1

I have a server with two NICs, configured each with a static IP (both public, if it makes any difference). They belong to the same subnet. Eg (fake ips but following the same logic):

NIC1:

# cat ifcfg-enp4s0 
TYPE="Ethernet"
BOOTPROTO="none"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
NAME="enp4s0"
DEVICE="enp4s0"
ONBOOT="yes"
DNS1="192.168.1.1"
IPADDR=192.168.0.1
PREFIX=24
GATEWAY=192.168.0.254
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_PRIVACY=no

NIC2:

# cat ifcfg-enp2s0f0 
TYPE=Ethernet
BOOTPROTO=none
IPADDR=192.168.0.2
PREFIX=24
GATEWAY=192.168.0.254
DNS1=192.168.1.1
DEFROUTE=no
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp2s0f0
DEVICE=enp2s0f0
ONBOOT=yes

I would like outgoing connections to go through NIC1 by default, unless it's down - then it should go through NIC2.

Packets to 192.168.0.1 should go to NIC1 and replies should come out of NIC1. Equally, packets to 192.168.0.2 should go to NIC2 and replies come out of NIC2.

With the above configuration, I get the following route:

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.254  0.0.0.0         UG    100    0        0 enp4s0
192.168.0.0    0.0.0.0         255.255.255.0   U     100    0        0 enp2s0f0
192.168.0.0    0.0.0.0         255.255.255.0   U     101    0        0 enp4s0

Now, the server is connected but only 192.168.0.1 is pingable from outside. 192.168.0.2 is unreacheable.

The network guys tell me that 192.168.0.2 is reachable from within the same subnet, so it must be an error in my configuration that makes is unavailable outside.

What did I do wrong? Can you advise on a fix?

2

I think you would be better off bonding the two NICs, and assigning a single IP to the bond.

The RedHat documentation has a good guide on this.

From what you state of your requirements, you will most likely want mode=1 (but check to see if the other modes might not do something 'better' - e.g. doubling your throughput unless one NIC is down).

If a bond is not an acceptable solution, you may want to create a static routes with metrics for each interface so that one is preferred over the other (I think you might be able to get away with 'only' setting a GATEWAY in each ifcfg-PORT file).

NIC2 is reachable locally because it is addressed by its physical (MAC) address, not its IP. When you try and contact it remotely, I would tend to think that you would need IP forwarding to be enabled.

tl;dr: A bond would simplify your life and make for a more resilient server, but if you really don't want that, you probably want some combination of route metrics/costs and ip_forwarding. But you will not be able to avoid NIC2's traffic going through NIC1 when NIC1 is up, since it has the preferred default route (i.e. the lower metric/cost).

  • I'm afraid I can't do bonding right now. Must be two separate IPs. The IP set on NIC1 works fine, I didn't do any forwarding. The network guys assure me all is setup correctly in their router/firewall.. I will look into static routing, thanks for the link. – Fabio Mar 3 '17 at 16:11
  • Ouch - in that case, I'm afraid it sounds like one of your other requirements may need to give. If you were to set your default gateway in /etc/sysconfig/network, you might be able to have a single default route in place, but you would still need ip_forwarding to reach your other IP from outside its broadcast domain. And for traffic that uses the default route, it would always transit via the preferred device for that route. Within the network's broadcast domain though, you can address each IP individually – iwaseatenbyagrue Mar 3 '17 at 16:15
  • I guess I need to read up quite a bit. I was hoping for a relatively easy fix but I'm out of my depth. Thanks for the advice. – Fabio Mar 3 '17 at 16:30
  • My pleasure - but do see if you can overcome the 'bond aversion' - all else aside, it simplifies your life and config, and if something does fail, it makes it more likely that things will continue working. Good luck – iwaseatenbyagrue Mar 3 '17 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.