2

I have a linux server with three interfaces - one for net, two internal, below are shown the internal ones:

eth1
inet addr:192.168.10.253
Bcast:192.168.255.255
Mask:255.255.0.0

eth2
inet addr:10.10.10.253
Bcast:10.10.10.255
Mask:255.255.255.0

Have one internal work machine with gate 192.168.10.253 and ip from that subnet and other with gate 10.10.10.253 and ip from its subnet. I need to be able to have access between those machines.

On the linux box I have the following routing table:

default via * dev eth0
10.10.10.0/24 dev eth2  proto kernel  scope link  src 10.10.10.253
* dev eth0  proto kernel  scope link  src *
192.168.10.0/16 dev eth1  proto kernel  scope link  src 192.168.10.253

I added a static route:

route add -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.10.253

and the result

10.10.10.0/24 via 192.168.10.253 dev eth1 scope link

but when I try to ping from eth1 an up and running interface 10.10.10.2 it always gives destination host unreachable. What am I missing as configuration?

The basic setup is shown here:

enter image description here

When I ping from eth1

ping 10.10.10.2 -I eth1
PING 10.10.10.2 (10.10.10.2) from 192.168.10.253 eth1: 56(84) bytes of data.
From 192.168.10.253 icmp_seq=1 Destination Host Unreachable

and when I ping from eth2:

ping 10.10.10.2 -I eth2
PING 10.10.10.2 (10.10.10.2) from 10.10.10.253 eth2: 56(84) bytes of data.
64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=0.547 ms
  • 1
    So you want traffic to 10.10.10.0/24 to got out of eth1 via gateway 192.168.10.253. Is that correct? That's what you've said and what your routing table implies. What then, is the point of the eth2 connection? – Darren Sep 4 '17 at 10:43
  • licensing demand unfortunately..it needs primary address from that range, for evaluation purposes – modzozo Sep 4 '17 at 11:00
  • So is there a route from 192.168.10.253 to the 10.10.10.0/24 subnet? From the OP: "...other with gate 10.10.10.253 and ip from its subnet." so it sounds like there isn't. – Darren Sep 4 '17 at 11:02
  • I need to add that with ip rule? – modzozo Sep 4 '17 at 11:17
  • Depends on what device that gateway is. Is there even a physical connection from that gateway device to the 10.10.10.0/24 subnet. Might help if you can post a network diagram. – Darren Sep 4 '17 at 11:21
1

As per your network diagram, there is no physical link from the 192.168.10.253 device to the 10.10.10.0/24 network so there is no way on Earth you should expect to get a response when you ping 10.10.10.2 out of eth1. The only way to ping 10.10.10.2 successfully is for the ping request to go out of eth2.

If you really need this to work, the solution is to connect 192.168.10.253 to 10.10.10.2 and create a route. How you do this depends on the nature of the two boxes. If they're servers they might have a second network port you can connect up (and configure appropriately). If they don't have a second network interface then you are probably out of luck without completely changing your network configuration. My suggestion, as you are probably in a bit of an XY problem, is to post a new question describing what you need to achieve, not how you are trying to achieve it.

  • Thanks Darren, should we simply re-use this thread rather than start a new one. – modzozo Sep 4 '17 at 13:38
  • @modzozo. No, that's not how this site works, it's not a forum. This is one question. If you want to ask something else, ask a new question (although by all means link to this one). – Darren Sep 4 '17 at 13:42
0

You do not need another route to allow users of the private subnets to communicate. You only need the following commands:

iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth1 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

The first two commands tell the firewall to allow traffic to flow between the two private subnets, and the third command does the same at the kernel level. You need both.

That's all.

  • OK, this has allowed traffic to pass across the interfaces, but the OP is specifically trying to ping the 10... subnet via the 192... device on eth1. How does this allow them to do that? The OP hasn’t actually explained why they need to do this or what they are trying to achieve. – Darren Sep 5 '17 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.