0

I have a destination server where currently my netmask is configured incorrectly as 255.0.0.0. Its correct netmask is 255.255.255.128. My source server is also of /25 network, so both have same subnet mask but both belong to two different vlans.

My question is as follows:

I can successfully connect to my destination server through another server which belongs to a different vlan and IP range like 157..., however, I cannot connect to my destination server from 10.10.126.. Upon traceroute in the destination server, I find that the server checks locally if the source IP belongs to its own local subnet. If it has a misconfigured netmask, why does it allow the ssh connection from 157.* server? How does it do that?

Current wrong configuration:

Destination server: 10.10.127.*  netmask 255.0.0.0

Current right config:

Source server:      10.10.126.*  Mask:255.255.255.128

Testing with tcpdump:

[root@Destination_server ~]# tcpdump -vvv -i eno16780032 host 10.10.126.*
tcpdump: listening on eno16780032, link-type EN10MB (Ethernet), capture size 65535 bytes
21:36:28.403812 IP (tos 0x0, ttl 64, id 48314, offset 0, flags [DF], proto TCP (6), length 60)
    10.10.126.*.60692 > Destination_server.ssh: Flags [S], cksum 0x3c87 (correct), seq 379301407, win 29200, options [mss 1380,sackOK,TS val 495338
91 ecr 0,nop,wscale 7], length 0
21:36:28.403928 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:29.400303 IP (tos 0x0, ttl 64, id 48315, offset 0, flags [DF], proto TCP (6), length 60)
    10.10.126.*.60692 > Destination_server.ssh: Flags [S], cksum 0x3b8d (correct), seq 379301407, win 29200, options [mss 1380,sackOK,TS val 495341
41 ecr 0,nop,wscale 7], length 0
21:36:29.406300 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:30.408295 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:31.405136 IP (tos 0x0, ttl 64, id 48316, offset 0, flags [DF], proto TCP (6), length 60)
    10.10.126.*.60692 > Destination_server.ssh: Flags [S], cksum 0x3998 (correct), seq 379301407, win 29200, options [mss 1380,sackOK,TS val 495346 42 ecr 0,nop,wscale 7], length 0
21:36:35.412611 IP (tos 0x0, ttl 64, id 48317, offset 0, flags [DF], proto TCP (6), length 60)
    10.10.126.*.60692 > Destination_server.ssh: Flags [S], cksum 0x35ae (correct), seq 379301407, win 29200, options [mss 1380,sackOK,TS val 495356 44 ecr 0,nop,wscale 7], length 0
21:36:35.412738 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:36.414276 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:37.416282 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:43.428318 IP (tos 0x0, ttl 64, id 48318, offset 0, flags [DF], proto TCP (6), length 60)
    10.10.126.*.60692 > Destination_server.ssh: Flags [S], cksum 0x2dda (correct), seq 379301407, win 29200, options [mss 1380,sackOK,TS val 495376 48 ecr 0,nop,wscale 7], length 0
21:36:43.428457 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:44.430268 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
21:36:45.432280 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.10.126.* tell Destination_server, length 28
0

Can I reach destination using a third server

In theory.

That third server would have to be in the subnet where your faulty server is located into.

Basically, if the "real" subnet is a /25 (255.255.255.128), and your faulty server IP is 10.10.127.10, then you can connect to anyone between 10.10.127.0 and 10.10.127.125. Those addresses would be in the same network your faulty server is.

Why

There's basically two cases to consider. Assuming your server has an IP, a netmask and a gateway. Omitting DNS resolution. Simplifying, ...

Within a subnet

If you try to reach some host within your network, then the first packet leaving your system would be an ARP, broadcasting with a "who-has my-ip-address" message.

In response, you may receive an "is-at 00:11:22:..." message, returning with your peer hardware address. Then, messages would be sent directly from your host, to the remote.

That first use case only applies for communications within a same LAN (or VLAN).

Remote subnet

Usually, you will try to reach some remote service. If the IP address for your target does not belong to any of your local networks, then your source server would forward its traffic to its default gateway.

Again, we may see some ARP resolution trying to resolve your gateway hardware address (although being your default gateway, its hardware address is probably in your ARP cache already).

From there, either our target belongs to some subnet attached to our router, then we're back to the within-a-subnet case. Otherwise, our router would forward traffic to its gateway.

Why 157.2.3.5 can get in

Well, considering that 157.2.3.5 is not part of 10/8, then its connections would go through your gateway, as usual.

Having configured your server with a /8 instead of a /25, you've basically broken communications between that server and everything that is included in this /8, while not part of your /25. Because your faulty server mistakenly assumes those networks to be local, tries for ARP resolution and won't get any answer.

As long as your remote belongs to 10.10.127.0/25, or anything but 10/8, then you won't have issues connecting.

4
  • Basically the 157.2.3.5 some IP is the server which is able to ssh into the server 10.10.127.10 but the server 10.10.126.10 is not able to do ssh even though this belongs to a different subnet of 10.10.126.0. How netmask comes into play in these both cases given it is misconfigured in destination server 10.10.127.10 – root Nov 13 '19 at 17:03
  • Because having configured 10.10.127.10 with a 255.0.0.0 netmask, and since its real netmask should have been 255.255.255.128, 10.10.127.10 would then have access to nodes within its "real" subnet (10.10.127.0/25), as well as any node not considered as local (everything but 10/8). So it makes sense, that from your server point of view, regardless of that wrong netmask, anything outside of your LAN still works. – SYN Nov 14 '19 at 8:47
  • Thanks SYN for the answer. I did some math with the mask and IP address, and understood the issue. – root Nov 14 '19 at 9:40
  • Wouldn't the range be 10.10.127.1 to 10.10.127.126 and 10.10.127.127 for broadcasting? (you said range would be between 10.10.127.0 and 10.10.127.125 which sounds wrong to me). – Alexis Wilke 12 mins ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.