Setting 2 IPs on Ubuntu 12.04 with two network adaptor card

hostingiplinux-networkingnicubuntu-12.04

There is a VPS runing ubuntu 12.04.3 server on vmware esxi 5.

It has 2 valid static IPs and two network cards eth0 and eth1.
but only one of the assigned ips is pingable from outside. (both ips ang gateway is pigable from inside).

it seems that I receive packets on dead IP, but don't reply them.
ifconfig will returns:

eth0      Link encap:Ethernet  HWaddr 00:50:56:03:43:2b  
          inet addr:91.121.247.155  Bcast:91.121.247.155  Mask:255.255.255.255
          inet6 addr: fe80::250:56ff:fe03:432b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:179 errors:0 dropped:0 overruns:0 frame:0
          TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:20976 (20.9 KB)  TX bytes:7246 (7.2 KB)

eth1      Link encap:Ethernet  HWaddr 00:50:56:05:11:46  
          inet addr:91.121.247.148  Bcast:91.121.247.148  Mask:255.255.255.255
          inet6 addr: fe80::250:56ff:fe05:1146/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:174 errors:0 dropped:0 overruns:0 frame:0
          TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:20181 (20.1 KB)  TX bytes:8317 (8.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:68 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:5884 (5.8 KB)  TX bytes:5884 (5.8 KB)

and ip route:

default via 188.165.247.254 dev eth1 
188.165.247.254 dev eth1  scope link 
188.165.247.254 dev eth0  scope link

also ip nei :

fe80::12bd:18ff:fee4:5040 dev eth0 lladdr 10:bd:18:e4:50:40 router REACHABLE
fe80::ee30:91ff:fee0:dfc0 dev eth0 lladdr ec:30:91:e0:df:c0 router REACHABLE
fe80::12bd:18ff:fee4:5040 dev eth1 lladdr 10:bd:18:e4:50:40 router REACHABLE
fe80::ee30:91ff:fee0:dfc0 dev eth1 lladdr ec:30:91:e0:df:c0 router REACHABLE

but arp -a returns NO OUTPUT at all.

this is my /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 91.121.247.155
    netmask 255.255.255.255
    broadcast 91.121.247.155
    post-up route add 188.165.247.254 dev eth0
    post-up route add default gw 188.165.247.254
    post-down route del 188.165.247.254 dev eth0
    post-down route del default gw 188.165.247.254



auto eth1
iface eth1 inet static
    address 91.121.247.148
    netmask 255.255.255.255
    broadcast 91.121.247.148
    post-up route add 188.165.247.254 dev eth1
    post-up route add default gw 188.165.247.254
    post-down route del 188.165.247.254 dev eth1
    post-down route del default gw 188.165.247.254
    dns-nameservers 213.186.33.99

the problem is 91.121.247.155 is not pingable from outside. and i don't know why.

Best Answer

The problem is that you can't have two 'default' gateways by default. How would The kernel know which interface to use if it's being told to use two different interfaces.

A quick search online found a recent post showing how to do it by creating a second routing table.

Without knowing what limitations you may be working with, why use two separate interfaces? From the looks of it, these two IPS are actually part of the same block. Why not just use an alias on eth0 for the second IP? If it's for bandwidth reasons you should consider setting up link aggregation(LACP, set up with the bonding kernel module) so both addresses can take advantage of the extra (virtual) nic. Assuming each virtual nic is connected to a separate real NIC (going to the same switch) you would also get redundancy for both IPs should one of the cables get pulled or a card goes bad on the VMware host.

Related Solutions

Ubuntu – KVM Ubuntu Guest cannot connect to the internet on bridged networking

I think you are missing a iptable rule for the masquerade

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

Linux – How to configure dual homed server in order for both network segments to communicate

There are two problems with this setup:

The hosts on LAN1 know nothing about the LAN2 segment. When you ping a host on LAN1 (let's call it host1) from SRV-02, the packet will be routed through SRV-01 and will reach host1. However, host1 will send the reply to it's default gateway (ISP router) as it doesn't have a specific route to LAN2. (The ISP router will either a) also send it to it's default gateway as it also doesn't know about LAN2, or b) drop the packet as it comes from an unknown source not it's local LAN.)
When trying to reach WAN from LAN2, the packets will be routed through SRV-02 to ISP router where two situations are possible:
- The router will not NAT translate the packet as the source of the packet (LAN2) is not it's local LAN (this is the more probable situation), or
- The router will NAT translate the packet and send it to the Internet. However, when the reply comes and the destination is translated back to the LAN2 address, the packet will not be delivered as the ISP router doesn't have a route for that network. The packet will be sent incorrectly to the default gateway (ISP).

