From my PC I can connect to .11.102, but not to .10.102:
ping -c 10 192.168.11.102 # works fine
ping -c 10 192.168.10.102 # 100% packet loss
Scenario 2
Now, if I disable .11.102 on the server (ip link set <dev> down) so that it only has an ip on the .10 subnet, the previously failing ping works fine.
PC: 192.168.11.101/24
Server: 192.168.10.102/24
From my PC:
ping -c 10 192.168.10.102 # now works fine
This is baffling to me… any idea why it might be?
Here’s some additional information:
The two subnets are on different vlans (.10/24 is untagged and .11/24 is tagged 11).
The PC and Server are connected to the same managed switch, which however does nothing “strange” (it just leaves tags as they are on all ports).
The router is connected to the aformentioned switch and set to forward packets between the two subnets (I’m pretty sure how I’ve configured it so, plus IIUC the second scenario ping wouldn’t work without forwarding).
The router also has the same vlan setup, and I can ping both .10.1 and .11.1 with no issue in both scenarios 1 and 2.
In case it may matter, machine 1 has the following routes, setup by networkmanager from dhcp:
default via 192.168.11.1 dev eth1 proto dhcp src 192.168.11.101 metric 410
192.168.11.0/24 dev eth1 proto kernel scope link src 192.168.11.101 metric 410
In case it may matter, Machine 2 uses systemd-networkd and the routes generated from DHCP are slightly different (after dropping the .11.102 address for scenario 2, of course the relevant routes disappear):
default via 192.168.10.1 dev eth0 proto dhcp src 192.168.10.102 metric 100
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.102 metric 100
192.168.10.1 dev eth0 proto dhcp scope link src 192.168.10.102 metric 100
default via 192.168.11.1 dev eth1 proto dhcp src 192.168.11.102 metric 101
192.168.11.0/24 dev eth1 proto kernel scope link src 192.168.11.102 metric 101
192.168.11.1 dev eth1 proto dhcp scope link src 192.168.11.102 metric 101
solution
(please do comment if something here is wrong or needs clarifications - hopefully someone will find this discussion in the future and find it useful)
In scenario 1, packets from the PC to the server are routed through .11.1.
Since the server also has an .11/24 address, packets from the server to the PC (including replies) are not routed and instead just sent directly over ethernet.
Since the PC does not expect replies from a different machine that the one it contacted, they are discarded on arrival.
The solution to this (if one still thinks the whole thing is a good idea), is to route traffic originating from the server and directed to .11/24 via the router.
This could be accomplished with ip route del 192.168.11.0/24, which would however break connectivity with .11/24 adresses (similar reason as above: incoming traffic would not be routed but replies would)…
The more general solution (which, IDK, may still have drawbacks?) is to setup a secondary routing table:
echo 50 mytable >> /etc/iproute2/rt_tables # this defines the routing table
# (see "ip rule" and "ip route show table <table>")
ip rule add from 192.168.10/24 iif lo table mytable priority 1 # "iff lo" selects only
# packets originating
# from the machine itself
ip route add default via 192.168.10.1 dev eth0 table mytable # "dev eth0" is the interface
# with the .10/24 address,
# and might be superfluous
Now, in my mind, that should break connectivity with .10/24 addresses just like ip route del above, but in practice it does not seem to (if I remember I’ll come back and explain why after studying some more)
My guess is that the server receives the packet from the client with src .11.101 dst .10.102 and tries to respond over the interface that has .11.102 assigned.
The client expects a response from src .10.102 and drops the packet.
But I would turn on a packet sniffer in the gateway to see if the returning traffic even passes the Firewall in scenario 1.
It has to do with link priority on the server. You’d imagine that a server that receives a packet that has a return address on the same subnet as it self logically would use that interface instead.
A similar thing happens in switches. For example if you have two vlans on a switch and both vlans have an ip assigned, connect a computer to one of the vlans. You will only be able to reach the switch on the non-routed connection. Even if you also are allowed to reach the second vlan through a router/Firewall.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
My guess is that the server receives the packet from the client with src .11.101 dst .10.102 and tries to respond over the interface that has .11.102 assigned. The client expects a response from src .10.102 and drops the packet. But I would turn on a packet sniffer in the gateway to see if the returning traffic even passes the Firewall in scenario 1.
So the request goes trough but the replies are discarded ? That could actually be it!
I think there was an option to allow that… I’ll search it and give it a try. Thanks!
It has to do with link priority on the server. You’d imagine that a server that receives a packet that has a return address on the same subnet as it self logically would use that interface instead.
A similar thing happens in switches. For example if you have two vlans on a switch and both vlans have an ip assigned, connect a computer to one of the vlans. You will only be able to reach the switch on the non-routed connection. Even if you also are allowed to reach the second vlan through a router/Firewall.