0

I run several LXC containers on my machine, some of which have their own IP address outside a network shared with the host. This IP address, as well as the corresponding network mask and gateway was provided to me by my ISP. I am using systemd 238 and tried following configuration [1]:

[Match]
Name=enpXsY

[Network]
Address=192.168.0.2/24
Gateway=192.168.0.1
IPForward=yes

[Route]
Destination=10.0.0.64/29
Gateway=10.0.0.65

In the systemd-networkd logs I see following error: Could not set route: Network is unreachable, but I cannot really explain this. If I do not specify a gateway, the kernel can route to this network just fine. Thus I would assume it would also be able to route the traffic to the gateway through this same interface. This does not even work, if I specify a route with Destination=10.0.0.65/32 before the route to 10.0.0.64/29, in order to take the kernel by the hand and explain how to reach that network.

UPDATE: In the meantime I changed the host's network configuration significantly, but these were the IPv4 addresses and routes it was configured with [1]:

# ip -4 address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: enpXsY: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.0.2/24 brd 192.168.0.255 scope global enpXsY
       valid_lft forever preferred_lft forever
4: lxcbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 10.10.10.1/24 brd 10.10.10.255 scope global lxcbr0
       valid_lft forever preferred_lft forever

# ip -4 route
default via 192.168.0.1 dev enpXsY proto static 
192.168.0.0/24 dev enpXsY proto kernel scope link src 192.168.0.2
10.10.10.0/24 dev lxcbr0 proto kernel scope link src 10.10.10.1 

[1]: I translated the actual IP-addresses into similar addresses in non-routed networks for privacy reasons.

1

In the systemd-networkd logs I see following error: Could not set route: Network is unreachable, but I cannot really explain this.

Well this tells you what the actual problem is. You need to have the router within the Subnet of one the IP addresses assigned to any one network interface.

In your case, you have an IP address of 192.168.0.2 with and subnet mask of 24. The gateway is at 192.168.0.1 which should be find as it is within the subnet.

The problem occurs within this section:

[Route]
Destination=10.0.0.64/29
Gateway=10.0.0.65

If you do not have other systemd-networkd configuration files that specify na interface with an IP address within 10.0.0.64/29 systemd-networkd does not know how to reach the gateway of 10.0.0.65. Note that the file names regulate the order in which the files are being processed as they are sorted lexically prior to execution. As I stated above, the gateway has to be next-hop which means that it is within a particular subnet known to the host.

3
  • I also tried ("This does not even work, if ..." in my original post) to explicitly tell the kernel to route traffic for the gateway via this interface: [Route] Destination=10.0.0.65/32 [Route] Destination=10.0.0.64/29 Gateway=10.0.0.65. This did not work, either. Was that just an ordering problem (i.e. the route to the gateway was not yet known when it was being used) or am I missing something else? – devurandom Jul 25 '18 at 15:25
  • 1
    The gateway has to be in one of your subnets, thus route traffic for the gateway via this interface will never work. Can you extend your question with the output of the commands ip -4 addr and ip -4 route, please? – Kevin K. Jul 25 '18 at 17:51
  • Thanks, I get it now. One cannot route arbitrary subnets through arbitrary gateways, because the gateway would have no way to reply to one's packets, if one does not also have an interface using an address from the range of addresses the gateway could reach. – devurandom Jul 26 '18 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.