1

I plugged a second interface in to a server with an existing functional interface(em1). The second interface is configured for a different network, so I created /etc/sysconfig/network-scripts/route-em2 (where em2 is my second NIC) with the following:

[acoder@server ~]# cat /etc/sysconfig/network-scripts/route-em2
111.222.52.0/24 via 111.222.52.2 dev em2

The second configured gateway appears in ip route:

[acoder@server ~]# ip route
111.222.138.0/24 dev em1  proto kernel  scope link  src 111.222.138.214 
111.222.52.0/24 via 111.222.52.2 dev em2 
111.222.52.0/23 dev em2  proto kernel  scope link  src 111.222.52.69 
169.254.0.0/16 dev em1  scope link  metric 1002 
169.254.0.0/16 dev em2  scope link  metric 1003 
default via 111.222.138.2 dev em1 

em2 network config:

DEVICE="em2"
NAME="egna"
IPADDR=111.222.52.69
NETMASK=255.255.254.0
DNS1=111.222.1.1
DNS2=111.222.1.2
TYPE=Ethernet
ONBOOT=yes

Unfortunately, I cannot ping or otherwise access 111.222.52.69.

What do I need to do so that the second interface (em2) works separately from the first (em1)?

  • 1
    netmask 23 or 24: use whichever one matches the network segment to which em2 is attached. Is it getting configuration from dhcp or ifcfg-em2 ? Is the machine 111.222.52.69 configured as 111.222.52.69/23 or 111.222.52.69/24 ? Do things work with no route-em2 (which looks like you're creating a static route to a locally attached segment--a route which should be automatically created anyway) (?) – user4556274 Aug 23 '16 at 18:17
  • I've added the ifcfg-em2 config to the question. – a coder Aug 23 '16 at 18:24
  • This is my first experience using routes - I may be going about this the wrong way. IP's on interface em1 have a different gateway from those on em2. I assume I need routes in this case, no? – a coder Aug 23 '16 at 18:25
  • Your ifcfg-em2 shows a netmask of /23 (255.255.254.0). I cannot say whether 23 or 24 is correct for your network, but it should be consistent; not using /23 in your ifcfg-em2 and /24 in route-em2. In general, you do not need an explicit route for the local network on each interface; as you can see, one is automatically created when the interface comes up. – user4556274 Aug 23 '16 at 18:40
  • 255.255.254.0 is the netmask I was given for the IP on em2. I have more learning to do, I don't quite have a handle on your last sentence. – a coder Aug 23 '16 at 18:46
1

You do not need a route-em2 file for your second interface unless there is a third subnet (i.e. not the subnet configured on em1 or em2) that you want to route to via em2 rather than the existing default gateway accessible via em1.

By configuring 111.222.52.0/23 on em2 like you have done the machine knows to use em2 for all IPs in that subnet. There doesn't need to be another "gateway" for that subnet. The following route proves this:

111.222.52.0/23 dev em2  proto kernel  scope link  src 111.222.52.69 

If after removing the route-em2 file and restarting your network service you cannot ping any 111.222.52.x IPs from the server it points to another issue.

  • Removed the routes-em2 file and restarted. The ifcfg-em2 file does not have a gateway specified (is that correct?). I can ping the em2 gateway using that interface, but am unable to ping anything else (again using the em2 interface). – a coder Aug 27 '16 at 12:48
  • I should add that em1 sits on a LAN and em2 is on a WAN. Since the default gateway is on em1, is WAN (em2) traffic being blocked since it's attempting to pass through a private network (em1 gateway)? – a coder Aug 27 '16 at 12:50
  • OK that makes things clearer. I'm assuming when you say "unable to ping anything else" you mean addresses outside the 11.222.52.0/23 subnet. You want to remove the gateway from the em1 configuration and configure 52.0/23's gateway in the em2 configuration. If the LAN has any additional subnets that you need access to apart from 111.222.138.0/24 you can add a static route for them via a route-em1 file. – root Aug 28 '16 at 4:02
  • Using your suggestion above could I potentially add a route for subnet 111.222.x.x to pass through gateway 111.222.138.2? If I don't hear back by later today I"ll give this a go. Band practice calls.. – a coder Aug 28 '16 at 13:27
  • 111.222.0.0/16 includes both em1 and em2's network so you need to add routes that are more specific for the LAN subnets. – root Aug 31 '16 at 6:19
0

Got this working with some help from this page. Shout out to @user4556274 and @root for their earlier help, even though I wound up taking a little different path.

Here is a network overview:

Existing and works:

em1: private LAN
     IP:      1.1.1.55
     GATEWAY: 1.1.1.1
     NIC #1

Need to add:

em2: public facing WAN
     IP:      2.2.2.88
     GATEWAY: 2.2.2.2
     NIC #2

Existing (working) /etc/sysconfig/network-scripts/ifcfg-em1 network script:

DEVICE=em1
NAME=siteone
HWADDR=$MACADDRESS
IPADDR=1.1.1.55
NETMASK=255.255.255.0
GATEWAY=1.1.1.1
DNS1=3.3.3.1
DNS2=3.3.3.2
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=none

That's what is on the server working now.

I now want to add another network script that is sequestered to the second interface, em2.


I begin by creating network script /etc/sysconfig/network-scripts/ifcfg-em2:

DEVICE=em2
NAME=sitetwo
HWADDR=$MACADDRESS
IPADDR=2.2.2.88
NETMASK=255.255.255.0
GATEWAY=2.2.2.2
DNS1=3.3.3.1
DNS2=3.3.3.2
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=none

Next, I edited /etc/iproute2/rt_tables and added a new line at the bottom (below #1 inr.ruhep). The new line contains 200 CHZBURGR. Make sure you have a tab and not spaces between 200 and CHZBURGR. Btw, the name doesn't have to be CHZBURGR - refer to this route as anything that isn't already in use.

#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
200     CHZBURGR

Next, create a new file called /etc/sysconfig/network-scripts/route-em2 and add the following:

default table CHZBURGR via 2.2.2.2

Note that 2.2.2.2 is the gateway of the second NIC (the public WAN).

Finally, create a rules file called /etc/sysconfig/network-scripts/rule-em2 with the following:

from 2.2.2.88 table CHZBURGR

Now you are ready to restart the network* and test.

service network restart

* I would strongly recommend either being at the physical server's console, or have iDRAC access. If there are any mistakes you might unintentionally be locked out of your system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.