All of lore.kernel.org
 help / color / mirror / Atom feed
From: Rafal Krzewski <Rafal.Krzewski@caltha.pl>
To: lartc@vger.kernel.org
Subject: [LARTC] routing with multiple uplinks problem
Date: Mon, 24 May 2004 07:44:43 +0000	[thread overview]
Message-ID: <40B1A7EB.7010300@caltha.pl> (raw)

Hello all,

I'm writing to the list, because I have a problem setting up my routing 
that I'm unable to overcome.

1. The situation:

+-------------+                      +-------------+
|    actaea   |                 eth0 |    ilex     |
| 192.168.1.4 |------ localnet ------| 192.168.1.1 |
+-------------+    192.168.1.0/24    +-------------+
                                  eth1 /          | ppp0
                                80.72.34.162  83.31.149.159 

                                      /           |
                                   wlnet        tpsa
                             80.72.34.160/24      |
                                   /              |
                          +--------------+   +------------+
                          | 80.72.34.161 |   | 213.25.2.3 |
                          +--------------+   +------------+
                                  \               /
                                   \-----------, /
        +--------------+          ""            \
        |    salix     |        /   Internet    "
        | 212.87.7.182 |--------'-,          ,-"
        +--------------+           "--------"

Ilex, the router/firewall is running Debian/GNU Linux "Sarge", kernel 
version 2.6.5, iproute2 tools 20010824-13, iptables 1.2.9-6

2. What I am trying to achieve:

I want ilex to respond to any incoming trafic on 80.72.34.162 address 
(it is running a DNS server). All outgoing trafic from localnet should 
go through tpsa link (faster but non-static IP). Resposnses to the 
latter should also return through tpsa link.

I have followed instrucitons from LARTC howto, chapter 4.2 but to no avail.

3. The problem:

after running:

ip route del default
ip route add default via 213.25.2.3

localnet traffic flows fine, BUT ilex no longer responds to pings from 
salix on 80.72.34.162 address

this happens also in the opposite direction, after running:

ip route del default
ip route add default via 80.72.34.161

localnet traffic flows fine, BUT ilex no longer responds to pings from 
salix on 83.31.149.159 address

4. What I did to diagnose the problem:

Checked, and double checked my settings against the howto.

Tried pinging ilex from salix tracing the traffic with iptables -j LOG
(settings below). I'm able to see ping request packets, but no ping 
response packets. I also tried monitoring the trafic with ethereal, both 
on the virtuall 'all' interface, and also on each of the physical 
interface (well, ppp0 isn't actually physical, but you get the idea) in 
promiscous mode. Only ping request packets are visible.

Then I tried connecting with ssh from salix to ilex. I'm seeing incoming 
SYN packets, but no response packets directed to salix emerge on either 
interface.

5. Relevant diagnostic information:

ip output, with default route through wlnet link:

ilex:~# ip address show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
     inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
     link/ether 00:30:1b:2e:fb:c1 brd ff:ff:ff:ff:ff:ff
     inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
     link/ether 00:c0:df:f7:5c:26 brd ff:ff:ff:ff:ff:ff
     inet 80.72.34.162/27 brd 80.255.255.255 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
     link/ether 00:60:4c:17:54:7c brd ff:ff:ff:ff:ff:ff
27: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 3
     link/ppp
     inet 83.31.149.159 peer 213.25.2.3/32 scope global ppp0

ilex:~# ip rule show
0:      from all lookup local
32764:  from 213.25.2.3 lookup tpsa
32765:  from 80.72.34.161 lookup wlnet
32766:  from all lookup main
32767:  from all lookup default

ilex:~# ip route show table local
local 192.168.1.1 dev eth0  proto kernel  scope host  src 192.168.1.1
local 83.31.149.159 dev ppp0  proto kernel  scope host  src 83.31.149.159
broadcast 80.72.34.160 dev eth1  proto kernel  scope link  src 80.72.34.162
broadcast 192.168.1.0 dev eth0  proto kernel  scope link  src 192.168.1.1
broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1
local 80.72.34.162 dev eth1  proto kernel  scope host  src 80.72.34.162
broadcast 80.255.255.255 dev eth1  proto kernel  scope link  src 
80.72.34.162
broadcast 192.168.1.255 dev eth0  proto kernel  scope link  src 192.168.1.1
broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1
local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1
broadcast 80.72.34.191 dev eth1  proto kernel  scope link  src 80.72.34.162
local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1

ilex:~# ip route show table tpsa
213.25.2.3 dev ppp0  scope link  src 83.31.149.159
80.72.34.160/27 dev eth1  scope link
192.168.1.0/24 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via 213.25.2.3 dev ppp0

ilex:~# ip route show table wlnet
213.25.2.3 dev ppp0  scope link
80.72.34.160/27 dev eth1  scope link  src 80.72.34.162
192.168.1.0/24 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via 80.72.34.161 dev eth1

ilex:~# ip route show table main
213.25.2.3 dev ppp0  proto kernel  scope link  src 83.31.149.159
80.72.34.160/27 dev eth1  proto kernel  scope link  src 80.72.34.162
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
default via 80.72.34.161 dev eth1

ilex:~# ip route show table default

iptables output at the time of testing (disabled firewall):

ilex:~# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4
 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4
 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4
ilex:~# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4
 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4
MASQUERADE  all  --  192.168.0.0/16       0.0.0.0/0
MASQUERADE  all  --  192.168.0.0/16       0.0.0.0/0
 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
LOG        all  --  83.31.149.159        0.0.0.0/0           LOG flags 0 
level 4
LOG        all  --  0.0.0.0/0            83.31.149.159       LOG flags 0 
level 4

Note: the seemingly indentical MASQUERADE entries in the POSTROUTING 
chain are:
-s 192.168.0.0/16 -o eth1 -j MASQUERADE
-s 192.168.0.0/16 -o ppp0 -j MASQUERADE

My apologies for a rather lenghty email. I'm trying to provide all 
information that I have in order to reduce mailing list noise.Please 
help - I am stuck.

Thanks in advance,
Rafal

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

             reply	other threads:[~2004-05-24  7:44 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-05-24  7:44 Rafal Krzewski [this message]
2004-05-24  8:36 ` [LARTC] routing with multiple uplinks problem Jose Luis Domingo Lopez
2004-05-24 10:38 ` Rafal Krzewski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=40B1A7EB.7010300@caltha.pl \
    --to=rafal.krzewski@caltha.pl \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.