0

I am building a cluster in the Google Compute Engine and currently I need to add a static route to another machine in the same network, but something is going wrong and I get an error "RTNETLINK answers: Network is unreachable".

Important note: I am not a network expert and I am probably doing some basic mistakes in the process.

I have a machine A and a machine B, where A has a subnet 11.10.0.0/16 with other machines B cannot reach, so A will be B's gateway to them. Both have the flag IP forwarding active and are in the same network (using eth0 on both) and can reach the other directly.

The command and error (executed on B) are:

B:~$ sudo ip route add 11.10.0.0/16 via 10.240.0.8 dev eth0
RTNETLINK answers: Network is unreachable

Host A

A:~$ ip route list
default via 10.240.0.1 dev eth0 
10.240.0.1 dev eth0  scope link 
11.10.0.0/16 via 11.10.0.2 dev tun0 
11.10.0.2 dev tun0  proto kernel  scope link  src 11.10.0.1 
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1
A:~$ ip addr
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1460 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 42:01:0a:f0:00:08 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.8/32 brd 10.240.0.8 scope global eth0
       valid_lft forever preferred_lft forever
3: docker0:  mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:7d:6d:9b:0b brd ff:ff:ff:ff:ff:ff
    inet 172.17.42.1/16 scope global docker0
       valid_lft forever preferred_lft forever
7: tun0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 100
    link/none 
    inet 11.10.0.1 peer 11.10.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever
A:~$ sudo iptables --list -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        anywhere            

Chain DOCKER (2 references)
target     prot opt source               destination
A:~$ sudo iptables --list -t filter
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination

Host B

B:~$ ip route
default via 10.240.0.1 dev eth0 
10.240.0.1 dev eth0  scope link 
11.11.0.0/16 via 11.11.0.2 dev tun0 
11.11.0.2 dev tun0  proto kernel  scope link  src 11.11.0.1 
172.17.0.0/16 dev docker0  proto kernel  scope link  src 172.17.42.1
B:~$ ip addr
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1460 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 42:01:0a:f0:00:07 brd ff:ff:ff:ff:ff:ff
    inet 10.240.0.7/32 brd 10.240.0.7 scope global eth0
       valid_lft forever preferred_lft forever
3: docker0:  mtu 1460 qdisc noqueue state DOWN group default 
    link/ether 02:42:b0:25:d5:57 brd ff:ff:ff:ff:ff:ff
    inet 172.17.42.1/16 scope global docker0
       valid_lft forever preferred_lft forever
17: tun0:  mtu 1500 qdisc pfifo_fast state UP group default qlen 100
    link/none 
    inet 11.11.0.1 peer 11.11.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever
B:~$ sudo iptables --list -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  172.17.0.0/16        anywhere            

Chain DOCKER (2 references)
target     prot opt source               destination

B:~$ sudo iptables --list -t filter
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination

I hope I've given enough information about the issue.

Improve this question
1
  • Well, my first error is using the network 11.10.0.0/16, which is reserved, so I cannot use it. But it seems the problems is related to the fact my two servers are not direct connected, so I'll probably need to solve the issue by using the gcloud API.
    – Leandro Santiago
    Oct 27, 2015 at 15:32

1 Answer 1

Reset to default
5

The virtual network you get on a GCE instance is effectively a /32 network to which only the instance itself and the gateway are attached (the latter being configured using a host route). This means that all outgoing traffic is sent to the gateway.

That is the reason why you get the following error:

B:~$ sudo ip route add 11.10.0.0/16 via 10.240.0.8 dev eth0
RTNETLINK answers: Network is unreachable

The error simply tells you that there is no host or network route that matches 10.240.0.8 (other than the default route which uses a gateway itself).

There is no way to set up your desired configuration using routing configuration on the hosts. Instead you need to configure routing in GCE itself, as described here. Conceptually you can think of this as configuring the routing table on the gateway. You don't need any additional configuration on the hosts because as explained above, they send all outgoing packets to the gateway.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .