1

EDIT: I have 2 machine setup, Machine A only has internet connection, Machine B ens192 interface connects directly with Machine A interface ens192.

So configured iptables in MachineA to make sure Machine B also has the connectivity. ping to ip address works but domain name fails. Below provided each machine network config details.

Machine A:

Network config:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:11:8a:1a brd ff:ff:ff:ff:ff:ff
    inet 20.1.1.27/24 brd 20.1.1.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::88f2:48b:daef:7b0d/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:1a:4b:09 brd ff:ff:ff:ff:ff:ff
    inet 192.168.43.67/24 brd 192.168.43.127 scope global noprefixroute ens224
       valid_lft forever preferred_lft forever
    inet6 fe80::65cb:5a44:210b:1ef3/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

I have configured iptables NAT to allow packet comes from private network interface(ens192) to reach other interface(ens224) for intenet connectivity. Below is the config used.

iptables --table nat --flush
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface ens224 -j MASQUERADE
iptables --append FORWARD --in-interface ens192 -j ACCEPT

Machine B:

After configuring NAT rules in Machine A, Now able to ping 8.8.8.8 or any IP address from machine B, but unable to resolve any hostname.

[root@localhost ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=1.78 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=1.90 ms

[root@localhost ~]# ping google.com
ping: google.com: Name or service not known

Network config:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:11:23:3a brd ff:ff:ff:ff:ff:ff
    inet 20.1.1.201/24 brd 20.1.1.255 scope global noprefixroute dynamic ens192
       valid_lft 15108sec preferred_lft 15108sec
    inet6 fe80::250:56ff:fe11:233a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

ip route:

[root@localhost ~]# ip route
default via 20.1.1.27 dev ens192 proto dhcp metric 100 
20.1.1.0/24 dev ens192 proto kernel scope link src 20.1.1.201 metric 100

resolv.conf

[root@localhost ~]# more /etc/resolv.conf 
# Generated by NetworkManager
nameserver 9.9.9.9
nameserver 20.1.1.27

How to resolve this issue?

3
  • Is 20.1.1.27 actually running a nameserver? (You've not mentioned this anywhere.) If it's not, there's no point including it in the /etc/resolv.conf configuration – roaima Sep 9 '19 at 13:22
  • 1
    @roaima 9.9.9.9 is quad9 dns address. 20.1.1.27 is the IP address of Machine A interface that receives incoming traffic from Machine B. I have removed it and kept only 9.9.9.9 and also tried 8.8.8.8 , still getting Name or service not known error – Mohan Sep 9 '19 at 14:11
  • Ah. I wasn't aware of Quad9 - thank you for the pointer. – roaima Sep 9 '19 at 15:32
0

IP connection from Machine B seems to be working.

I would test if DNS servers under resolf.conf are valid.

fping 9.9.9.9
fping 20.1.1.27

Check if DNS returs any data.

nslookup google.com 9.9.9.9
nslookup google.com 20.1.1.27
nslookup google.com 8.8.8.8
host google.com 8.8.8.8

Check also iptables:

/sbin/iptables -t nat -A POSTROUTING -o ens224 -j MASQUERADE
/sbin/iptables -A FORWARD -i ens224 -o ens192 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i ens192 -o ens224 -j ACCEPT
3
  • fping and nslookup is not installed in my CentOS machine, so cant check it. Do I have to configure the iptables you have provided above in Machine B? Thanks.. – Mohan Sep 10 '19 at 9:29
  • So try ping instead of fping. If there is no nslookup, host should be there. iptabkes is just for configuration on machine you have a internet, machine A. – Lukáš Viktora Sep 10 '19 at 19:49
  • ping to 9.9.9.9 and 20.1.1.27 is working fine. host google.com 8.8.8.8 - throws "connection timed out no servers could be reached". I have provided the iptables configured on the MachineA in the original post. Is that correct? – Mohan Sep 13 '19 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.