2

I am having a problem with an Ubuntu server running two NICs on two different subnets androuting between them. We are running a Nginx server as a reverse proxy with a public subnet and private subnet.

We are running ubuntu server 15.04.

Here’s the setup :

eth0      Link encap:Ethernet  HWaddr 00:50:56:88:6e:91
          inet addr:89.21.20.14  Bcast:89.21.20.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fe88:6e91/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:89152 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1729 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5552124 (5.5 MB)  TX bytes:286442 (286.4 KB)

eth1      Link encap:Ethernet  HWaddr 00:50:56:88:16:0b
          inet addr:10.150.200.50  Bcast:10.150.200.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fe88:160b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:549 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:53395 (53.3 KB)  TX bytes:1908 (1.9 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:160 errors:0 dropped:0 overruns:0 frame:0
          TX packets:160 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:12960 (12.9 KB)  TX bytes:12960 (12.9 KB)

I have the gateway on eth0.

When I try and ping 89.21.20.14 from a server on 10.150.200.xx subnet it isn’t working and I cannot communicate with it. The traffic is hitting eth0 as I can see from

sudo tcpdump -i eth0 proto \\icmp

I have also tried to do the same thing going from a server in 89.21.20.xx and access/ping 10.150.200.50 but that isn’t going through either. When running the tcpdump I can see the pings hitting eth1

Problem is that we have websites running on the private subnet web servers and they reference domains that point to the public IPs on 89.21.20.xx and therefore cannot communicate with the sites/applications.

I’m thinking it’s some kind of routing issue but not too sure of where to start?

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         89.21.24.1      0.0.0.0         UG        0 0          0 eth0
10.150.200.0    0.0.0.0         255.255.255.0   U         0 0          0 eth1
89.21.20.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0



Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         89.21.20.1      0.0.0.0         UG    0      0        0 eth0
10.150.200.0    *               255.255.255.0   U     0      0        0 eth1
localnet        *               255.255.255.0   U     0      0        0 eth0
2
  • Post routecommand output.
    – migrc
    Nov 11, 2015 at 16:51
  • @JohnFox add that as an edit to your question not as a comment. Also, read my answer, and clarify what exactly you are trying to achieve (nginx as a reverse proxy is NOT a router, and you will only be able to ping eth1 from things that are connected to that private subnet on eth1). Also explain why this is tagged as 'nginx'
    – Thomas Ward
    Nov 11, 2015 at 16:57

1 Answer 1

2

You state in comments that you don't want subnet traversal. You've already got this, then, with the not being able to reach eth0 from eth1 and vice versa, so your issue is already resolved.

If you have some other question, though, you need to be more specific with what you're asking. (The reverse proxying happens transparently, you won't be able to reach eth0 from eth1 or vice versa, not without going through nginx on the reverse proxy server).


The below is kept for historical reasons.

I'm curious why this is tagged , because this is not an NGINX issue, it's a case of you trying to go from inside (eth1 and the internal subnet) to outside (eth0, and the public Internet) without a router (or a system configured as a router) in place or a rule to let your 'server' act as a proxy from inside->out (which is NOT a reverse proxy).

NGINX is not a proxy or router. A reverse proxy will say "OK, so send this request to the backend, abc." Then, it'll say "ABC: Send me the response", which will send the initial request made from outside to the internal server. That then gets you the response from backend 'abc' at the nginx server. That is returned by nginx to the requesting client.

A reverse proxy also only works outside -> in. This diagram shows basically how that looks from outside going in:

Hastily Drawn Diagram by Thomas W.

The reverse path works, but only because the Reverse Proxy System (nginx) is waiting for response from the backends, and then hands that data back to the Web Browser or remote client making the request for information and expecting a response back.

The reverse path, however, does NOT permit you to go from eth1 on the Reverse Proxy to eth0 on the Reverse Proxy via the Remote Proxy system - that's not how IP routing works, and to achieve what you're looking to achieve, you need a real router in place that can handle network traversal from the Internal IPs to the outside, and then back to the Public IP address of eth0 on the reverse proxy box, so it'd look like this:

the router way, another diagram by Thomas W.

The data traversal here, then, would be from the internal boxes, through the router box they're connected to, out to the Internet, and then from the Internet back to your eth0 box. (The most basic way of explaining this of course).

However, your Reverse Proxy box does not double as a router, so it doesn't work in the way you're thinking it does.


On another note:

You don't get to ping from internal (which goes to eth1) to eth0 directly, which is on a completely different subnet unless you go through an actual router and go outside then back in. Unless you set up your server that also has nginx on it to be a router, which from your comments appears to not be the case. So, this "not able to ping across interfaces and subnets" is expected behavior.

9
  • We do have a router on the network that isnt the ubuntu server and this is providing the gateway. Yes, the nginx part is a bit misleading and irelevant. The idea behind having the two nics is that the public IP is the only bit that is accessible and the second nic on the private subnet is used to direct the traffic over to the web servers on the private lan.
    – John Fox
    Nov 11, 2015 at 17:04
  • I'm ok with the Nginx Reverse Proxy side of things. I'm with you on that explanation.
    – John Fox
    Nov 11, 2015 at 17:11
  • @JohnFox Then why are you trying to ping eth0 from the internal servers? Those internal servers aren't connected to a router, are they? If they are, then you need your router / firewall to be able to handle routing of requests to the public IP address assigned to eth0 on the Reverse Proxy box. You should also consider that an internal range should never be trying to reach the public IP address on eth0 or have to. I believe what you're trying to achieve is an Impossible Situation (TM) as a result of not understanding networking limitations and network restrictions/rules.
    – Thomas Ward
    Nov 11, 2015 at 17:15
  • ... The same network restrictions apply here too, for the other direction, from eth0 to eth1 - you can't ping via those interfaces to the other interface because you don't have routing rules to handle PublicIP -> PrivateIP. A router wouldn't be able to help you here either.
    – Thomas Ward
    Nov 11, 2015 at 17:19
  • The internal servers are connected to the router and have external access (via NAT). These are web servers that need to make calls to external services. We have applications that call themselves via their domain names (that go to the public IP addresses) and currently dont work.
    – John Fox
    Nov 11, 2015 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .