I have:

eth0                         eth0 
Router 1|eth1 ----  eth1|Router 2

Both eth0's are connected to the Internet. However currently the default route to reach the Internet on Router 2 is via eth1 (so it goes through router 1). Router 1 can reach the Internet fine, however I am unable to ssh to the ip on eth0 on Router 2 from the Internet.

I tried `sudo bash -c 'echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter' but that has not resolved the issue. When I do a packetdump on router 2 filtering on the source IP of the machine trying to ssh to Router 2 I see the incoming packets but no replies.

  • I'm very curious what a packet dump on R2-Eth1 shows. Dump on both interfaces, and see what the source port is on incoming connection R2-Eth0, then check the R2-Eth1 dump for anything to that port-number. It may help illuminate problems. Or, you know, show nothing. – sysadmin1138 Jul 21 '10 at 15:12
  • The dump on eth1 just shows the SYN packets keep coming in. For R2 eth1 I see nothing. – Kyle Brandt Jul 21 '10 at 15:17

Some Questions:

Do you have a firewall running on router 2?

Is SSH running on Router 2?

Do you have a NAT or an access rule on Router 1?

Are the routes on both routers correct ?

  • Firewall: I have removed all rules for the time being. SSH: Yes, of course :-) I can ssh from Router 1 to Router 2 via the eth1s. Nat on Router 1: Yes, but only to match things that arrive from Router 2 that have an internal IP. Routes: I believe they are correct yes. Since connections initiated from Router 2 go out to the intervia via eth1 work fine. – Kyle Brandt Jul 21 '10 at 14:27
  • Please add the routing table of both routers: $route -n And the firewall please with: $iptables -l -v -n – Fake4d Jul 21 '10 at 14:57

Please show your routing table. This is quite likely a routing problem :)

To get the routing table, type

route -n


Actually it turns out my rp_filter idea is the correct solution. When I disabled it for everything on both routers the problem is resolved.

This is obviously the BIG HAMMER approach so I need to work through all the logic and figure out which ones I need to selectively disable and the put more fine grained protection around it with iptables.... To Be Continued :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.