Here is the situation :
- VMplayer with 2 physical NICs (network interface cards) on the Windows host
- VM Debian 64bits
- On VM settings: both NICs are configured to replicate on the physical network
- When VM Debian is running, I declared 2 NICs :
ETH0 : 0.0.0.0 (dedicated to snort)
ETH1 : 172.22.0.12 set on dhcp (internet)
ETH0 is up and in promiscuous mode to receive mirroring flow from a switch
ETH1 is using to go to internet
I have some update scripts that must download some data from internet.
They cannot access the network, even if
/etc/resolv.conf is well configured.
Depending tests that I did :
Or I can go to the net, but no capture on snort that listens eth0
Or I cannot go to the internet and snort capture eth0
What is(are) the configuration you think ?
I wish :
ETH0 : 0.0.0.0 : capture the traffic that arriving
ETH1 : dhcp : go to the internet from kernel (root) login for my scripts
Thanks for your help
You need to make sure the default route is via the eth1 interface. For example:
route del default route add default eth1
That will delete the existing default route (if any) and add a new default route via eth1.
You could add those as
post-up commands to the definition of
iface eth1 inet dhcp post-up route del default || true post-up route add default eth1
|| true ensures that the
route del default never returns a failure exit code, even if there is no default route to delete. Without that,
ifup could abort before running the
route add default eth1 command.
The problem came because VMPlayer needs to have a bridge nic and a nat bridge. After this, linux configuration interfaces are as usual.