These issues could be fixed by adding a static route to LAN2 to ISP router and adding a source NAT configuration for LAN2 on SRV-01. However, that is not possible due to no admin access to the ISP router.

There are two solutions that get around it:

A. Make SRV-01 a full router for LAN1 and LAN2 hosts

Add another network adapter to SRV-01 (making it 3 in total)
Change the topology as follows:

WAN -> ISP router -> LAN1 -> SRV-01 +-> LAN3 (for hosts originally in LAN1)
                                    +-> LAN2 -> SRV-02

Basically, we're making SRV-01 a router for both LAN segments.

This will require moving hosts originally in LAN1 to a new subnet LAN3 - let's say we use 10.0.1.0/24
The network configuration of SRV-01 will need to be changed as follows:

/etc/network/interfaces:

# LAN1 - to ISP router
auto eth0
iface eth0 inet dhcp
# we can even use dhcp as the IP address is not really important
# - there are no more hosts on LAN1 apart from ISP router and SRV-01

# LAN3 - for hosts originally in LAN1
iface eth1
    address 10.0.1.1
    netmask 255.255.255.0

# LAN2
iface eth2
    address 10.0.2.1
    netmask 255.255.255.0

iptables rules to make WAN access work:

iptables -t nat -A POSTROUTING -o eth0 -s 10.0.1.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -s 10.0.2.0/24 -j MASQUERADE

Alternatively, if you choose to keep the static IP address on SRV-01 on eth0 the rules could be changed (although MASQUERADE would still work):

iptables -t nat -A POSTROUTING -o eth0 -s 10.0.1.0/24 -j SNAT --to-source 192.168.5.8
iptables -t nat -A POSTROUTING -o eth0 -s 10.0.2.0/24 -j SNAT --to-source 192.168.5.8

DHCP will need to be configured on SRV-01 on eth1 (LAN3, for hosts originally on LAN1), and possibly on eth2 (LAN2) as well if required. (In both cases the gateway will be the local address of eth1 or eth2 respectively, but that goes without saying :)

This will make communication possible between LAN3 and LAN2 (via SRV-01 which is the default gateway for both). WAN access will also work from both LAN3 and LAN2 thanks to the double source NAT.

B. Make SRV-01 a DHCP server for LAN1

This approach is not as clean as above but is slightly simpler. It assumes you are able to disable DHCP on ISP router

Disable DHCP on ISP router
Set up DHCP for LAN1 on SRV-01 and make SRV-01 (192.168.5.8) the default gateway for LAN1
Set up source NAT translation for LAN2 on SRV-01 so that the WAN access works from LAN2:

iptables -t nat -A POSTROUTING -o eth0 -s 10.0.2.0/24 -d 192.168.5.4 -j SNAT --to-source 192.168.5.8
iptables -t nat -A POSTROUTING -o eth0 -s 10.0.2.0/24 ! -d 192.168.5.0/24 -j SNAT --to-source 192.168.5.8

The first line enables SNAT so that LAN2 hosts can access the ISP router itself and the second line disables SNAT for LAN2-LAN1 access.

Again, this approach is not as clean as the one above as there are two routers in the same subnet (SRV-01, ISP router). When I used this approach myself I noticed my second router (SRV-01 in this scenario) would send ICMP redirects to the ISP router as it would see that the client (host on LAN1) and the upstream router (ISP router) are on the same LAN. This might not be desired as network policies implemented on SRV-01 could be circumvented.

Hope that helps.

Best Answer

Related Solutions

Ubuntu – KVM Ubuntu Guest cannot connect to the internet on bridged networking

Linux – How to configure dual homed server in order for both network segments to communicate

Related Topic