0

I have been using an OpenVZ environment left behind by a previous employee. A while ago I needed to use virtual eth devices to try a specific application. After removing VETH might have misconfigured my routing. To make matters worse the firewall configuration has been changed in those days, making it difficult to pinpoint the issue.

The situation now is that from the HN and the CTs I can ping all hosts on the company Network, but I cannot access any of them using other protocols.

The routing configuration is: ip route 10.1.0.234 dev venet0 scope link 10.1.0.126 dev venet0 scope link 10.1.0.203 dev venet0 scope link 10.1.0.125 dev venet0 scope link 10.1.0.97 dev venet0 scope link 10.1.0.0/24 dev br0 proto kernel scope link src 10.1.0.52 169.254.0.0/16 dev br0 scope link metric 1003 default via 10.1.0.254 dev br0

The bridge configuration is:

brctl show
bridge name bridge id       STP enabled interfaces
br0     8000.080027319a71   no      eth0

The IP configuration is:

ip add
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 08:00:27:31:9a:71 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::a00:27ff:fe31:9a71/64 scope link 
       valid_lft forever preferred_lft forever
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 08:00:27:31:9a:71 brd ff:ff:ff:ff:ff:ff
    inet 10.111.0.52/24 brd 10.111.0.255 scope global br0
    inet6 fe80::a00:27ff:fe31:9a71/64 scope link 
       valid_lft forever preferred_lft forever
4: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/void 
    inet6 fe80::1/128 scope link 
       valid_lft forever preferred_lft forever

Where 10.1.0.52 is the hn ip address and 10.1.0.254 is the physical gateway (I am connecting from a satellite office)

With my poor networking skills I cannot see anything wrong in this configuration. I think there is an issue with the firewall configuration, but the admin in charge of the firewall is adamant the issue is in my routing.

  • You should share the HN's iptables configuration, the bridge and interface configuration and routing table if a container is actually running (which it seems you didn't) and perhaps your sysctl settings. – fuero Jan 7 '15 at 22:24
  • I pruned the CTs entries from ip route, because i did not want to edit all those ips. Iptables is completely empty (which is strange). – Bruno9779 Jan 7 '15 at 22:31
  • The brctl output you shared only contains eth0 only, which can't be right. You doing proxy arp? – fuero Jan 7 '15 at 22:33
  • No, no proxy ARP. I have never configured a bridge before, so I am kinda at loss about what should be there and what should not – Bruno9779 Jan 7 '15 at 22:36
  • Join me on the StackExchange Chat, clearing this up would only produce useless clutter in the comment. – fuero Jan 7 '15 at 22:47

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.