1

EDIT: I have 2 machine setup, Machine A only has internet connection, Machine B ens192 interface connects directly with Machine A interface ens192.

So configured iptables in MachineA to make sure Machine B also has the connectivity. ping to ip address works but domain name fails. Below provided each machine network config details.

Machine A:

Network config:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:11:8a:1a brd ff:ff:ff:ff:ff:ff
    inet 20.1.1.27/24 brd 20.1.1.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::88f2:48b:daef:7b0d/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:1a:4b:09 brd ff:ff:ff:ff:ff:ff
    inet 192.168.43.67/24 brd 192.168.43.127 scope global noprefixroute ens224
       valid_lft forever preferred_lft forever
    inet6 fe80::65cb:5a44:210b:1ef3/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

I have configured iptables NAT to allow packet comes from private network interface(ens192) to reach other interface(ens224) for intenet connectivity. Below is the config used.

iptables --table nat --flush
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface ens224 -j MASQUERADE
iptables --append FORWARD --in-interface ens192 -j ACCEPT

Machine B:

After configuring NAT rules in Machine A, Now able to ping 8.8.8.8 or any IP address from machine B, but unable to resolve any hostname.

[root@localhost ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=1.78 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=1.90 ms

[root@localhost ~]# ping google.com
ping: google.com: Name or service not known

Network config:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:11:23:3a brd ff:ff:ff:ff:ff:ff
    inet 20.1.1.201/24 brd 20.1.1.255 scope global noprefixroute dynamic ens192
       valid_lft 15108sec preferred_lft 15108sec
    inet6 fe80::250:56ff:fe11:233a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

ip route:

[root@localhost ~]# ip route
default via 20.1.1.27 dev ens192 proto dhcp metric 100 
20.1.1.0/24 dev ens192 proto kernel scope link src 20.1.1.201 metric 100

resolv.conf

[root@localhost ~]# more /etc/resolv.conf 
# Generated by NetworkManager
nameserver 9.9.9.9
nameserver 20.1.1.27

How to resolve this issue?

Improve this question
3
  • Is 20.1.1.27 actually running a nameserver? (You've not mentioned this anywhere.) If it's not, there's no point including it in the /etc/resolv.conf configuration
    – Chris Davies
    Sep 9, 2019 at 13:22
  • 1
    @roaima 9.9.9.9 is quad9 dns address. 20.1.1.27 is the IP address of Machine A interface that receives incoming traffic from Machine B. I have removed it and kept only 9.9.9.9 and also tried 8.8.8.8 , still getting Name or service not known error
    – Mohan
    Sep 9, 2019 at 14:11
  • Ah. I wasn't aware of Quad9 - thank you for the pointer.
    – Chris Davies
    Sep 9, 2019 at 15:32

1 Answer 1

Reset to default
0

IP connection from Machine B seems to be working.

I would test if DNS servers under resolf.conf are valid.

fping 9.9.9.9
fping 20.1.1.27

Check if DNS returs any data.

nslookup google.com 9.9.9.9
nslookup google.com 20.1.1.27
nslookup google.com 8.8.8.8
host google.com 8.8.8.8

Check also iptables:

/sbin/iptables -t nat -A POSTROUTING -o ens224 -j MASQUERADE
/sbin/iptables -A FORWARD -i ens224 -o ens192 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i ens192 -o ens224 -j ACCEPT
Improve this answer
3
  • fping and nslookup is not installed in my CentOS machine, so cant check it. Do I have to configure the iptables you have provided above in Machine B? Thanks..
    – Mohan
    Sep 10, 2019 at 9:29
  • So try ping instead of fping. If there is no nslookup, host should be there. iptabkes is just for configuration on machine you have a internet, machine A.
    – Lukáš Viktora
    Sep 10, 2019 at 19:49
  • ping to 9.9.9.9 and 20.1.1.27 is working fine. host google.com 8.8.8.8 - throws "connection timed out no servers could be reached". I have provided the iptables configured on the MachineA in the original post. Is that correct?
    – Mohan
    Sep 13, 2019 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .