4

As seen below, Linux(3.7-trunk-686-pae) keeps route to 10.10.12.64/28 in routing table although the interface is physically down:

root@kali:~# ip addr show dev eth0
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether b4:99:ba:57:7c:5f brd ff:ff:ff:ff:ff:ff
    inet 10.10.12.77/28 scope global eth0
root@kali:~# ip route show dev eth0
10.10.12.64/28  proto kernel  scope link  src 10.10.12.77 
root@kali:~# ip route get 10.10.12.69
10.10.12.69 dev eth0  src 10.10.12.77 
    cache 
root@kali:~# 

Route is removed from the routing table if I disable the interface administratively("ip link set dev eth0 down").

What is the purpose to keep the route in routing table while the interface itself is physically down? For example if the more-specific route 10.10.12.64/28 would not be present while the interface is down, then the traffic could be sent to less-specific route(for example 0.0.0.0/0) to another interface which is up.

  • If you want dynamic routing, run a dynamic routing daemon and tell it the rules. This is beyond the scope of static routing. – BowlOfRed Dec 19 '14 at 19:13
3

There is no guarantee that another interface will route the traffic appropriately. Even if it does route to a device at the specified address, the device may not be the intended device. There are a number of issues which could arise:

Changing the routing to another interface may inflict NAT rules on the traffic, which would break connections when the interface comes up.

For private IP address ranges such as specified in the question, the interface may connect to another organization with an entirely different network. The local 10.0.0.0/8 network would be an inappropriate place to route such traffic. Even in the same organization, the block may be a test network replicating a production network.

For addresses which can be routed over the Internet, there may be security reasons not to route traffic over the Internet. Although it is not recommended, it is possible to use local routing to route traffic which should be kept secure. While it would be best to encrypt the traffic, in some cases this may be difficult to do.

2

My best suggestion would be to use netplug - http://www.red-bean.com/~bos/

Just use this to run

 ip link set eth0 down

when the cable is unplugged. And the reverse when it comes back up.

This is fine for a machine which is purely a router. But if the machine has other services, then these services would have to be bound to internal IP addresses.

  • Services can just listen on the wildcard address; this is generally the default as it avoids the need to configure it before starting. (Though how you find the service is a different matter, if there are multiple IPs which might or might not be reachable). – sourcejedi Aug 27 '15 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.