0

I currently have a workstation set up with two NICs on separate networks.

My current setup is this:

eth0: LAN
eth1: Outside internet

I have a default gateway set up on eth1 to reach the outside internet. I also have a route in place to set the default gateway for the LAN on eth0. I can browse the internet as well as reach the local LAN with no problems. The issue I'm having is that when I try to access the Ubuntu machine from another machine on the LAN, the packets are coming in on eth0 but leaving on eth1. How can I set up a rule that ensures that all traffic for the LAN subnet ignores eth1?

3
  • How do you know it's going out the wrong Ethernet port? Please add in some detail on what the networks look like and what your routing table is. Mar 23, 2016 at 17:58
  • Possible duplicate of Separate Network Traffic on Two Network Interfaces Oct 7, 2019 at 18:03
  • Can you add this information to the question? ip addr show; ip route show (feel free to edit out an IP if it's public). Then from what IP are you trying to send traffic that you say is being replied though a different interface from what you expect?
    – eftshift0
    Dec 1, 2021 at 0:06

2 Answers 2

1

By setting a second default gateway on eth0, you're effectively claiming that you can reach the entirety of Internet through eth0. Since this is not actually true, this false claim will cause problems for you.

Apparently, your default gateway route on eth0 is placed after the default gateway route on eth1 in the routing table. Routing table entries are sorted primarily by specificity (i.e. by decreasing netmask length), and secondarily by the metric value. Default gateway routes have a netmask length of /0 by definition, and so only the metric value may influence their sorting order.

Whenever you have more than one network interface, your routing table configuration should reflect the actual topology of your network. If all the Internet is not reachable through your eth0 interface, setting a default gateway entry for it is the wrong thing to do. The system should automatically set up a route entry covering the systems that are directly accessible by each network interface, so if your LAN does not include multiple network segments, you might not need to do anything.

You should only set a default gateway entry for interface(s) that can actually reach the internet; for interfaces connecting only to your own LAN, it is perfectly legitimate to leave their default gateway entries unset.

If your LAN includes multiple network segments, then you may need to add more specific routes for them. For example: if eth0 is connected to network segment 192.168.1.0/24 and there is another LAN segment 192.168.2.0/24 beyond it, reachable through router 192.168.1.1, then you would need to configure a route like this:

ip route add 192.168.2.0/24 via 192.168.1.1 dev eth0

or like this using the now-obsolete route command:

route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.1

Basically, you identify the network segment (or combination of segments) reachable using a specific router/gateway system. The gateway system itself must be directly reachable; normally you cannot specify greater-order routes ("go to that router, then from there to this other router...") because once you send the packets to one router, it will decide (using its own routing table) what should happen to the packet next.

If your LAN is composed of many network segments (possibly reachable through different routers/gateways), you may have to write several route entries to specify how to reach all the parts of it. This is fundamentally what the routing table is really for; systems with just one NIC are just the simplified degenerate case.

0

if you do not have network route for your LAN side, use this command to create one:

/sbin/route add -net 192.168.1.0/24 192.168.1.1 dev eth0

this assumes your local area network addresses are between 192.168.1.1 and 192.168.1.255 and 192.168.1.1 is your router's IP address. Your netmask is 255.255.255.0. If these are any different you will need to modify these addresses.

You must log in to answer this question.