I am provisioning machines with MAAS, and the machines are all configured with two different subnets:
- public network 220.127.116.11/24. publicly routable subnet. (18.104.22.168 is redacted). DHCP.
- private network 192.168.79.0/24. Maas management network (auto-assign).
Keeping the same interface configuration in MAAS across all nodes, when I deploy on 18.04LTS, the routing table is different than when I deploy 16.04LTS, out of the box. The way it's setup, the 18.04 nodes essentially prevent connections from networks outside (1) and (2). e.g. I can't ssh nor ping the 18.04 host from the public internet. Everything's fine on 16.04 hosts.
From both 16.04 and 18.04 hosts, I can successfully connect TO the public internet (e.g.
wget google.com), and I get responses.
The routing table on 18.04 ends up being slightly different than the one on 16.04:
# 18.04 machine has IPs 22.214.171.124 (eno1), and 192.168.79.9 (eno2) ubuntu@18-04:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.79.254 0.0.0.0 UG 0 0 0 eno2 0.0.0.0 126.96.36.199 0.0.0.0 UG 100 0 0 eno1 192.168.79.0 0.0.0.0 255.255.255.0 U 0 0 0 eno2 188.8.131.52 0.0.0.0 255.255.255.0 U 0 0 0 eno1 184.108.40.206 0.0.0.0 255.255.255.255 UH 100 0 0 eno1
ubuntu@16-04:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 220.127.116.11 0.0.0.0 UG 0 0 0 eno1 192.168.79.0 0.0.0.0 255.255.255.0 U 0 0 0 eno2 18.104.22.168 0.0.0.0 255.255.255.0 U 0 0 0 eno1
The one on 18.04 doesn't work properly. I'm not sure why there's an extra host route (UH) added, and the preferential route is via eno2 (the private network). I can see incoming internet packets come in over eno1 (with tcpdump -i eno1), but I'm guessing the replies go back onto eno2 and get lost.
Is there a way to configure MAAS so 18.04 routing tables look like the ones on 16.04?
18.04 uses netplan to configure networks, and it has special rules for dhcp. network config is in /etc/netplan/50-cloud-init.yaml , and netplan gives priority to the static route over the one aquired via dhcp.
I've had to reverse that priority assignment, but the only way I've managed to fix this is by patching the netplan files after deployment.
eno1: dhcp4: true match: macaddress: c8:1f:66:c9:fd:3c mtu: 1500 set-name: eno1 eno2: addresses: - 192.168.79.110/24 gateway4: 192.168.79.254 match: macaddress: c8:1f:66:c9:fd:3d mtu: 1500 nameservers: addresses: - 192.168.79.10 - 192.168.79.11 search: - maas set-name: eno2
My initial idea was to create an override file with a lexicographically greater name in /etc/netplan/, to remove the "gateway4" entry, but I don't think there's any way to delete a key. You can just override them. So I've edited the same file in place to add the route and give it a higher metric than the default 100 for dhcp networks.
Here's my patched route for eno2. eno1 (dhcp) stays unchanged.
eno1: dhcp4: true match: macaddress: ca:fe:ba:be:ca:3c mtu: 1500 set-name: eno1 eno2: addresses: - 192.168.79.110/24 # no need for this. use routes below. # gateway4: 192.168.79.254 routes: - to: 0.0.0.0/0 via: 192.168.79.254 # dhcp gateways get 100 by default. make this > 100 metric: 200 match: macaddress: ca:fe:ba:be:ca:3d mtu: 1500 nameservers: addresses: - 192.168.79.10 - 192.168.79.11 search: - maas set-name: eno2
I considered also making the dhcp gw route metric 0 (with dhcp4-overrides), but then both gateway routes would have had priority 0 -- and I'm fuzzy on the linux rules then.
netplan apply with the updated config gets me where I want.
Is there any way to make that edit as part of the automated deployment in MAAS?