1

Okay I've been struggling with this all the week sorry if it's a repost but I couldn't find or understand any other "ask ubuntu" posts.

My goal it's to reach the ssh connections from one interface and from another interface reach the ports 80 and 443 from my server.

I have this config on my 01-netcfg.yaml

network:
  version: 2
  renderer: networkd
  ethernets:
    ens160:
      addresses: [XXX.XXX.118.3/26]
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.45.1, XXX.XXX.45.2]
      routes:
        - to: XXX.XXX.13.192/26
          via: XXX.XXX.118.62
    ens192:
      addresses: [XXX.XXX.118.67/26]
      gateway4: XXX.XXX.45.1
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.45.1, XXX.XXX.45.2]
    ens224:
      addresses: [XXX.XXX.118.131/26]
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.45.1, XXX.XXX.45.2]
      routes:
        - to: 0.0.0.0/0
          via: XXX.XXX.118.190
  vlans:
    vlan411:
      id: 411
      link: ens160
      addresses: [XXX.XXX.13.192/26]
    vlan431:
      id: 431
      link: ens192
      addresses: [XXX.XXX.118.164/26]
    vlan740:
      id: 740
      link: ens224
      addresses: [XXX.XXX.118.131/26]

The problem is if remove the route for my admin server (ends .3); I can access via web to my other interface (ends with .131) but I can't reach the server via ssh (.3).

My route for the ip server ends with .3 and my route for public (infranet) ends with 131

So I can't figure out how to make it work... if I have to change something on the netplan config or is more a iptables change.

My current status for the ufw is inactive.

Thank you for the help in advance.

my route table

default         XXX.XXX.118.190  0.0.0.0         UG    0      0        0 ens224
XXX.XXX.13.192  XXX.XXX.118.62   255.255.255.192 UG    0      0        0 ens160
XXX.XXX.13.192   0.0.0.0         255.255.255.192 U     0      0        0 vlan431
XXX.XXX.13.192   0.0.0.0         255.255.255.192 U     0      0        0 vlan740
XXX.XXX.118.0    0.0.0.0         255.255.255.192 U     0      0        0 ens160
XXX.XXX.118.64   0.0.0.0         255.255.255.192 U     0      0        0 ens192
XXX.XXX.118.128  0.0.0.0         255.255.255.192 U     0      0        0 ens224
  • Please see my answer. No guarantee's that it'll do exactly what you want, but syntactically it's more correct than yours. Report back. – heynnema Jun 10 at 23:17
  • I will check it, right now im out the office and I can't access to the server, thanks for your quick suggest. I will try tomorrow – Archagy Jun 10 at 23:33
  • You've clearly declared that you have a network that should be reached via a router connected to your ens160 interface, so why do you expect routing to the .3 address to work if you delete that route? Assuming the remote machine is on the .192/26 network, if you delete this route then INCOMING traffic for the .3 will come in via .62 but OUTGOING traffic from this address will go via .190 and possibly be discarded by the router. – slangasek Jun 11 at 1:39
  • Side note, this part is certainly incorrect: - to: 0.0.0.0 via: XXX.XXX.XXX.190 as that is a host route to ip 0.0.0.0, not a default route. – slangasek Jun 11 at 1:52
  • @slangasek any comments on my .yaml file in my answer? – heynnema Jun 11 at 7:37
1

Spacing, indentation, and no tabs, are important.

Note: verify that netmask /26 is correct for your environment

Note: no gateway4 when routes specified

Note: there may be a limit of 3 DNS nameservers

network:
  version: 2
  renderer: networkd
  ethernets:
    ens160:
      addresses: [XXX.XXX.XXX.3/26]
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.XXX.1, XXX.XXX.XXX.2]
      routes:
        - to: XXX.XXX.XXX.192/26
          via: XXX.XXX.XXX.62
    ens192:
      addresses: [XXX.XXX.XXX.67/26]
      gateway4: XXX.XXX.XXX.1
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.XXX.1, XXX.XXX.XXX.2]
    ens224:
      addresses: [XXX.XXX.XXX.131/26]
      nameservers:
        addresses: [8.8.4.4, XXX.XXX.XXX.1, XXX.XXX.XXX.2]
      routes:
        - to: 0.0.0.0/0
          via: XXX.XXX.XXX.190
    vlans:
      vlan411:
        id: 411
        link: ens160
        addresses: [XXX.XXX.XXX.XXX/26]
      vlan431:
        id: 431
        link: ens192
        addresses: [XXX.XXX.XXX.XXX/26]
      vlan740:
        id: 740
        link: ens224
        addresses: [XXX.XXX.XXX.XXX/26]

sudo netplan --debug generate # generate config files

sudo netplan apply # apply new configuration

reboot # reboot and verify operation

  • The netmask is right, I removed the gateway and remove the nameservers. I ran the commands that you suggest. I update the post of my config file to the current. I can have access to ssh but not via web to the 131. – Archagy Jun 11 at 16:12
  • @Archagy I don't think that your mods to your own .yaml file will make it work. Try my .yaml, editing the addresses as needed, and start working using that as a base. – heynnema Jun 11 at 16:27
  • Sorry I missed all your changes, I update the config netplan file with all your setting. I lost the access for ssh for my ip segment (I have to connect to another server in the same segment to have access). I added my ip table route. – Archagy Jun 11 at 17:16
  • @Archagy I don't think you can set the vlan addresses to the same as the ensXXXX devices. I'm not an expert on routing, so I'm not much help there. Maybe slangasek can help with that. – heynnema Jun 11 at 17:23
  • Thanks for all your quick response, yeah, I'm totally a newbie about routing. I will keep trying – Archagy Jun 11 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.