Centos doesn’t reply to icmp request

centosicmpkernelpacket-capturerouting

I have the following situation:
Centos7, 2 NIC with following setup:

  • em2(NIC2) : 

            82.79.24.74/29  
        82.79.24.75/29

  • em3(NIC3) : 

            192.168.0.240/24
        192.168.133.240/24

    enter image description here

NIC1 and NIC4 are not used. The em2 ips are public ips and em3 ips are private ips.
The asymmetrically routed (outgoing routes and incoming routes are different) packets are accepted, the rp_filter = 2 is set. The firewall is disabled too, there is no active firewall.

Everything works fine, except one. Sometimes the host(kernel) randomly ignores a random IP for no reason, for example one from my clients IP and they cannot access nothing from the server. They cannot either ping the server.

14:18:16.553360 IP 81.12.176.198 > 82.79.24.74: ICMP echo request, id 1, seq 2171, length 40
14:18:21.548878 IP 81.12.176.198 > 82.79.24.74: ICMP echo request, id 1, seq 2172, length 40
14:18:26.547637 IP 81.12.176.198 > 82.79.24.74: ICMP echo request, id 1, seq 2173, length 40
14:18:31.547129 IP 81.12.176.198 > 82.79.24.74: ICMP echo request, id 1, seq 2174, length 40

I've captured the ICMP packets, and the packets are arriving, but there isn't any reply packet on any interface(em2, em2, lo). I can ping the client's IP from the host:
enter image description here

Could anybody give some advice where can I start the researching and locating the source of the problem?

Best Answer

You have 2 IPs in the same subnet(82.79.24.74/29) on the same interface (em2):

𝛌 ~ ipcalc 82.79.24.74/29
Address:   82.79.24.74          01010010.01001111.00011000.01001 010
Netmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000
Wildcard:  0.0.0.7              00000000.00000000.00000000.00000 111
=>
Network:   82.79.24.72/29       01010010.01001111.00011000.01001 000
HostMin:   82.79.24.73          01010010.01001111.00011000.01001 001
HostMax:   82.79.24.78          01010010.01001111.00011000.01001 110
Broadcast: 82.79.24.79          01010010.01001111.00011000.01001 111
Hosts/Net: 6                     Class A

You should not do that. Try removing one of them or make it /32 alias instead.

Related Topic