14

I set up 3 CentOS servers, configured server2 as router between 192.168.1.0/24 and 30.0.0.0/24, but ping can't get through.

I tried ping 192.168.1.62 from server1, according to tcpdump on server3, ICMP request is received, but it doesn't generate ICMP response.

23:36:06.436243 IP 30.0.0.2 > 192.168.1.62: ICMP echo request, id 23570, seq 2838, length 64
23:36:07.436212 IP 30.0.0.2 > 192.168.1.62: ICMP echo request, id 23570, seq 2839, length 64

Setup

Servers

  • server1:

    • eth0 - 30.0.0.2

  • server2:

    • eth0 - 192.168.1.61
    • eth0:0 - 30.0.0.1

  • server3:

    • eth0 - 192.168.1.62
Routing

  • route info on server1:

    • 0.0.0.0 30.0.0.1

  • route info on server3:

    • 30.0.0.0/24 192.168.1.61
slm
  • 15,396
  • 12
  • 109
  • 124
Robby
  • 159
  • 1
  • 1
  • 5

2 Answers2

23

I was receiving ICMP packets but did not see them go out. The problem was related to the traffic traversing multiple interfaces and reverse path filtering being on by default...

I've enabled martian source logging first:

$ echo 1 >/proc/sys/net/ipv4/conf/eth2/log_martians

Then there are several options for what to do with them... I'm enabling loosely handling them:

$ sysctl net.ipv4.conf.all.rp_filter=2

See these for details:

slm
  • 15,396
  • 12
  • 109
  • 124
AXE Labs
  • 4,051
  • 4
  • 29
  • 29
  • Thank you!!! The redhat link in particular was very helpful. In my case, I had a server with interfaces on VLAN10 and 1000, and addresses on each subnet. I had a laptop on VLAN10 that could ping the server's VLAN10 address (directly connected), but not on VLAN1000 (through a router). Turns out the server was dropping packets received from VLAN10 addresses on VLAN1000. The laptop started seeing ping replies the instant I changed /proc/sys/net/ipv4/conf/VLAN1000/rp_filter to "02". – rjb1290 Dec 04 '16 at 06:26
7

Run tcpdump with -e flag and see if the destination MAC address is correct.

FoamyBeer
  • 221
  • 5
  • 7