1

I have a kvm guest with two virtual NIC.

  1. NIC with internal IP III.III.III.III (eth0)
  2. NIC with external IP EEE.EEE.EEE.EEE(eth1)

I'm using macvtap. The host has his own external IP. I can ping both NIC from the host but i can't ping EEE.EEE.EEE.EEE from outside. I did a tcpdump on both NIC. I see ICMP requests on eth1 but replies seem to be sent using the "wrong" internal eth0 interface.

# tcpdump -i eth1 icmp -n

14:57:30.398789 IP XXX.XXX.XXX.XXX > EEE.EEE.EEE.EEE: ICMP echo request, id 1408, seq 6, length 64
14:57:31.398546 IP XXX.XXX.XXX.XXX > EEE.EEE.EEE.EEE: ICMP echo request, id 1408, seq 7, length 64
14:57:32.398547 IP XXX.XXX.XXX.XXX > EEE.EEE.EEE.EEE: ICMP echo request, id 1408, seq 8, length 64
14:57:33.398550 IP XXX.XXX.XXX.XXX > EEE.EEE.EEE.EEE: ICMP echo request, id 1408, seq 9, length 64

# tcpdump -i eth0 icmp -n

14:57:40.398610 IP EEE.EEE.EEE.EEE > XXX.XXX.XXX.XXX: ICMP echo reply, id 1408, seq 16, length 64
14:57:41.398562 IP EEE.EEE.EEE.EEE > XXX.XXX.XXX.XXX: ICMP echo reply, id 1408, seq 17, length 64
14:57:42.398562 IP EEE.EEE.EEE.EEE > XXX.XXX.XXX.XXX: ICMP echo reply, id 1408, seq 18, length 64
14:57:43.398588 IP EEE.EEE.EEE.EEE > XXX.XXX.XXX.XXX: ICMP echo reply, id 1408, seq 19, length 64

I have 2 default routes. One setup by libvirt/kvm for guest internal network with NAT and another one setup by myself for eth1.

# route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         ###.###.###.### 0.0.0.0         UG    0      0        0 eth1
0.0.0.0         192.168.122.1   0.0.0.0         UG    0      0        0 eth0
###.###.###.### 0.0.0.0         255.255.255.255 UH    0      0        0 eth1
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

I can't ping EEE.EEE.EEE.EEE from outside because of the NAT thing, requests are sent to an IP and replies are comming from another one ? Having 2 default routes is probably not a good idea, i should remove the extra NAT. However I don't understand why ICMP answer packets are not sent on the interface getting the requests. Is it a "feature" (a kind of load balancer) ? Is it possible to avoid that ?

0

You must log in to answer this question.

Browse other questions tagged .