Linux IP Alias not working – Amazon EC2

amazon ec2ip-aliasingip-routing

I can't seem to figure out this IP aliasing on Amazon EC2. I know it should be straight fwd though.

In summary I have two questions (my scenario details follows after questions), in priority:

  1. How to get the routing working via the CLI commands?
  2. Then after [1] works, how to make the configs stick via config files so that it sticks even after reboots?

The config files is my secondary problem, seeing that I can't even get the routing going via CLI.

Here is what I have by default:

eth0      Link encap:Ethernet  HWaddr 0a:64:bd:67:d6:4a  
          inet addr:172.31.16.15  Bcast:172.31.31.255  Mask:255.255.240.0
          inet6 addr: fe80::864:bdff:fe67:d64a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:266 errors:0 dropped:0 overruns:0 frame:0
          TX packets:257 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:29714 (29.7 KB)  TX bytes:29843 (29.8 KB)

With the following routing table:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.31.16.1     0.0.0.0         UG    0      0        0 eth0
172.31.16.0     0.0.0.0         255.255.240.0   U     0      0        0 eth0

What I want is:

eth0 -> 172.31.16.15
eth0:0 -> 172.31.16.100
eth0:1 -> 172.31.16.101

With the correct routing of course (and I think this is where things go wrong for me) so that I can successfully accomplish this:

1.  telnet -b 172.31.16.15 172.31.16.20 5222
2.  telnet -b 172.31.16.100 172.31.16.20 5222
3.  telnet -b 172.31.16.101 172.31.16.20 5222

Even pinging works only from the 172.31.16.15 ip:

1.  ping -I 172.31.16.15 172.31.16.20
2.  ping -I 172.31.16.100 172.31.16.20
3.  ping -I 172.31.16.101 172.31.16.20

Only [1] works for both the telnet and ping commands above.

When I do the telnet command, and I tcpdump the traffic, the results as follows:

For 172.31.16.15 when it works:

12:58:14.082176 IP (tos 0x10, ttl 64, id 59547, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.15.26798 > 172.31.16.20.5222: Flags [S], cksum 0x7890 (incorrect -> 0x455e), seq 2790518412, win 29200, options [mss 1460,sackOK,TS val 2360855 ecr 0,nop,wscale 7], length 0
12:58:14.082848 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.20.5222 > 172.31.16.15.26798: Flags [S.], cksum 0xfb9b (correct), seq 1051320718, ack 2790518413, win 28960, options [mss 1460,sackOK,TS val 2304582 ecr 2360855,nop,wscale 7], length 0
12:58:14.082877 IP (tos 0x10, ttl 64, id 59548, offset 0, flags [DF], proto TCP (6), length 52)
    172.31.16.15.26798 > 172.31.16.20.5222: Flags [.], cksum 0x7888 (incorrect -> 0x9aa3), ack 1, win 229, options [nop,nop,TS val 2360855 ecr 2304582], length 0

For 172.31.16.100 when it doesn't work (also, nothing arrives at receiving end):

12:59:01.001723 IP (tos 0x10, ttl 64, id 45034, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xf906), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2372585 ecr 0,nop,wscale 7], length 0
12:59:02.000831 IP (tos 0x10, ttl 64, id 45035, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xf80c), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2372835 ecr 0,nop,wscale 7], length 0
12:59:04.004827 IP (tos 0x10, ttl 64, id 45036, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xf617), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2373336 ecr 0,nop,wscale 7], length 0
12:59:08.012822 IP (tos 0x10, ttl 64, id 45037, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xf22d), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2374338 ecr 0,nop,wscale 7], length 0
12:59:16.036831 IP (tos 0x10, ttl 64, id 45038, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xea57), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2376344 ecr 0,nop,wscale 7], length 0
12:59:32.068840 IP (tos 0x10, ttl 64, id 45039, offset 0, flags [DF], proto TCP (6), length 60)
    172.31.16.100.17006 > 172.31.16.20.5222: Flags [S], cksum 0x78e5 (incorrect -> 0xdaaf), seq 1028496387, win 29200, options [mss 1460,sackOK,TS val 2380352 ecr 0,nop,wscale 7], length 0

I have tried this in /etc/network/interfaces:

auto eth0:0
iface eth0:0 inet static
address 172.31.16.100
netmask 255.255.240.0
broadcast 172.31.31.255
network 172.31.16.0
gateway 172.31.16.1

auto eth0:1
iface eth0:1 inet static
address 172.31.16.101
netmask 255.255.240.0
broadcast 172.31.31.255
network 172.31.16.0
gateway 172.31.16.1

When I restart networking it doesn't take effect. Also when I reboot machine I can't ssh into it again either. Seems something takes effect then, but obviously very wrong.

