Here is the situation :
- VMplayer with 2 physical NICs (network interface cards) on the Windows host
- VM Debian 64bits
- On VM settings: both NICs are configured to replicate on the physical network
- When VM Debian is running, I declared 2 NICs :
ETH0 : 0.0.0.0 (dedicated to snort)
ETH1 : 172.22.0.12 set on dhcp (internet)
ETH0 is up and in promiscuous mode to receive mirroring flow from a switch
ETH1 is using to go to internet
I have some update scripts that must download some data from internet.
They cannot access the network, even if
/etc/resolv.conf is well configured.
Depending tests that I did :
Or I can go to the net, but no capture on snort that listens eth0
Or I cannot go to the internet and snort capture eth0
What is(are) the configuration you think ?
I wish :
ETH0 : 0.0.0.0 : capture the traffic that arriving
ETH1 : dhcp : go to the internet from kernel (root) login for my scripts
Thanks for your help
You need to make sure the default route is via the eth1 interface. For example:
route del default route add default eth1
That will delete the existing default route (if any) and add a new default route via eth1.
You could add those as
post-up commands to the definition of
iface eth1 inet dhcp post-up route del default || true post-up route add default eth1
|| true ensures that the
route del default never returns a failure exit code, even if there is no default route to delete. Without that,
ifup could abort before running the
route add default eth1 command.