2

I have a network that looks like this:

                   +--------------+
                   | Linux Router |
                   +--------------+
             10.0.1.100/24 | 10.0.0.100/24
                           |
Host A (10.0.1.101/24) ----+--- Host B (10.0.0.3/24)

with 1 caveat: the Linux router only has 1 physical Ethernet port with 2 IP addresses assigned. I need be able to ping 10.0.0.3 from Host A and ping 10.0.1.101 from Host B, but I can't. Why?

[root@Host_A ~]# ping -c1 10.0.0.3
PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.
From 10.0.1.100: icmp_seq=1 Redirect Host(New nexthop: 10.0.0.3)

Then it is Destination Host Unreachable. Here is how my Linux router is configured:

cat /proc/sys/net/ipv4/ip_forward:

1

ip link:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether d0:5f:b8:fc:fc:ef brd ff:ff:ff:ff:ff:ff

ip addr:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether d0:5f:b8:fc:fc:ef brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.100/24 brd 10.0.0.255 scope global eth0
    inet 10.0.1.100/24 brd 10.0.1.255 scope global eth0
    inet6 fe80::d25f:b8ff:fefc:fcef/64 scope link 
       valid_lft forever preferred_lft forever

route -n:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
4
  • What is the output of route -n? It may only be routing for itself by default. It also might be helpful to know which distribution of Linux you are using. Apr 21, 2015 at 19:37
  • I edited and answered
    – Clay
    Apr 21, 2015 at 19:40
  • From 10.0.1.101 can you ping and get a reply from 10.0.0.100?
    – hookenz
    Apr 21, 2015 at 20:22
  • Matt, yes I can
    – Clay
    Apr 22, 2015 at 10:51

1 Answer 1

4

You need to disable the router to send the redirects:

sudo sysctl -w ipv4.conf.eth0.send_redirects = 0

You will need to edit /etc/sysctl.conf and add the following line to apply the config at boot time.

ipv4.conf.eth0.send_redirects = 0

However your config is neither optimal, nor secure. You should either use a router and split the network in 2 VLANs. You will need a VLAN aware switch.

The other solution would be to use a larger prefix (eg. replace 10.0.0.100/24 and 10.0.1.0/24 with 10.0.0.0/23)

3
  • I understand that merging the networks will allow me to remove the router, that this is not an optimal setup (I should have 2 router NICs but I don't), though I am confused about how this is less secure. I need to force all traffic through a single computer. The next step in what I'm doing is to use tc to simulate the 2 networks being separated by a high loss network.
    – Clay
    Apr 22, 2015 at 10:57
  • It is less secure because people are spiting the network for security reasons and put a router with firewall capabilities between VLANs. If security is not concern, you will gain some speed by have only one single VLAN. Apr 22, 2015 at 18:57
  • However if you have a lot of broadcast traffic, using VLANs and a router between them could improve performance. The broadcast traffic will not be routed. Apr 22, 2015 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .