3

AWS. Centos 7.5 m5.large EC2 instance. VPC with 2 subnets. The instance has two network interfaces, one per a subnet. A Network Security Group is configured to allow all TCP inbound and outbound connections from/to my public IP. 

[root@ip-10-212-0-116 ~]# cat /etc/iproute2/rt_tables
255     local
254     main
253     default
0       unspec
200 ens5-rt
200 ens6-rt

[root@ip-10-212-0-116 ~]# ip route
default via 10.212.0.1 dev ens5 
10.212.0.0/24 dev ens5 proto kernel scope link src 10.212.0.116 
10.212.1.0/24 dev ens6 proto kernel scope link src 10.212.1.116

[root@ip-10-212-0-116 ~]# ip add |grep ens
2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
    inet 10.212.0.116/24 brd 10.212.0.255 scope global dynamic ens5
3: ens6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    inet 10.212.1.116/24 brd 10.212.1.255 scope global ens6

[root@ip-10-212-0-116 ~]# cat /etc/sysconfig/network-scripts/rule-ens{5,6}
from 10.212.0.116/32 table ens5-rt
to 10.212.0.116/32 table ens5-rt
from 10.212.1.116/32 table ens6-rt
to 10.212.1.116/32 table ens6-rt

[root@ip-10-212-0-116 ~]# cat /etc/sysconfig/network-scripts/rule-ens{5,6}
from 10.212.0.116/32 table ens5-rt
to 10.212.0.116/32 table ens5-rt
from 10.212.1.116/32 table ens6-rt
to 10.212.1.116/32 table ens6-rt

So ssh -i Downloads/rasp.pem centos@publicip1 works. And ssh -i Downloads/rasp.pem centos@publicip2 returns timeout error.

I have done the same configuration in Azure using this guide https://docs.microsoft.com/en-us/azure/virtual-machines/linux/multiple-nics and it works. The difference I have noticed is that in AWS ens5 (primary) interface rewrites BOOTPROTO setting from static to dhcp on boot.

Mr. Raspberry
  • 3,918
  • 13
  • 32
  • Whatever else is needed for policy routing (like actual routes added in the new routing table(s)), you certainly shouldn't use the same value 200 to define ens5-rt and ens6-rt. Defining and using the symbols ens5-rt and ens6-rt isn't needed. Two specific routing table values (eg: 200 and an other one like 201) *are* needed, or the same routing table will get everything and this won't be different from the default of using the main routing table. – A.B Apr 16 '22 at 14:24

0 Answers0