I've also done the CLI sudo ifconfig way:

$ sudo ifconfig eth0:0 172.31.16.100 netmask 255.255.240.0 broadcast 172.31.31.255 up
$ sudo ifconfig eth0:1 172.31.16.101 netmask 255.255.240.0 broadcast 172.31.31.255 up

where my IP alias do take effect immediately:

$ ifconfig 
eth0      Link encap:Ethernet  HWaddr 0a:64:bd:67:d6:4a  
          inet addr:172.31.16.15  Bcast:172.31.31.255  Mask:255.255.240.0
          inet6 addr: fe80::864:bdff:fe67:d64a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1224 errors:0 dropped:0 overruns:0 frame:0
          TX packets:943 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:93498 (93.4 KB)  TX bytes:118463 (118.4 KB)

eth0:0    Link encap:Ethernet  HWaddr 0a:64:bd:67:d6:4a  
          inet addr:172.31.16.100  Bcast:172.31.31.255  Mask:255.255.240.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:1    Link encap:Ethernet  HWaddr 0a:64:bd:67:d6:4a  
          inet addr:172.31.16.101  Bcast:172.31.31.255  Mask:255.255.240.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

with the routing table still looking the same:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.31.16.1     0.0.0.0         UG    0      0        0 eth0
172.31.16.0     0.0.0.0         255.255.240.0   U     0      0        0 eth0

but again, I can't do the telnet as described above for [2] and [3].

Also, after entering following commands (and flushing the routing tables):

echo 200 EJ0 >> /etc/iproute2/rt_tables
echo 201 EJ1 >> /etc/iproute2/rt_tables
ip route add 172.31.16.0 dev eth0:0 src 172.31.16.100 table EJ0
ip route add default via 172.31.16.1 table EJ0
ip route add 172.31.16.0 dev eth0:1 src 172.31.16.101 table EJ1
ip route add default via 172.31.16.1 table EJ1
ip route add 172.31.16.0 dev eth0:0 src 172.31.16.100
ip route add 172.31.16.0 dev eth0:1 src 172.31.16.101
ip rule add from 172.31.16.100 table EJ0
ip rule add from 172.31.16.101 table EJ1

the ping and telnet commands still don't work.

More info:

$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 0a:64:bd:67:d6:4a brd ff:ff:ff:ff:ff:ff
    inet 172.31.16.15/20 brd 172.31.31.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 172.31.16.100/20 brd 172.31.31.255 scope global secondary eth0:0
       valid_lft forever preferred_lft forever
    inet 172.31.16.101/20 brd 172.31.31.255 scope global secondary eth0:1
       valid_lft forever preferred_lft forever
    inet6 fe80::864:bdff:fe67:d64a/64 scope link 
       valid_lft forever preferred_lft forever

and

$ ip route show
default via 172.31.16.1 dev eth0 
172.31.16.0 dev eth0  scope link  src 172.31.16.100 
172.31.16.0/20 dev eth0  proto kernel  scope link  src 172.31.16.15

This is all so that HAProxy can successfully connect to an ejabberd instance but doing it from two different src IPs (eth0:0 and eth0:1).

Any advice most welcome and tons appreciated.

Best Answer

IP aliasing is indeed possible with Amazon EC2 VPC!!

If you are using Ubuntu Linux (like I am at the moment) you still need to add your IP alias as per usual for Linux BUT the crucial part is also to do the ADDITIONAL configuring of it on the Amazon EC2 console itself as shown here Multiple Private IP Addresses.

Thanks all for your comments and contributions.

Related Topic