Defining the problem is a little bit complicated. So İ will attempt to draw the case: enter image description here

Number 2 is an ubuntu router(virtual box Vm) with three interfaces. Number 1 is a emulated router, and the number 3 is a remote host behind some routers. When İ ping number-3 from number-1, ping request goes thru 'a' and 'c' path, but reply comes from 'b' path. İn this case number-2 does not route ping reply to number-1, so ping fails. But if ping reply comes from 'c' path, then number-2 routes the reply packet. What is the problem with the first case??

  • Does the packet has the correct IP? Is there a NAT in this scenario? – grochmal Jun 7 '16 at 19:11
  • Also, are there any firewalls in the way? – garethTheRed Jun 7 '16 at 19:57
  • Yes, when i check the packets in either case with tcpdump, ips were right, no NAT and no firewall.. – Salihm Jun 7 '16 at 20:38

This is due to what Linux calls reverse path filtering (see also wikipedia).

Basically if traffic comes from a host on an interface which traffic to the host would not use, the kernel drops the traffic.

Fixing it is simple

sysctl -w net.ipv4.conf.$iface_b.rp_filter=2
sysctl -w net.ipv4.conf.$iface_c.rp_filter=2

Replace $iface_b and $iface_c with the appropriate interface names.

(on older kernels 2 may be unavailable, so use 0)

  • This is exactly what i am looking for. Thanks.. – Salihm Jun 8 '16 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.