I just have a problem on the multiple NIC & IP addresses server. I've configured my Cent OS 7 server with an additional public IP address which belongs to eth1. When iptables source NAT enabled, only the additional IP address couldn't be used.
In this post, two public IP addresses are indicated by 99.0.1.100 (eth0) and 99.0.2.100 (eth1). Subnet-mask of 99.0.2.100 is 255.255.254.0, default gateway is set properly (99.0.1.1 for 99.0.1.100, 99.0.2.1 for 99.0.2.100).
below is contents of /etc/sysconfig/network-scripts/ifcfg-eth1
. (HWADDR is censored)
DEVICE=eth1
TYPE=Ethernet
HWADDR=**:**:**:**:**:**
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static
IPADDR=99.0.2.100
NETMASK=255.255.254.0
below is output of ip route
.
default via 99.0.1.1 dev eth0 proto static metric 100
99.0.1.0/23 dev eth0 proto kernel scope link src 99.0.1.100 metric 100
99.0.2.0/23 dev eth1 proto kernel scope link src 99.0.2.100
below is output of ip rule
.
0: from all lookup local
32765: from 99.0.2.100 lookup subroute-eth1
32766: from all lookup main
32767: from all lookup default
below is contents of /etc/sysconfig/network-scripts/route-eth1
.
default via 99.0.2.1 table subroute-eth1
below is contents of /etc/sysconfig/network-scripts/rule-eth1
.
from 99.0.2.100 table subroute-eth1
then, the following request has been sent properly and responded proper IP address as string for each public IP addresses.
# curl --interface eth0 api.ipify.org # outputs 99.0.1.100
# curl --interface eth1 api.ipify.org # outputs 99.0.2.100
here, I want each users of the system use different public IP address. So applied the following iptables source NAT. Where uid=1000 is A, uid=1001 is B, respectively.
# iptables -t nat -m owner --uid-owner 1000 -A POSTROUTING -j SNAT --to-source 99.0.1.100
# iptables -t nat -m owner --uid-owner 1001 -A POSTROUTING -j SNAT --to-source 99.0.2.100
in this situation, eth0 works correctly, but eth1 has timed out.
# curl api.ipify.org # outputs 99.0.1.100
# sudo -u A curl api.ipify.org # outputs 99.0.1.100
# sudo -u B curl api.ipify.org # **time out**
I have no idea what is wrong because of lack of network experience. If anyone has ideas, help me, please.
Note that in this situation, ssh [email protected]
from Internet is still working properly.
Edit: below is output of ip route show table subroute-eth1
default via 99.0.2.1 dev eth1
ip route show table subroute-eth1
? Or maybe it's empty and you didn't realize it?99.0.1.0/23
is an invalid route, it should be99.0.0.0/23
(99.0.2.0/23
is fine), just to keep a reproducible case in the question.