Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a firewall (shorewall) with two networks, one with public ip-addresses and one behind a nat with private addresses. A KVM-server (Ubuntu 10.04) attached to both networks via two bridged network cards. A VPS (a KVM-virtual machine) on the KVM-host has two virtual network interfaces attached to each of the networks. I want to be able to reach the server each path from the local private network and via the public ip from Internet.

With this configuration I can reach the VPS using the private network and private address and using the public address from Internet, but not using the public address from the private network.

Gateway (gate)

aw@gate:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
99.99.99.0    *               255.255.255.240 U     0      0        0 eth0
99.99.98.128  *               255.255.255.128 U     0      0        0 eth2
192.168.1.0     *               255.255.255.0   U     0      0        0 eth1
default         99.99.99.129 0.0.0.0         UG    100    0        0 eth2

KVM-host (magne)

aw@magne:~$ ifconfig 
br0       Link encap:Ethernet  HWaddr 12:25:90:39:80:44  
         inet addr:192.168.1.78  Bcast:192.168.1.255  Mask:255.255.255.0
      inet6 addr: 2001:470:28:1ac:225:90ff:fe39:8044/64 Scope:Global
      inet6 addr: fe80::225:90ff:fe39:8044/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:81437 errors:0 dropped:0 overruns:0 frame:0
      TX packets:75378 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:10458872 (10.4 MB)  TX bytes:29451307 (29.4 MB)

br1       Link encap:Ethernet  HWaddr 12:25:90:39:80:45  
      inet6 addr: fe80::225:90ff:fe39:8045/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:477 errors:0 dropped:0 overruns:0 frame:0
      TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:45443 (45.4 KB)  TX bytes:468 (468.0 B)

aw@magne:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         192.168.1.1     0.0.0.0         UG    100    0        0 br0

have also tried with this

aw@magne:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
99.99.99.0      99.99.99.1      255.255.255.240 UG    100    0        0 br1
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         192.168.1.1     0.0.0.0         UG    100    0        0 br0

I don't think the routing table on the bridged KVM-host does matter?

VPS (virtual machine, ask)

aw@ask:~$ ifconfig 
eth0      Link encap:Ethernet  HWaddr 12:54:00:e1:b3:d7  
      inet addr:192.168.1.185  Bcast:192.168.1.255  Mask:255.255.255.0
      inet6 addr: 2001:470:28:1ac:5054:ff:fee1:b3d7/64 Scope:Global
      inet6 addr: fe80::5054:ff:fee1:b3d7/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:5549 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1941 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:675590 (675.5 KB)  TX bytes:214175 (214.1 KB)

eth1      Link encap:Ethernet  HWaddr 12:54:00:2a:3a:dc  
      inet addr:99.99.99.14  Bcast:99.99.99.15  Mask:255.255.255.240
      inet6 addr: fe80::5054:ff:fe2a:3adc/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:2122 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1720 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:232251 (232.2 KB)  TX bytes:198017 (198.0 KB)

Eth0 are bridged with br0 in VirtManager and eth1 with br1

aw@ask:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
99.99.99.0      *               255.255.255.240 U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
default         99.99.99.1      0.0.0.0         UG    10     0        0 eth1
default         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
aw@ask:~$ 

Machine on the Internet (embla)

aw@embla:~$ ifconfig 
eth2      Link encap:Ethernet  HWaddr 12:30:48:88:31:b8  
      inet addr:88.88.88.78  Bcast:88.88.88.79  Mask:255.255.255.248
      inet6 addr: fe80::230:48ff:fe88:31b8/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:5593116 errors:0 dropped:0 overruns:0 frame:0
      TX packets:3947742 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:4262717553 (4.2 GB)  TX bytes:491960763 (491.9 MB)
      Interrupt:18 

aw@embla:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
88.88.88.72    *               255.255.255.248 U     0      0        0 eth2
default         88.88.88.73     0.0.0.0         UG    100    0        0 eth2
aw@embla:~$ 
aw@embla:~$ ssh 99.99.99.14
aw@99.99.99.14's password: 
(working)

Klient on the local network (lian)

aw@lian:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     *               255.255.255.0   U     1      0        0 eth0
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0

aw@lian:~$ ssh 192.168.1.185
aw@192.168.1.185's password: 

aw@lian:~$ ssh 99.99.99.14  (hangs)

I think lian and embla are correct and the error could be found in either gate/magne/ask. If ask has only one virtual ethernet with for example br1 it works both from Internet (embla) and from the local network (lian). I have fiddled with metrics for the dual default route in ask without any luck.

Any ideas?

share|improve this question
    
add comment

closed as too localized by Luis Alvarado Mar 14 '13 at 16:13

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.