Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a Gentoo Linux server. Server is connected to two networks: internal and external.

Internal network ip: 192.168.1.200
External network ip: 192.168.0.2

If I'm trying to make request from server to itself, it uses external network IP. Connecting to nginx using Wget gives me this log record:

server ~ # tail -n 1 /var/log/nginx/error_log
192.168.0.2 - - [27/Aug/2014:19:04:42 +0300] "GET / HTTP/1.1" 200 5 "-" "Wget/1.14 (linux-gnu)"

Despite that I connecting directly to 192.168.1.200:

server ~ # wget http://192.168.1.200/

Routing table (metric is higher on external network, but seems ignored): ip route show

server ~ # ip route
192.168.0.0/30 dev wan  scope link  metric 20 
192.168.1.0/24 dev lan  scope link  metric 10 

ip route get:

server ~ # ip route get 192.168.1.200
local 192.168.1.200 dev lo  src 192.168.1.200 
    cache <local> 

How can I get this machine to connect using 192.168.1.200 to itself, instead of 192.168.0.2?

share|improve this question
4  
Do you have any iptables rules? iptables -t nat -nvL. If you've got a MASQUERADE or SNAT rule that is too broad, that can cause this. –  Patrick Aug 27 at 16:19
1  
You saved my day! Thank you vm. I completely forgot that I'm behind NAT'ed network. Sorted this out! –  Greshnik Aug 27 at 16:57

2 Answers 2

If you have this problem with every program you run, you should check your server firewall rule. Make sure that it only use NAT for external destination. Your route table make no sense if you have a wide NAT rule.

After fixing firewall rule, for wget, you can use --bind-address option to chose what interface you want to use:

wget --bind-address=192.168.1.200 http://192.168.1.200/

From wget documentation:

‘--bind-address=ADDRESS’

When making client TCP/IP connections, bind to ADDRESS on the local machine. ADDRESS may be specified as a hostname or IP address. This option can be useful if your machine is bound to multiple IPs.

You can use a .wgetrc file to make this permanent.

share|improve this answer
1  
Good point, thanks. But I have problems with EVERY program I use, not only wget. –  Greshnik Aug 27 at 16:53
1  
@Greshnik: I update answer with a more details. If you can give use your firewall rule, we can make it clearly. –  Gnouc Aug 27 at 17:41

As was mentioned by @Patrick in one of the comments to my question, I was encountering an issue with my iptables NAT rules.

  • eth0: Internal network, 192.168.1.200
  • eth1: External network, 192.168.0.2

My NAT rule was:

$ iptables -t nat -A POSTROUTING ! -o eth0 -j MASQUERADE

That means, that all traffic whose output destination device is not interface eth0 will be masqueraded. The same thing happens with local traffic too, as it comes out from the lo interface.

After fixing iptables NAT rule to:

$ iptables -t nat -A POSTROUTING ! -d 192.168.1.0/24 -j MASQUERADE

My problem was solved!

share|improve this answer
2  
Local traffic can also have 127.0.0.1 (or in general, 127.0.0.0/8) as its destination. It may be easier to masquerade based on where your packet is going, rather than where it isn't. –  Jander Aug 27 at 18:54
    
@Jander, you are definitely right! I need to send all traffic whose destination is not an internal or local network through NAT. Can you, please, give me a right advice on that? –  Greshnik Aug 27 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.