Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My server (runs on Ubuntu 12.04) is behind a NAT and has to access a specific service that has a public IP address (64.*.*.*).

The problem is that I cannot reach that specific public IP (all other IP addresses for the same service work; the domain has several IP addresses assigned to it). The same IP address can be reached from another identical environment. The NAT server (through which I pass) can also access it.

Tcpdump on my server shows only SYN packages, while on the NAT does not show any traffic comming from my server. The IP is not blocked by iptables on the NAT server. Another IP for the same service works fine.

Scheme:

My Server -> My NAT -> (Unreachable) Public IP

Routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.10.2.200      0.0.0.0         UG        0 0          0 eth0
10.10.0.0        10.10.2.1        255.255.255.0   UG        0 0          0 eth0
10.10.2.0        0.0.0.0         255.255.254.0   U         0 0          0 eth0
10.10.9.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1

IP Address of eth0: 10.10.2.51

I discovered (by comparing the MAC addresses in tcpdumps and looking in the arp table) that instead of going towards my default gateway, the server tries to establish the connection through 10.10.2.1 (but only for that public IP, 64.*.*.*), which is puzzling me.

share|improve this question
1  
Share your routing table and your NIC configuration. Verify that packets take the correct interface when leaving your server. –  fuero Apr 18 '13 at 14:28
    
What is the unreachable public IP? –  pjc50 Apr 18 '13 at 14:45
    
That IP is unreachable only from my server (the one in question; the other ones work perfectly). It's address should not matter. –  Mihai Apr 18 '13 at 14:48
    
@Mihai For us to understand the route your server is sending the connection along, we need to know what IP you're trying to access. For example, if it's within 10.10.0.*, then it'll be routed through 10.10.2.1. For the reasons you've listed, it's probably a routing issue on your server, and the address we're trying to reach matters very much for figuring this out. –  Darth Android Apr 18 '13 at 18:08
    
@Darth: If the target address is within 10.10.0.*, then I would hope that the OP would not so emphatically call it a “public IP address.” Still, … –  Scott Apr 18 '13 at 18:53
show 3 more comments

1 Answer 1

up vote 0 down vote accepted

I think I solved the problem. Unfortunately, I don't know which of the two things I did solved it.

First I added one more interface from a different subnet (10.10.8.51), changed the NAT server IP address (10.10.8.200) and sent all the default traffic through that interface.

Secondly, I discovered that the NAT server did ICMP redirect so I disabled the accepting of redirects. I actually think that this caused my problem, but I did not have time to test it on the staging env.

# sysctl -w net.ipv4.conf.eth2.accept_redirects = 0
# sysctl -w net.ipv4.conf.eth2.send_redirects = 0

# sysctl -w net.ipv6.conf.eth2.accept_redirects = 0
# sysctl -w net.ipv6.conf.eth2.send_redirects = 0
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.