I have a linux server with three interfaces - one for net, two internal, below are shown the internal ones:

inet addr:

inet addr:

Have one internal work machine with gate and ip from that subnet and other with gate and ip from its subnet. I need to be able to have access between those machines.

On the linux box I have the following routing table:

default via * dev eth0 dev eth2  proto kernel  scope link  src
* dev eth0  proto kernel  scope link  src * dev eth1  proto kernel  scope link  src

I added a static route:

route add -net netmask gw

and the result via dev eth1 scope link

but when I try to ping from eth1 an up and running interface it always gives destination host unreachable. What am I missing as configuration?

The basic setup is shown here:

enter image description here

When I ping from eth1

ping -I eth1
PING ( from eth1: 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable

and when I ping from eth2:

ping -I eth2
PING ( from eth2: 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.547 ms
  • 1
    So you want traffic to to got out of eth1 via gateway Is that correct? That's what you've said and what your routing table implies. What then, is the point of the eth2 connection? – Darren Sep 4 '17 at 10:43
  • licensing demand unfortunately..it needs primary address from that range, for evaluation purposes – modzozo Sep 4 '17 at 11:00
  • So is there a route from to the subnet? From the OP: "...other with gate and ip from its subnet." so it sounds like there isn't. – Darren Sep 4 '17 at 11:02
  • I need to add that with ip rule? – modzozo Sep 4 '17 at 11:17
  • Depends on what device that gateway is. Is there even a physical connection from that gateway device to the subnet. Might help if you can post a network diagram. – Darren Sep 4 '17 at 11:21

As per your network diagram, there is no physical link from the device to the network so there is no way on Earth you should expect to get a response when you ping out of eth1. The only way to ping successfully is for the ping request to go out of eth2.

If you really need this to work, the solution is to connect to and create a route. How you do this depends on the nature of the two boxes. If they're servers they might have a second network port you can connect up (and configure appropriately). If they don't have a second network interface then you are probably out of luck without completely changing your network configuration. My suggestion, as you are probably in a bit of an XY problem, is to post a new question describing what you need to achieve, not how you are trying to achieve it.

  • Thanks Darren, should we simply re-use this thread rather than start a new one. – modzozo Sep 4 '17 at 13:38
  • @modzozo. No, that's not how this site works, it's not a forum. This is one question. If you want to ask something else, ask a new question (although by all means link to this one). – Darren Sep 4 '17 at 13:42

You do not need another route to allow users of the private subnets to communicate. You only need the following commands:

iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth1 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

The first two commands tell the firewall to allow traffic to flow between the two private subnets, and the third command does the same at the kernel level. You need both.

That's all.

  • OK, this has allowed traffic to pass across the interfaces, but the OP is specifically trying to ping the 10... subnet via the 192... device on eth1. How does this allow them to do that? The OP hasn’t actually explained why they need to do this or what they are trying to achieve. – Darren Sep 5 '17 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.