0

I have:

eth0                         eth0 
Router 1|eth1 ----  eth1|Router 2

Both eth0's are connected to the Internet. However currently the default route to reach the Internet on Router 2 is via eth1 (so it goes through router 1). Router 1 can reach the Internet fine, however I am unable to ssh to the ip on eth0 on Router 2 from the Internet.

I tried `sudo bash -c 'echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter' but that has not resolved the issue. When I do a packetdump on router 2 filtering on the source IP of the machine trying to ssh to Router 2 I see the incoming packets but no replies.

2
  • I'm very curious what a packet dump on R2-Eth1 shows. Dump on both interfaces, and see what the source port is on incoming connection R2-Eth0, then check the R2-Eth1 dump for anything to that port-number. It may help illuminate problems. Or, you know, show nothing.
    – sysadmin1138
    Jul 21, 2010 at 15:12
  • The dump on eth1 just shows the SYN packets keep coming in. For R2 eth1 I see nothing. Jul 21, 2010 at 15:17

3 Answers 3

0

Some Questions:

Do you have a firewall running on router 2?

Is SSH running on Router 2?

Do you have a NAT or an access rule on Router 1?

Are the routes on both routers correct ?

2
  • Firewall: I have removed all rules for the time being. SSH: Yes, of course :-) I can ssh from Router 1 to Router 2 via the eth1s. Nat on Router 1: Yes, but only to match things that arrive from Router 2 that have an internal IP. Routes: I believe they are correct yes. Since connections initiated from Router 2 go out to the intervia via eth1 work fine. Jul 21, 2010 at 14:27
  • Please add the routing table of both routers: $route -n And the firewall please with: $iptables -l -v -n
    – Fake4d
    Jul 21, 2010 at 14:57
0

Please show your routing table. This is quite likely a routing problem :)

To get the routing table, type

route -n

0

Actually it turns out my rp_filter idea is the correct solution. When I disabled it for everything on both routers the problem is resolved.

This is obviously the BIG HAMMER approach so I need to work through all the logic and figure out which ones I need to selectively disable and the put more fine grained protection around it with iptables.... To Be Continued :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .