2

I'am looking to set up a configuration on a dual network RHEL8 enterprise machine hosting web services (web server, APIs, gitlab...). The machine has two network interfaces : eno1 for the local network and eno2 for the company network. The objective is to be able to provide WEB services on both networks. The WEB services must also be able to make requests on the WEB but also to other servers on the local or company network.

Next to, is a simplified network diagram where the current server is the "Web server" :

simplified network

Web interfaces configurations :

# eno1 interface
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_DEFROUTE=no
IPV6_FAILURE_FATAL=no
NAME=eno1
UUID=40eefeb5-cf77-4332-9b13-5efff8ca1191
DEVICE=eno1
ONBOOT=yes
IPADDR=192.168.0.4
NETMASK=255.255.255.0
PREFIX=24
GATEWAY=192.168.0.254
IPV4_ROUTE_METRIC=100
# eno2 interface
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_DEFROUTE=no
IPV6_FAILURE_FATAL=no
NAME=eno2
UUID=b0ba0e02-f62a-48bb-95b3-e4411316d102
DEVICE=eno2
ONBOOT=yes
IPV4_ROUTE_METRIC=100

The routing table has been generated automatically (ip route) :

default via 172.26.254.254 dev eno2 proto dhcp src 172.26.0.1 metric 100 
default via 192.168.0.254 dev eno1 proto static metric 100 
172.26.0.0/16 dev eno2 proto kernel scope link src 172.26.0.1 metric 100 
192.168.0.0/24 dev eno1 proto kernel scope link src 192.168.0.4 metric 100 

One last thing before detailing the expected behaviour and the actual behaviour, inter-vlan routing on the local network has been implemented. It takes into account the bidirectional communications on all the ports wanted for the WEB services but also for the ICMP protocol between the machines used in this situation.

What happens :

This is the desired behaviour on NetworkManager starting :

  • Web services are accessible from all servers in VLAN 1 (server B on exemple)
  • Web services are accessible from all VLAN 2 servers (server A on exemple)
  • The webservices are accessible from server D or any other server in the company network.
  • The webserver is able to access the web
  • The webserver is able to request the Gitlab server and the LDAP server

Depending on which interface is started last, I have two different behaviours.

If the last interface started is eno1 (the local network interface) :

  • Web services are accessible from all servers in VLAN 1
  • Web services aren't accessible from all VLAN 2 servers
  • The webservices are accessible from server D or any other server in the company network.
  • The webserver isn't able to access the web
  • The webserver isn't able to request the Gitlab server and the LDAP server

If the last interface started is eno2 (the company network interface) :

  • Web services aren't accessible from all servers in VLAN 1
  • Web services are accessible from all VLAN 2 servers
  • The webservices are accessible from server D or any other server in the company network.
  • The webserver is able to access the web
  • The webserver is able to request the Gitlab server and the LDAP server

My tests :

I have already tried to change the subnet mask of eno1 to 192.168.0.0/22 while keeping the gateway and changing the following routing

192.168.0.0/24 dev eno1 proto kernel scope link src 192.168.0.4 metric 100 

by

192.168.0.0/22 dev eno1 proto kernel scope link src 192.168.0.4 metric 100 

but the issue still here.

Also, I tried to play with interfaces metrics, delete 192.168.0.0/24 default gateway, tried to add rules and routes files in network-script folder with custom routing directives but nothing conclusive.

Thank you in advance !

1 Answer 1

0

I think you are making it way more complex than it needs to be.

What I would do is add 1 default route and route that to the internet/upstream router. No need for another default route.

Add an additional route for the devices in VLAN2

ip add route -n net 192.168.2.0/24 via 192.168.2.254 dev eno1

Adding routes in NM

This is assuming your north side switch can route the VLAN, really depends on the switch and it s config.

The switch or server on the north would need to know how to reach the 192.168.0.0/24 net but I assume it already does.

I don't think there is much more to it.

You could, if the switch to VLAN2 is giving you problems add another IP to the north side of the server and have the server tag it's packets with VLAN2 and allow it into that network.

3
  • Thank you very much for your feedback. I can't test your solution right now because of another problem (I don't have access to the company network anymore...) but as soon as I can, I'll try and let you know. Have a good day !
    – AntoninC.
    Dec 19, 2022 at 11:04
  • I cleaned up the rules and added the route you recommended and it works! Thank you very much for your help.
    – AntoninC.
    Dec 21, 2022 at 8:16
  • You are welcome AntoninC, glad to hear!
    – proxx
    Dec 21, 2022 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .