I've got a low-powered dual-core Celeron machine, running Ubuntu 19.04, acting as my router. It's also running an
lxd virtual machine with PiHole for DNS.
It's all working well, and has been for some months. Ubuntu 19.10 is now out though, and I discovered on another machine that the configuration I've been using, which has the networking bridge needed for
lxd set up in
/etc/network/interfaces, no longer works in 19.10. I've successfully moved another machine with a similar bridge configuration over to NetPlan, but I can't seem to figure out how to do so for the router. I hope that someone here might show me where I'm going wrong.
Here is the original and currently-working
# interfaces(5) file used by ifup(8) and ifdown(8) auto lo iface lo inet loopback # The WAN interface. auto ethwan iface ethwan inet dhcp dns-nameservers 22.214.171.124 126.96.36.199 # The (old) LAN interface. iface eth0 inet manual # The new LAN interface, on the new USB-to-Ethernet connection. iface ethlan inet manual # The *new* LAN interface. auto br0 iface br0 inet static address 192.168.1.1 netmask 255.255.255.0 dns-nameservers 188.8.131.52 184.108.40.206 bridge-ifaces ethlan bridge-ports ethlan up ifconfig ethlan up
Here's what I tried to use for
/etc/netplan/01-network-manager-all.yaml, after commenting out all but the two
lo lines above:
# Let NetworkManager manage all devices on this system network: version: 2 #renderer: NetworkManager renderer: networkd ethernets: # eth0 isn't used, as the hardware isn't reliable eth0: match: macaddress: f4:4d:30:67:0a:6c dhcp4: yes dhcp6: yes set-name: eth0 ethlan: match: macaddress: 00:e0:4c:6a:03:3f set-name: ethlan dhcp4: no dhcp6: no ethwan: match: macaddress: 78:32:1b:a8:cc:1c dhcp4: yes dhcp6: yes set-name: ethwan bridges: br0: interfaces: [ethlan] dhcp4: no dhcp6: no addresses: [192.168.1.1/24] #gateway4: 192.168.1.1 #nameservers: # addresses: # - 192.168.1.11
The nameserver is supplied via
With this setup, the router machine can access the Internet with no problems -- but the
lxd virtual machine can't access most sites at all (when I run
sudo apt update on it, it says that it hits
http://security.ubuntu.com/ubuntu, but can't seem to reach
http://archive.ubuntu.com/ubuntu), and machines elsewhere on the network have similar problems (I can't get to Google or DuckDuckGo, but my wife can reach Facebook on her iPad). I suspect the ones that it can reach are due to DNS caching somewhere along the line.
I've tried uncommenting both the
gateway4 line and the three nameserver lines, together and separately. The gateway line seems to prevent it from working at all (I'm not sure of the internal details, but that seems to make sense); the nameserver lines don't seem to have any effect. I've also tried it with NetworkManager as the renderer, which also seems to cause it not to work at all.
Can anyone see where I've gone wrong, or suggest a change that might fix it? Thanks!
ip route data, with the working
default via 220.127.116.11 dev ethwan default dev eth0 scope link metric 1002 linkdown default dev ethlan scope link metric 1003 default dev wlp2s0 scope link metric 1005 linkdown 18.104.22.168/27 dev ethwan proto kernel scope link src 22.214.171.124 169.254.0.0/16 dev eth0 proto kernel scope link src 169.254.5.39 linkdown 169.254.0.0/16 dev wlp2s0 proto kernel scope link src 169.254.8.207 linkdown 169.254.0.0/16 dev ethlan proto kernel scope link src 169.254.4.254 169.254.0.0/16 dev ethwan scope link metric 1000 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1
The same data, with the
default via 126.96.36.199 dev ethwan default via 188.8.131.52 dev ethwan proto dhcp src 184.108.40.206 metric 100 default dev ethlan scope link metric 1003 default dev wlp2s0 scope link metric 1005 linkdown 220.127.116.11/27 dev ethwan proto kernel scope link src 18.104.22.168 169.254.0.0/16 dev wlp2s0 proto kernel scope link src 169.254.8.207 linkdown 169.254.0.0/16 dev ethlan proto kernel scope link src 169.254.4.254 192.168.1.0/24 dev br0 proto kernel scope link src 192.168.1.1 22.214.171.124/27 dev ethwan proto kernel scope link src 126.96.36.199 188.8.131.52 dev ethwan proto dhcp scope link src 184.108.40.206 metric 100
I think the new
220.127.116.11 address is an additional address that my ISP assigned during my attempts. Other than that, and the rearranging of lines, it looks mostly the same to me, but I don't know a lot about the output of that command.
However, while attempting it, I made a very weird discovery. When I use the
netplan configuration above, machines on the local network can get to any site except TLS/SSL sites.
curl -v http://google.com returns the 301-redirect data,
curl -v https://google.com gets to the line that says
* TLSv1.3 (OUT), TLS handshake, Client hello (1): and then it just stops. I believe that explains why some sites worked and others didn't under that configuration.
I thought that might be an
iptables problem, except that it works fine under the
Even more confused now. :-?