0

I have two subnets S1 (10.3.0.0/24) and S2 (10.3.120.0/24) and two CentOS 7.6 machines A and B. Machine A two NICs, one for each subnet with ip addresses 10.3.0.4 on eth0 for S1 and 10.3.120.254 on eth1 for S2. Machine B has only one NIC for Subnet S2 with the IP 10.3.120.4. When I ping Machine A's IP address 10.3.120.254 from Machine B, I get a response (because they are in the same subnet). But when I ping Machine A's IP 10.3.0.4 from Machine B, there is no response.

These are the routes on Machine A

[me@MachineA ~]$ ip route show
default via 10.3.0.1 dev eth0 proto dhcp metric 100 
10.3.0.0/24 dev eth0 proto kernel scope link src 10.3.0.4 metric 100 
10.3.120.0/24 dev eth1 proto kernel scope link src 10.3.120.254 metric 101

And these are the routes on Machine B.

[me@MachineB ~]$ ip route show
default via 10.3.120.254 dev eth0 
10.3.120.0/24 dev eth0 proto kernel scope link src 10.3.120.4 metric 100 

Some more information, firewalld is running on Machine A but not on Machine B. This is the firewalld configuration on Machine A.

[me@MachineA ~]$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth1 eth0
  sources: 
  services: ssh dhcpv6-client
  ports: 
  protocols: 
  masquerade: yes
  forward-ports:
  source-ports: 
  icmp-blocks: echo-reply
  rich rules:

What I wanted to know is what am I missing here? Why is there a response when I ping to 10.3.120.254 but not when I ping 10.3.0.4 although they are two different IP addresses of the same machine and the default route on Machine B should be forwarding the packet to Machine A?

EDIT: This is the IP setup on Machine A.

[me@MachineA ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:3a:a3:6f:74 brd ff:ff:ff:ff:ff:ff
    inet 10.3.0.4/24 brd 10.3.0.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:3aff:fea3:6f74/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:3a:09:0a:13 brd ff:ff:ff:ff:ff:ff
    inet 10.3.120.254/24 brd 10.3.120.255 scope global noprefixroute eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::8fd2:7210:82b3:d056/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

and this is the IP configuration on Machine B

[me@MachineB ~]$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0d:3a:09:38:1f brd ff:ff:ff:ff:ff:ff
    inet 10.3.120.4/24 brd 10.3.120.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20d:3aff:fe09:381f/64 scope link 
       valid_lft forever preferred_lft forever

EDIT2: I tried adding the route

ip route add 10.3.0.0/24 via 10.3.120.254 dev eth0

and it still didn't work

EDIT3: I can ping Machine B from Machine A and packet forwarding is enabled on Machine A.

[me@MachineA ~]$ cat /proc/sys/net/ipv4/ip_forward
1
  • 1
    Not familiar with firewalld, but icmp-blocks: echo-reply will block answers to pings (which is exactly what you are experiencing), and masquerade: yes which I assumes means NAT can cause all sort of trouble with routing, depending on what it actually does. Try deactivating the firewall completely and see if it works. If it does, you've found the culprit. – dirkt Oct 18 '19 at 11:03
  • Well, I cannot deactivate the firewall since I need it to do some basic port forwarding. I tried removing the icmp-blocks: echo-reply value but it still does not work. – thisisshantzz Oct 19 '19 at 1:47
  • You certainly can deactivate the firewall to test if the firewall is the culprit, or if it's anything else. If it turns out to be the firewall, then you've reduced the problem to "how do I configure the firewall to allow port forwarding, but doesn't block things I do need". Debugging works by partitioning the problem until you've found out where it is. "Guessing" doesn't work, you need to test your hypothesis. – dirkt Oct 19 '19 at 6:25
0

You can have a try to add a route to B, which tells B that:

go to subnet 10.3.0.0/24 via 10.3.120.254

  • You mean something like ip route add 10.3.0.0/24 via 10.3.120.254 dev eth0? I did that and it still does not work. – thisisshantzz Oct 18 '19 at 10:01
  • You can start a tcpdump on A to see if the specific icmp packet arrives A – Shellmode Oct 18 '19 at 10:03
  • I can see that the ping request arrives at Machine A. The tcpdump output contains the following two lines ARP, Request who-has 10.3.120.4 tell MachineA, length 28 and ARP, Reply 10.3.120.4 is-at 12:34:56:78:9a:bc (oui Unknown), length 28. Could the firewall be the one blocking the routing? – thisisshantzz Oct 18 '19 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.