0

My server (runs on Ubuntu 12.04) is behind a NAT and has to access a specific service that has a public IP address (64.*.*.*).

The problem is that I cannot reach that specific public IP (all other IP addresses for the same service work; the domain has several IP addresses assigned to it). The same IP address can be reached from another identical environment. The NAT server (through which I pass) can also access it.

Tcpdump on my server shows only SYN packages, while on the NAT does not show any traffic comming from my server. The IP is not blocked by iptables on the NAT server. Another IP for the same service works fine.

Scheme:

My Server -> My NAT -> (Unreachable) Public IP

Routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.10.2.200      0.0.0.0         UG        0 0          0 eth0
10.10.0.0        10.10.2.1        255.255.255.0   UG        0 0          0 eth0
10.10.2.0        0.0.0.0         255.255.254.0   U         0 0          0 eth0
10.10.9.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1

IP Address of eth0: 10.10.2.51

I discovered (by comparing the MAC addresses in tcpdumps and looking in the arp table) that instead of going towards my default gateway, the server tries to establish the connection through 10.10.2.1 (but only for that public IP, 64.*.*.*), which is puzzling me.

8
  • 1
    Share your routing table and your NIC configuration. Verify that packets take the correct interface when leaving your server.
    – fuero
    Apr 18, 2013 at 14:28
  • What is the unreachable public IP?
    – pjc50
    Apr 18, 2013 at 14:45
  • That IP is unreachable only from my server (the one in question; the other ones work perfectly). It's address should not matter.
    – Mihai
    Apr 18, 2013 at 14:48
  • @Mihai For us to understand the route your server is sending the connection along, we need to know what IP you're trying to access. For example, if it's within 10.10.0.*, then it'll be routed through 10.10.2.1. For the reasons you've listed, it's probably a routing issue on your server, and the address we're trying to reach matters very much for figuring this out. Apr 18, 2013 at 18:08
  • @Darth: If the target address is within 10.10.0.*, then I would hope that the OP would not so emphatically call it a “public IP address.” Still, … Apr 18, 2013 at 18:53

1 Answer 1

0

I think I solved the problem. Unfortunately, I don't know which of the two things I did solved it.

First I added one more interface from a different subnet (10.10.8.51), changed the NAT server IP address (10.10.8.200) and sent all the default traffic through that interface.

Secondly, I discovered that the NAT server did ICMP redirect so I disabled the accepting of redirects. I actually think that this caused my problem, but I did not have time to test it on the staging env.

# sysctl -w net.ipv4.conf.eth2.accept_redirects = 0
# sysctl -w net.ipv4.conf.eth2.send_redirects = 0

# sysctl -w net.ipv6.conf.eth2.accept_redirects = 0
# sysctl -w net.ipv6.conf.eth2.send_redirects = 0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .