. the one of eth0!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.