3

In the following output, why does vpn1 route/ping to 10.100.0.1 instead of to 10.100.0.112?

10.100.0.1 is network gateway with no nat. 10.100.0.112 is dual home host with nat enabled.

root@vpn1:~# ip ro

8.8.8.8 via 10.100.0.112 dev eth0  src 10.100.0.5
10.100.0.0/24 dev eth0  proto kernel  scope link  src 10.100.0.5
default via 10.100.0.1 dev eth0  metric 100

root@vpn1:~# traceroute 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  10.100.0.1 (10.100.0.1)  0.287 ms  0.257 ms  0.317 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * *^C

root@vpn1:~# ping 10.100.0.112

PING 10.100.0.112 (10.100.0.112) 56(84) bytes of data.
64 bytes from 10.100.0.112: icmp_req=1 ttl=127 time=0.321 ms
^C


--- 10.100.0.112 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.321/0.321/0.321/0.000 ms</br>

On the other side, 10.100.0.112 has a following configuration

boban@boban-desktop:~$ ip ro  
10.100.0.114 dev ppp0  proto kernel  scope link  src 10.100.0.112  
x.y.z.q/28 dev eth0  proto kernel  scope link  src x.y.z.56  metric 1  
**10.100.0.0/16 dev ppp0  scope link**    
default via x.y.z.62 dev eth0  proto static

So, network 10.100.0.0/16 is on ppp0 interface, vpn (maybe this is of bigger importance than I think).

boban@boban-desktop:~$ sudo iptables -t nat -S  
-P PREROUTING ACCEPT  
-P INPUT ACCEPT  
-P OUTPUT ACCEPT  
-P POSTROUTING ACCEPT  
-A POSTROUTING -o eth0 -j MASQUERADE  
boban@boban-desktop:~$ sudo iptables  -S  
-P INPUT ACCEPT  
-P FORWARD ACCEPT  
-P OUTPUT ACCEPT
Improve this question
0

2 Answers 2

Reset to default
0

Difficult to tell without seeing more. What is the default route configuration at 10.100.0.112? Could you get a tcpdump of the traffic on the wire?

I'd suspect an ICMP redirect from 10.100.0.112 telling your host to use 10.100.0.1 instead.

Improve this answer
5
  • where is your VPN gateway then? could you add its addresses, routing configuration and information about the implementation (mainly if it is bridging or doing proxy arp) as well please? And a tcpdump would still help a lot.
    – the-wabbit
    May 31, 2011 at 9:40
  • I'm starting to think that it's not the routing problem here. I've tried to connect to ppp from windows, and I've got client address 10.100.0.103, server address 10.100.0.112. From vpn1, I can ping 10.100.0.112, but not 10.100.0.103. So I can't route 8.8.8.8 to 10.100.0.103 as I should.
    – Boban P.
    May 31, 2011 at 11:32
  • How to solve it?
    – Boban P.
    May 31, 2011 at 11:33
  • I don't know details since it's remote vpn server which is not set up by me. All I have it is login credentials and server IP. Which exactly tcpdump are you are interested?
    – Boban P.
    May 31, 2011 at 11:58
  • I still don't quite get it - you have a host at 10.100.0.112 with a route to 10.100.0.0/16 through a PPP VPN interface, right? This route includes the network 10.100.0.0/24, which the host itself appears to be in locally - right? In the same network 10.100.0.0/24 you have vpn1, but it can only reach 10.100.0.112 through a PPP (VPN) connection through the 10.100.0.114 gateway - correct? It would help to have some kind of conceptual drawing of what is where. And a tcpdump -vne off the station you are trying the ping from - i.e. vpn1. Feel free to just update the question with this information.
    – the-wabbit
    May 31, 2011 at 12:44
0

I would expect to see a subnet mask for that 8.8.8.8 route - the fact that I don't see one seems to indicate that it isn't doing the right thing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.