I'm investigating some anomalies I found on a server I manage after installing Snort IDS.
I have ~10 Ubuntu production webservers that are set up with Ansible and regularly provisioned. One of them is displaying very strange routing of requests.
Lets say the server's IP public is
- It's a Digital Ocean droplet.
- It only has one NIC.
ifconfigshows the NIC with public IP
When I look at the logs in Snort, and also when I monitor the network traffic with iftop I see that:
- All of the traffic I expect (ssh, https, an SQL port) is being routed to a host at a private address in the
10.255.255.255range. Let's say it's:
- Traffic on other ports is not being redirected there, and is resolving to ports on
If I look through my
iptables rules there are no mentions of this host
10.20.0.10, or anything unusual with routing.
netstat is not showing anything unusual. If I ping
10.20.0.10 I can see there is something there. I can't see any processes running on the server that are unexpected.
I can't figure out why or how traffic from external addresses is being routed to this private address. I've checked the other 10 servers (which are all configured exactly the same, via Ansible) and they don't have this strange routing behaviour. All their traffic resolves to regular ports on their respective public IPs.
It seems like the network interface configuration is non-standard on our servers that are hosted with Digital Ocean.
auto lo iface lo inet loopback auto eth0 iface eth0 inet dhcp
auto lo iface lo inet loopback dns-nameservers 188.8.131.52 184.108.40.206 # This is custom Digital Ocean DNS auto eth0 iface eth0 inet static address 220.127.116.11/20 gateway 18.104.22.168 # control-alias eth0 iface eth0 inet static address 10.20.0.10/16
So that's part of the mystery solved. Our other DO hosted servers have a similar config (with different IPs, obviously).
The remaining issue is that our other DO-hosted servers don't route any incoming traffic to their addresses listed under "control-alias eth0", so I'm still confused as to why one server does, and the others don't.