0

Our sysadmin created for me two CentOS virtual machines, 10.132.67.18 and 10.132.67.19. I can ssh to both of them, but when I try to network them together, I get "no route to host":

root@10.132.67.19:/# ssh 10.132.67.18
ssh: connect to host 10.132.67.18 port 22: No route to host

Interestingly, ping works:

root@10.132.67.19:/#$ ping 10.132.67.18
PING 10.132.67.18 (10.132.67.18) 56(84) bytes of data.
64 bytes from 10.132.67.18: icmp_seq=1 ttl=64 time=0.319 ms
64 bytes from 10.132.67.18: icmp_seq=2 ttl=64 time=0.393 ms

This is the iptables -S on both machines:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 10.128.31.0/24 -j ACCEPT
-A INPUT -s 10.120.0.0/16 -j ACCEPT
-A INPUT -s 10.70.1.32/32 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -s 10.70.1.144/32 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Can it be caused by this? I don't see 10.132.67.18 listed there, and I don't know whether the default is ACCEPT or REJECT, but probably ACCEPT, based on the first lines? I am not an iptables expert....

1
  • Within a "table" the rules are applied in order. Looking at the INPUT, we see established connections are OK, ICMP (which includes ping) are OK, things coming from 10.128.31.x, 10.120.x.x and a couple of UDP things are OK, otherwise they are rejected. This includes things from 10.132.67.{18,19}. Probably best to add more rules to allow 10.132.67.x to communicate.
    – icarus
    Apr 8, 2020 at 0:14

1 Answer 1

1

You don't have any ACCEPT rule for the 10.132.67.X hosts or network, so the ssh connection satisfies the rule j REJECT --reject-with icmp-host-prohibited. That is why you see the no route to host message. Ping is accepted in the -p icmp -j ACCEPT rule, which is applied for all sources.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.