0

I'm currently having issues accessing the internet on my Ubuntu 18.04 server. The server has TWO NICs enabled. I can ping the default gateway and internal IPs, but I cannot ping any external IP. I checked the firewall and see the pings are allowed and are going out, but I'm not receiving anything back. I've included my networking config below. Thank you.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:81:04:0d brd ff:ff:ff:ff:ff:ff
    inet 172.18.248.27/24 brd 172.18.248.255 scope global ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe81:40d/64 scope link 
       valid_lft forever preferred_lft forever
3: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:81:76:4c brd ff:ff:ff:ff:ff:ff
    inet 172.18.254.27/24 brd 172.18.254.255 scope global ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe81:764c/64 scope link 
       valid_lft forever preferred_lft forever

Pinging to Google forcing from interface,

ping -I ens160 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 172.18.248.27 ens160: 56(84) bytes of data.
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4092ms

Normal ping to Google,

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5104ms

Ping to DG,

ping 172.18.248.254
PING 172.18.248.254 (172.18.248.254) 56(84) bytes of data.
64 bytes from 172.18.248.254: icmp_seq=1 ttl=64 time=0.767 ms
64 bytes from 172.18.248.254: icmp_seq=2 ttl=64 time=0.800 ms
^C
--- 172.18.248.254 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1024ms
rtt min/avg/max/mdev = 0.767/0.783/0.800/0.032 ms

Tracepath to Google,

tracepath 8.8.8.8
 1?: [LOCALHOST]                      pmtu 1500
 1:  ???                                                   4.654ms 
 1:  ???                                                   4.709ms 
 2:  no reply
 3:  no reply
 4:  no reply
 5:  no reply
 6:  no reply
^C

Routes,

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.18.248.254  0.0.0.0         UG    0      0        0 ens160
172.18.248.0    0.0.0.0         255.255.255.0   U     0      0        0 ens160
172.18.254.0    0.0.0.0         255.255.255.0   U     0      0        0 ens192

IP route list,

default via 172.18.248.254 dev ens160 proto static 
172.18.248.0/24 dev ens160 proto kernel scope link src 172.18.248.27 
172.18.254.0/24 dev ens192 proto kernel scope link src 172.18.254.27 

/etc/netplan File,

  network:
        ethernets:
            ens160:
                addresses:
                - 172.18.248.27/24
                gateway4: 172.18.248.254
                nameservers:
                    addresses:
                    - 8.8.8.8
            ens192:
                addresses:
                - 172.18.254.27/24
                gateway4: 172.18.254.254
                nameservers:
                    addresses:
                    - 8.8.8.8
        version: 2

EDIT:

I think I may have found it. Here is the output of netstat -r on the machine (M1) that cannot access the internet.

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         172.18.248.254  0.0.0.0         UG        0 0          0 ens160
default         172.18.254.254  0.0.0.0         UG        0 0          0 ens192
172.18.248.0    0.0.0.0         255.255.255.0   U         0 0          0 ens160
172.18.254.0    0.0.0.0         255.255.255.0   U         0 0          0 ens192

Here is the netstat -r command on a machine (M2) that CAN reach the internet, in the same subnet.

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
default         _gateway        0.0.0.0         UG        0 0          0 ens160
172.18.248.0    0.0.0.0         255.255.255.0   U         0 0          0 ens192
172.18.254.0    0.0.0.0         255.255.255.0   U         0 0          0 ens160

So I believe it's a misconfig in the kernel routing. Would anyone know how I can correct it to mimic M2's config?

  • It looks like you must have problem with upstream router. Your netplan incorrectly has two gateways but you must have manually deleted default via 172.18.254.254. Is your gateway configured properly? Does it have a proper routes or NAT for this local network? You may need to add more info about your network setup. – RomanK Nov 2 at 19:37
  • /etc/netplan has one gateway set to 172.18.254.254 and the other as 172.18.248.254. I see that you are able to ping 172.18.248.254 but I don't see where you try to ping 172.18.254.254. Did you accidentally add this address? – Gordster Nov 2 at 20:02
  • @Gordster - We have two interfaces on the machine (untrust DMZ-ens192, and trust DMZ-ens160). The original DG was set up to exit ens192. I had issues running an API from the machine (rules on firewall blocked traffic from ens192 IP), so I attempted to configure the machine to use ens160. – Mysicksi Nov 2 at 20:26
  • @RomanK - I believe it had originally had two DGs enabled. I was having issues with an API (the HTTP call would exit ens192 and being blocked by the firewall). I tried to increase the route metric on ens192 using ifmetric. I logged in the next day and the metric was back to default. Then I deleted the ens192 route so I could force the API to only use ens160. After I did that, my connection to the internet dropped. Priority for the API to run is higher than having internet access currently, but I would like to correct the internet issue, without causing much downtime on the API – Mysicksi Nov 2 at 20:33
  • Should I re-configure the DG for the other interface with a higher metric than ens160? – Mysicksi Nov 2 at 20:37
0

From the information you have provided, we can assume below network topology:

                   +------------------+
                   |        M1        |
                   |                  |172.18.254.27/24
       +-----------+ ens160    ens192 +------------+
       |           |                  |            |
       |           |                  |            |
       |           +------------------+            |         +----------------+
       |                                           |         |    Gateway     |
172.18.248.0/24                                    +---------+                |
       |           +------------------+            |         | 172.18.254.254 |
       |           |        M2        |            |         +----------------+
       |           |                  |            |
       +-----------+ ens192    ens160 +------------+
                   |                  |
                   |                  |
                   +------------------+

Based on your M2 configuration the gateway is in the 172.18.254.0/24 network.
When you edit the routing or IP settings using command line tools such as ip address and ip route, the changes are not persistent, meaning will not survive the reboot.
For persistent changes, edit netplan file, and delete getaway from ens160 interface.
After saving the file you need to apply it:

sudo netplan apply

In case, you have redundant gateway in 172.18.248.0/24 network, you will need to offset default routes with different metric values.
You can do so by editing your netplan file as below:

network:
        ethernets:
            ens160:
                addresses:
                - 172.18.248.27/24
                #gateway4: 172.18.248.254 #Commented out
                routes:
                - to: 0.0.0.0/0
                  via: 172.18.248.254
                  metric: 110 #higher metric than default 100 on ens192
                nameservers:
                    addresses:
                    - 8.8.8.8
            ens192:
                addresses:
                - 172.18.254.27/24
                gateway4: 172.18.254.254
                nameservers:
                    addresses:
                    - 8.8.8.8
        version: 2
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.