0

Using 19.10 (eoan). Here's a bird's-eye view of the setup:

  • netplan is set to put wlan0, eth0, eth1 in a bridge, br0
  • netplan statically sets br0 with DNS servers (and IP4 address, gateway4, etc.)
  • systemd-resolved ("SR" hereafter) is in default configuration (I think), making the host use SR's stub resolver, bypassing dnsmasq
  • dnsmasq is providing DHCP, DNS to the local network, on br0
  • hardware is raspberry pi 3B+ - wlan0 and eth0 are built-in, eth1 is an Apple USB-Ethernet adapter, supported by the asix driver
  • separate from this, netplan also sets up a 6in4 tunnel (static IP6 assignment on both the tunnel and the bridge interface; v6 forwarding enabled and default route set up)

I added the USB NIC just today for testing. Without it, everything works fine. When I connect eth1, the SR's DNS scope is lost from the br0 link, system therefore has no link to resolve DNS, and connectivity via hostnames therefore breaks.

resolvectl status before:

...
Link 4 (br0)
      Current Scopes: DNS
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
  Current DNS Server: 208.67.222.222
         DNS Servers: 208.67.222.222
                      208.67.220.220
                      8.8.8.8
                      8.8.4.4
                      2001:4860:4860::8888
                      2001:4860:4860::8844
          DNS Domain: lan
...

After:

...
Link 5 (br0)
      Current Scopes: none
DefaultRoute setting: no
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
         DNS Servers: 208.67.222.222
                      208.67.220.220
                      8.8.8.8
                      8.8.4.4
                      2001:4860:4860::8888
                      2001:4860:4860::8844
          DNS Domain: lan

Link 3 (eth1)
      Current Scopes: none
DefaultRoute setting: no
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no

Link 2 (eth0)
      Current Scopes: none
DefaultRoute setting: no
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
...

Despite SR's claim, the routing table does not change after plugging the USB NIC (GUA prefixes removed from output):

ubuntu@rpi3:~$ ip -4 route
default via 192.168.2.1 dev br0 proto static 
192.168.2.0/24 dev br0 proto kernel scope link src 192.168.2.4 
ubuntu@rpi3:~$ ip -6 route
::1 dev lo proto kernel metric 256 pref medium
<external prefix> dev he-ipv6 proto kernel metric 256 pref medium
<internal prefix> dev br0 proto kernel metric 256 pref medium
fe80::/64 dev he-ipv6 proto kernel metric 256 pref medium
fe80::/64 dev br0 proto kernel metric 256 pref medium
default dev he-ipv6 proto static metric 1024 pref medium

Netplan config - 2 parts:

network:
  ethernets:
    eth0:
      dhcp4: no
      optional: true
    wlan0:
      dhcp4: no
      optional: true
    eth1:
      dhcp4: no
      optional: true
  bridges:
    br0:
      dhcp4: no
      dhcp6: no
      accept-ra: no
      addresses:
        - 192.168.2.4/24
      gateway4: 192.168.2.1
      interfaces:
        - eth0
        - eth1
#        - wlan0
      optional: true
      nameservers:
        search: [lan]
        addresses: [208.67.222.222, 208.67.220.220, 8.8.8.8, 8.8.4.4]


network:
  version: 2
  bridges:
    br0:
      addresses:
        - "<internal IP6>/64"
      nameservers:
        addresses: ["2001:4860:4860::8888", "2001:4860:4860::8844"]
  tunnels:
    he-ipv6:
      mode: sit
      remote: 216.66.86.122
      local: 192.168.2.4
      addresses:
        - "<external IP6/64"
      routes:
        - to: "::/0"
          on-link: false
          scope: link

networkctl status also shows no difference:

●        State: routable
       Address: 192.168.2.4 on br0
                <internal IP6> on br0
                <external IP6> on he-ipv6
                fe80::<EUI-64> on br0
                fe80::c0a8:204 on he-ipv6
       Gateway: 192.168.2.1 (HUAWEI TECHNOLOGIES CO.,LTD) on br0
           DNS: 208.67.222.222
                208.67.220.220
                8.8.8.8
                8.8.4.4
                2001:4860:4860::8888
                2001:4860:4860::8844
Search Domains: lan

It is perhaps suspicious that there's no IPv6 gateway, since the route references a link (a 6in4 tunnel) rather than next-hop:

ip -6 route:

::1 dev lo proto kernel metric 256 pref medium
<external prefix>/64 dev he-ipv6 proto kernel metric 256 pref medium
<internal prefix>/64 dev br0 proto kernel metric 256 pref medium
fe80::/64 dev he-ipv6 proto kernel metric 256 pref medium
fe80::/64 dev br0 proto kernel metric 256 pref medium
default dev he-ipv6 proto static metric 1024 pref medium

networkctl before:

IDX LINK             TYPE               OPERATIONAL      SETUP     
  1 lo               loopback           carrier          unmanaged 
  2 eth0             ether              enslaved         configured
  3 wlan0            wlan               carrier          failed    
  4 br0              bridge             routable         configured
  5 sit0             sit                off              unmanaged 
  6 he-ipv6          sit                routable         configured

... and after:

IDX LINK             TYPE               OPERATIONAL      SETUP     
  1 lo               loopback           carrier          unmanaged 
  2 eth0             ether              no-carrier       configured
  3 wlan0            wlan               no-carrier       configuring
  4 br0              bridge             degraded-carrier configured
  5 sit0             sit                off              unmanaged 
  6 he-ipv6          sit                routable         configured
  7 eth1             ether              enslaved         configured
  • What does your netplan yaml look like, and what is the output of networkctl before and after connecting the USB ethernet device? – slangasek Feb 24 at 6:09
  • Thanks for taking the time to review this. I added the info to the question. – myxal Feb 24 at 18:52
  • I don't see eth1 mentioned at all in your netplan config but you say it's part of your bridge. What am I missing? Also, I was specifically looking for the output of 'networkctl', not 'networkctl status'. – slangasek Feb 25 at 20:04
  • Whoops, pasted the other version as I'm shuffling the configurations. eth1 is/was in the predictable place.You are on the right track - before adding the extra interface, the br0 iface is routable, then goes to degraded-carrier. That is actually documented as a state of bridge/bond iface with any of the enslaved ports having no carrier. Even worse, the bridge interface does not recover when eth1 is removed from the system. Semantically, I don't see why having slave ports without carrier should stop the bridge interface from being routable, can this be adjusted with a setting? – myxal Feb 26 at 23:26
  • I'm sorry, I don't know the answer to the question about configurability. I don't believe we expose anything in netplan that can be used to configure this behavior. – slangasek Feb 27 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.