0

I have 2 subnets, A and B and a router connected to both A and B and the WAN.

I have 4 servers dual homed on subnets A and B, 2 of them are Mac OS and 2 of them are Centos 7 (1503). They are all configured to reply on the same interface that requests were received and the gateway on the B subnet is their default gateway. This diagram shows the network.

The 2 Mac OS servers and one of the CentOS servers, Bob, work fine in that each can ping and ssh into the others via their subnet A or B addresses.

Additionally, clients on subnet A can also access the Mac OS servers and the CentOS server, Bob via their subnet A or B addresses; and the three servers can access any of the clients on subnet A.

The second CentOS server, Alice, is the problem.

None of the other dual-homed servers or clients on subnet A can ping or ssh into Alice using Alice's subnet A address. Pings and ssh simply hang and I see no evidence of traffic at Alice via tcpdump. The arp tables on the other servers and clients all show that Alice's IP addresses on subnets A and B are mapped to the appropriate MAC addresses.

None of the other dual-homed servers can ping or ssh into Alice using Alice's subnet B address.

However, clients on subnet A are able to ping and ssh into Alice by using Alice's address on subnet B.

Further, Alice can ping and ssh into all servers and clients via subnet A; and can ping the other three servers on subnet B, but when Alice attempts to ssh into any of the servers via their subnet B addresses, Alice receives "Connection refused"?!

The servers Bob and Alice are intended to be configured the same except of course for addresses.

I've compared the various /etc/sysconfig/network-scripts/{ifcfg-, route-, rule-}{eno1, eno2} on Bob and Alice and they appear to be identical except for the addresses assigned to each interface.

I've compared "ip addr", "ip route", "ip rule" between Bob and Alice and all look identical save for address assignments.

I have disabled SELinux and disabled the firewall on Alice to remove these from consideration.

I'm befuddled regarding where the misconfiguration on Alice is.

It seems to me from the evidence that there is not A hardware problem with either of Alice's interfaces since I can reach each interface from the router via the subnet A and B addresses for Alice and clients on subnet A can reach Alice via the subnet B address.

It doesn't seem to be A problem in the router since all other combinations of communication are working.

Further, the connection refused doesn't seem to be A configuration issue with the other three servers via subnet B since they are all able to connect to each other on subnet B. From looking at tcpdump when Alice tries to connect to the other three servers on subnet B, I don't see any packets arriving at the B interfaces on the other three servers.

I would really appreciate any ideas about where to probe to try and resolve this issue.

Thank you, Chris

4
  • i would look at arp tables (mac addresses) and work your way up the networking stack.... take a look at the switchport alice's interface B is plugged into, and ensure its the right vlan config. tcpdump is you friend, and it sounds like you on the right track using it
    – nandoP
    May 8, 2015 at 15:59
  • The arp tables look correct on Alice and all other systems. There are no vlans involved. Since I can ping Alice on both subnets from the router and ssh into Alice on both subnets from the WAN through the router and since single-homed clients on subnet A can ping and ssh Alice's subnet B address it would appear the switches and Alice's NICs are functioning properly. Also Alice can ping and SSH all systems on subnet A. Only the systems on subnet B give connection refused when Alice attempts to SSH. Ping works fine in that situation.
    – C0d3F3rr3t
    May 8, 2015 at 16:08
  • so alice can ping hosts on subnet B, but ssh gets rejected on subnetB hosts? firewalling tcp/22 or sshd not running on subnetB hosts? post your routing table on alice as well..... it may be traffic to subnet B is going out interface A? use tcpdump to check this. run tcpdump on the router and on alice and the subnetB hosts while pinging to understand further
    – nandoP
    May 8, 2015 at 18:12
  • The first thing to do is to consider one of the problematic scenarios and figure out what sequence of packets the various hosts would have to be sending when it is working correctly. Then you need to look at the actual traffic using tcpdump or similar and identify the first point at which it differs.
    – kasperd
    May 8, 2015 at 20:38

1 Answer 1

0

After some wireshark captures with quite a few ICMP redirects from the router to the "hidden" server, I traced the problem to an overly zealous use of policy routing rules. Once the rules were simplified the problem was resolved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .