unable to route through linux gateway

Question

I have 2 linux box A and B, both are RHEL 7.

B nic configuration:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
    inet 10.74.61.131  netmask 255.255.254.0  broadcast 10.74.61.255
    inet6 fe80::1011:12ff:fec7:d118  prefixlen 64  scopeid 0x20<link>
    ether 12:11:12:c7:d1:18  txqueuelen 1000  (Ethernet)
    RX packets 4599  bytes 503250 (491.4 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 4489  bytes 693330 (677.0 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
    inet 10.74.60.97  netmask 255.255.254.0  broadcast 10.74.61.255
    inet6 fe80::10b3:c9ff:fe85:47b5  prefixlen 64  scopeid 0x20<link>
    ether 12:b3:c9:85:47:b5  txqueuelen 1000  (Ethernet)
    RX packets 136  bytes 8864 (8.6 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 274  bytes 22184 (21.6 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

B Kernel IP routing table

 Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
  0.0.0.0         10.74.60.1      0.0.0.0         UG    100    0        0 eth0
  0.0.0.0         10.74.60.1      0.0.0.0         UG    101    0        0 eth1
  10.74.60.0      0.0.0.0         255.255.254.0   U     100    0        0 eth0
  10.74.60.0      0.0.0.0         255.255.254.0   U     101    0        0 eth1
  146.1.242.0     10.74.61.26     255.255.254.0   UG    0      0        0 eth1

B ip route

default via 10.74.60.1 dev eth0  proto static  metric 100
default via 10.74.60.1 dev eth1  proto static  metric 101
10.74.60.0/23 dev eth0  proto kernel  scope link  src 10.74.61.131  metric 100
10.74.60.0/23 dev eth1  proto kernel  scope link  src 10.74.60.97  metric 101
146.1.242.0/23 via 10.74.61.26 dev eth1

B route to 146.1.242.62:

ip route get 146.1.242.62
146.1.242.62 via 10.74.61.26 dev eth1  src 10.74.60.97
cache

A nic configuration

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
    inet 10.74.61.26  netmask 255.255.254.0  broadcast 10.74.61.255
    ether 12:d5:c1:64:c1:84  txqueuelen 1000  (Ethernet)
    RX packets 41439  bytes 2210425 (2.1 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 78272  bytes 23367775 (22.2 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9001
    inet 10.74.60.101  netmask 255.255.254.0  broadcast 10.74.61.255
    ether 12:f6:c9:b0:75:05  txqueuelen 1000  (Ethernet)
    RX packets 521  bytes 32470 (31.7 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 275  bytes 22494 (21.9 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

A Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.74.60.1      0.0.0.0         UG    100    0        0 eth0
0.0.0.0         10.74.60.1      0.0.0.0         UG    101    0        0 eth1
10.74.60.0      0.0.0.0         255.255.254.0   U     100    0        0 eth0
10.74.60.0      0.0.0.0         255.255.254.0   U     101    0        0 eth1

A ip route

default via 10.74.60.1 dev eth0  proto static  metric 100
default via 10.74.60.1 dev eth1  proto static  metric 101
10.74.60.0/23 dev eth0  proto kernel  scope link  src 10.74.61.26  metric  100
10.74.60.0/23 dev eth1  proto kernel  scope link  src 10.74.60.101  metric 101

A is used as gateway, in B any traffic destined to 146.1.242.0/23 goes thru eth1 which has 10.74.61.26 gateway.

B --> eth1 (gw 10.74.61.26) ---->A (eth0 10.74.61.26)

A route to 146.1.242.62:

ip route get 146.1.242.62
146.1.242.62 via 10.74.61.26 dev eth1  src 10.74.60.97
cache

I have made A routable A ip routing conf /etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
#disable ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1

net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2

Enabled & started firewall. Iptables all are accept, nothing getting dropped or rejected.

So when i ping from B

ping -I eth1 146.1.242.62
PING 146.1.242.62 (146.1.242.62) from 10.74.60.97 eth1: 56(84) bytes of data.
^C
--- 146.1.242.62 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms

It never goes through, what is that i am doing wrong.

When i ping from B to A below are the tcpdump result

ping -I eth0 146.1.242.62
PING 146.1.242.62 (146.1.242.62) from 10.74.61.131 eth0: 56(84) bytes of data.
64 bytes from 146.1.242.62: icmp_seq=1 ttl=50 time=36.8 ms
^C
--- 146.1.242.62 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5009ms

tcpdump icmp response:

IP 146.1.242.62 > ip-10-74-61-131.ebiz.ee.com: ICMP echo reply, id 3405, seq 1, length 64
IP ip-10-74-61-131.ebiz.ee.com > 146.1.242.62: ICMP echo request, id 3405, seq 2, length 64
IP 146.1.242.62 > ip-10-74-61-131.ebiz.ee.com: ICMP echo reply, id 3405, seq 2, length 64
IP ip-10-74-61-131.ebiz.ee.com > 146.1.242.62: ICMP echo request, id 3405, seq 3, length 64
IP 146.1.242.62 > ip-10-74-61-131.ebiz.ee.com: ICMP echo reply, id 3405, seq 3, length 64
IP ip-10-74-61-131.ebiz.ee.com > 146.1.242.62: ICMP echo request, id 3405, seq 4, length 64
IP 146.1.242.62 > ip-10-74-61-131.ebiz.ee.com: ICMP echo reply, id 3405, seq 4, length 64
IP ip-10-74-61-131.ebiz.ee.com > 146.1.242.62: ICMP echo request, id 3405, seq 5, length 64

But when i do

ping -I eth1 146.1.242.62
PING 146.1.242.62 (146.1.242.62) from 10.74.60.97 eth1: 56(84) bytes of data.
^C
--- 146.1.242.62 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

no tcpdump icmp response.

iptables of A as of 11/21/2016

iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
...
-A PREROUTING -j LOG --log-prefix "-- PRE ROUTE--" --log-level 6
-A POSTROUTING -j LOG --log-prefix "-- POST ROUTE--" --log-level 6


iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

iptables of B:

iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -j LOG --log-prefix "-- POST ROUTE--" --log-level 6

After enabling log for post route in B and pre & post route log in A, i pinged the target (146.1.242.62), it logs in B post route, but nothing in pre route of A. Below is the log entry and ping

ping 146.1.242.62
PING 146.1.242.62 (146.1.242.62) from 10.74.60.97 eth1: 56(84) bytes of data.
^C
--- 146.1.242.62 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

B log:
Nov 21 10:36:25 localhost kernel: -- POST ROUTE--IN= OUT=eth1 SRC=10.74.60.97 DST=146.1.242.62 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=19877 DF PROTO=ICMP TYPE=8 CODE=0 ID=4920 SEQ=1  

A log: none, no log in PRE ROUTE & POST ROUTE about the ping

Does your router normally deal with your interfaces having an mtu of 9001? What is it's mtu? Are you doing some type of pmtud? — Aaron, Nov 21 '16 at 13:12
hmm.. i have not done anything with mtu, but my tracepath shows pmtu 9001. — Jin, Nov 21 '16 at 13:50

score 1 · Answer 1 · answered Nov 21 '16 at 00:11

1

Your post doesn't show any iptables rules. My guess it that on your host A, you should make sure that traffic passing through gets NAT-ed.

Running the following command as root may help:

iptables -t nat -A POSTROUTING --src 10.74.60.97/32 \! --dst 10.74.61.26/32 -o eth0 -j MASQUERADE

You may also find tcpdump useful, troubleshooting network issues.

answered Nov 21 '16 at 00:11

SYN

1,751
9
14

I added the rule, but still the same issue, i have used the tcp dump i see that there is no response. i have update the post with its result. – Jin Nov 21 '16 at 13:52

unable to route through linux gateway

1 Answers1