1

I've found several related questions, but none of them seem to be solving my particular problem.

I have a server at 10.a.b.1, and another server at 10.c.d.2. We're in AWS EC2 classic with no control over internal IPs, so the middle octets are different but irrelevant.

Server 2 runs OpenVPN and knows about another network, 10.10.10.0/24. I would like server 1 to be able to reach this network, which will mean updating the routes on server 1 and on the relevant servers on the other network.

In other words, server 1 should send 10.10.10.0/24 traffic to server 2, and servers on the other network should send 10.a.b.1 traffic to server 2. I'm not sure whether server 2 needs any changes, possibly IP forwarding or iptables to actually forward the traffic.

Right now, I'm stuck at server 1:

server1$ ip route add 10.10.10.0/24 via 10.c.d.2 dev eth0

Unfortunately, this fails with: RTNETLINK answers: Network is unreachable.

I can successfully ping and traceroute from server 1 to server 2 at 10.c.d.2, so I'm stumped on why I'm unable to add this route?

Improve this question
7
  • 10.10.10.0 must be in the same subnet as 10.c.d.2. Ideally, c and d need to be 10. Anything other than that, and you'll need to insert a bridge between 10.c.d.2 and 10.10.10.0/24.
    – eyoung100
    Commented Jul 18, 2016 at 23:33
  • 10.10.10.0 definitely is not in the same subnet as 10.c.d.2. Can you share a link or SO writeup on how to set up a bridge? Also, why is it necessary? I can already reach server 2, why can't I route any traffic I want to it?
    – knite
    Commented Jul 18, 2016 at 23:56
  • You can't route any traffic to it, because the server cant "see" it. Is server 2 connected to 10.10.10.0/24 via the running VPN? If so, server 1 needs the same VPN connection. Server 2 is tunneled to 10.10.10.0/24. Creating the same tunnel on Server 1 will remove the need for a Bridge. Read Bridging. Station A ==> Server 1, and Station B ==> Server 2. Bridging Server 1 to Server 2, will allow you to share the VPN tunnel.
    – eyoung100
    Commented Jul 19, 2016 at 0:07
  • If this is an AWS Environment, you need to add a software bridge, only if you choose not to add the VPN to Server 1. See LINUX: Understanding Bridging Interfaces in Linux and Linux BRIDGE-STP-HOWTO - Skip to part 6
    – eyoung100
    Commented Jul 19, 2016 at 0:32
  • You would have to setup another point-to-point VPN to make server2's IP the gateway for 10.10.10.0/24 addresses. It has the be encapsulated somehow, otherwise the network is going to drop/misroute each server's packets before it gets to the other server.
    – Bratchley
    Commented Jul 19, 2016 at 2:52

1 Answer 1

Reset to default
0

10.a.b.1 and 10.c.d.2 are not on the same network, are they?

They might be on the same network if the prefix length is sufficiently short, like /8. You didn't state the prefix length, but I suspect it's not that short and that they are in fact nor on the same network.

The target for a route can only be a next hop on a local link. So you can install a route on servr1 for 10.10.10.0/24 that points to the router that gets traffic one hop closer to server2. But then what will that router do with the traffic? It has to know where to send it (via a route) to get it another step closer to server2. And so on. But you don't control any of those intermediate routers, so you probably cannot do that.

Your best bet if you want to get the traffic from server1 over to server2 (which can then direct it via a local link to 10.10.10.0/24) is to tunnel it. Either create a tunnel (GRE, etc...) between server1 and server2, or, more simply, just create a tunnel between server1 and 10.10.10.0/24.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .