2

I'm configuring CentOS 7 networking in a server with 2 nic. Network iterfaces are:

  • em1 which should be connected to a local network by DHCP, IP: 192.168.0.240 Gateway: 192.168.0.2 Masq.: 255.255.255.0.

    Its config script is /etc/sysconfig/network-scripts/ifcfg-em1:

TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="dhcp"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="yes"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="em1"
DEVICE="em1"
ONBOOT="yes"
IPV6_PRIVACY="no"
  • em2 which should be connected to the internet with static ip IP: 179.94.94.83 Gateway: 179.94.94.81 Masq.: 255.255.255.248

    Its config script is /etc/sysconfig/network-scripts/ifcfg-em2:

TYPE=Ethernet
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=em2
DEVICE=em2
ONBOOT=yes
IPADDR=179.94.94.83
GATEWAY=179.94.94.81
DNS1=200.40.30.245
DNS2=200.40.220.245
PROXY_METHOD=none
BROWSER_ONLY=no
PREFIX=29

The problem:

The problem is when both nics (em1 & em2) are connected I can connect using IP 192.168.0.240 but I don't have access using IP 179.94.94.83 or vice versa, depending which one is first plugged, but if only one of them is connected the corresponding IP works normally.

I've been reading:

but I couldn't find a solution. Here the author refers to NAT configuration http://jensd.be/468/linux/two-network-cards-rp_filter#comment-15119 but anyway I cannot make both connections work simultaneously.

To clear thing up:

1 NIC1 should have a local static IP like 192.168.x.x and NIC2 should have the external static IP 179.x.x.x.

2 It would be great if we could access different services through different networks, ie. SSH using LAN only and HTTP using both (open to the Internet and LAN)

  • My guess is that your problem is that you have a default route on both interfaces. Remove the default route on the interface connected to the local network. – Johan Myréen Apr 1 at 6:59
1

You don't have to give up DHCP. You can instruct the startup scripts to disable the default route, even if obtained in the reply from the DHCP server. This allows you to keep a valid active lease on the DHCP server and retrieve other useful informations provided by DHCP, while allowing you to have a default gateway set elsewhere.

Just change the DEFROUTE parameter to:

DEFROUTE=no

in /etc/sysconfig/network-scripts/ifcfg-em1 and restart network (or just ifdown em1; ifup em1).

Found by studying /etc/sysconfig/network-scripts/ifup-eth and then at Redhat (although it only mentions its usage along NetworkManager, it works with and without it):
4.6. Configuring the Default Gateway

In dynamic network environments, where mobile hosts are managed by NetworkManager, gateway information is likely to be interface specific and is best left to be assigned by DHCP. In special cases where it is necessary to influence NetworkManager's selection of the exit interface to be used to reach a gateway, make use of the DEFROUTE=no command in the ifcfg files for those interfaces which do not lead to the default gateway.

Note that on CentOS if the parameter NM_CONTROLLED=no is not set, and NetworkManager is installed, which is probably your case seing the extra parameters, NetworkManager will (usually nicely) interact with sysconfig scripts and will build an equivalent setting from the same file. It's then advised to do a nmcli c reload after a direct change on the file.

The equivalent change can also be achieved from NetworkManager's side, once you determine the id or uuid naming used for the interface (here choosing to have it being named System em1 by NetworkManager).

nmcli c modify id 'System em1' ipv4.never-default yes

which will automatically position DEFROUTE=no in /etc/sysconfig/network-scripts/ifcfg-em1. Cycling down/up the interface is still required.

You might also have to consider disabling DHCP's DNS servers and override it with "static" DNS parameters, although there is no good solution provided by the network scripts if you need both internal and external DNS resolutions at the same time (you'd then probably require a custom local DNS server or similar solution), so ponder if this can help or not:

PEERDNS=no

This parameter appears to work fine only when under NetworkManager's control, in tests I made, apparently it had no effect without, because DNS was set directly in /etc/resolv.conf by dhclient rather than being "integrated" by NM first. If that's really your case (no NetworkManager and not wanting it), then the other answer available might be better suited.

Likewise there's the equivalent NetworkManager ipv4.ignore-auto-dns (as well as ipv6.ignore-auto-dns matching IPV6_PEERDNS= ) property exposed.

  • Thank you @A.B. I just followed your advice and set DEFROUTE=no in /etc/sysconfig/network-scripts/ifcfg-em1 and left DEFROUTE=yesin /etc/sysconfig/network-scripts/ifcfg-em2. Also both IPs get assigned by the DHCP server ;-) – Damon Hill Apr 2 at 15:24
1

You still have DHCP in your config.

Your /etc/sysconfig/network-scripts/ifcfg-em1 script should look like:

DEVICE=em1
BOOTPROTO=static
DHCPCLASS=
IPADDR=192.168.0.240
NETMASK=255.255.255.0
BROADCAST=192.168.0.255
NETWORK=192.168.0.0
ONBOOT=yes

Your /etc/sysconfig/network-scripts/ifcfg-em2 should be similar:

DEVICE=em2
BOOTPROTO=static
DHCPCLASS=
IPADDR=179.94.94.83
NETMASK=255.255.255.248
BROADCAST=179.94.94.87
NETWORK=179.94.94.80
ONBOOT=yes

Additionally add the following line to /etc/sysconfig/network or edit the existing GATEWAY line:

GATEWAY=179.94.94.81

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.