Networking Forums

Networking Forums > Computer Networking > Linux Networking > Re: Routing issues - ping works one way but not the other

Reply
Thread Tools Display Modes

Re: Routing issues - ping works one way but not the other

 
 
Pascal Hambourg
Guest
Posts: n/a

 
      10-12-2010, 11:06 AM
Hello,

David Brown a écrit :
> I've got a routing issue that I can't quite figure out. My (very
> simplified) setup is this:
>
> Box A is on 192.168.0.1 and is the router, dns server, etc. for the
> 192.168.0.x network. It has other interfaces as well, for access
> further into the network and out onto the internet. iptables are set to
> allow all traffic in, out and forwarded. There is a "route -net
> 192.168.1.0/24 gw 192.168.0.2" in the route table.


Don't you mean "192.168.1.0/24 gw 192.168.0.3" ?

> Box B is on 192.168.0.2 with 192.168.0.1 as the default gateway. It's a
> client machine on the 192.168.0.x network.
>
> Box C is a router with two ports. One is at 192.168.0.3, the other is
> 192.168.1.1. iptables are set to allow all traffic in, out and
> forwarded. The default route is set to 192.168.0.1 (box A).
>
> Box D is on 192.168.1.2 with 192.168.1.1 as the default gateway. It's a
> client machine on the 192.168.1.x network.
>
>
> If I log into box B, and type "ping D" I get a response. The route
> flow is B to A (the default gateway), then to C (due to the specific
> route command), then to D. I've confirmed this path with traceroute.
>
> If I log into box D and type "ping B", I get no response. Traceroute
> shows the flow from D to C as expected, but nothing beyond that. I know
> that the packet is going directly from C to B (see below for how I
> know), as expected. But somehow the reply from box B is not getting
> back to D.
>
> (If I ping from box D to something outside these networks, accessed
> through router A, it works fine.)


What about ping A from D ? I guess it works fine ?

> I can't see why I can ping one way, and not the other.


Is there some NAT or stateful filtering on the box A and box C ? These
don't work well with asymmetric routing.
Can you run tcpdump on the boxes and see what's going on ?

> If I run "route -net 192.168.1.0/24 gw 192.168.0.2" on B, then pings
> work properly both ways.


Then I guess it rules out box B not replying to ping at all.
 
Reply With Quote
 
 
 
 
Pascal Hambourg
Guest
Posts: n/a

 
      10-12-2010, 01:07 PM
David Brown a écrit :
> On 12/10/2010 13:06, Pascal Hambourg wrote:
>
>> Is there some NAT or stateful filtering on the box A and box C ? These
>> don't work well with asymmetric routing.

>
> There is no NAT or any kind of filtering on box C - everything passing
> through is forwarded directly. Box A does have filtering and NAT, but
> not on the interfaces in question (though see below for an update).

[...]
> A is refusing to forward it from B to C because of the iptables rule
> "iptables -A FORWARD -m state --state INVALID -j DROP". I have always
> used this rule (and the same for INPUT and OUTPUT chains) at the start
> of iptables firewalls.
>
> Assuming that is the case (and I'll do some more tests to make sure),
> the question then is why is this reply packet being judged as invalid?


Because box A's connection tracking state machine did not see the echo
request it replies to, due to the asymmetric routing. In the other way,
box A sees the echo request which has state NEW, and does not see the
echo reply, but that does not matter.

> And if I am correct in thinking that dropping INVALID packets is
> considered best practice, is there any risk in skipping that rule? The
> scope here is only for packets arriving and leaving on the same internal
> LAN interface - anything on other interfaces or originating from outside
> will still be dropped if it is INVALID.


You can safely ACCEPT any packet arriving and leaving on the same
internal LAN interface, regardless of its state.
 
Reply With Quote
 
 
 
 
Pascal Hambourg
Guest
Posts: n/a

 
      10-12-2010, 03:16 PM
Andrew Gideon a écrit :
> On Tue, 12 Oct 2010 15:07:45 +0200, Pascal Hambourg wrote:
>
>> Because box A's connection tracking state machine did not see the echo
>> request it replies to, due to the asymmetric routing. In the other way,
>> box A sees the echo request which has state NEW, and does not see the
>> echo reply, but that does not matter.

>
> Is there any way to "fix" this by sharing connection state amongst
> multiple routers?


Check conntrackd from conntrack-tools.
<http://conntrack-tools.netfilter.org/>
 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Same OS;wifi works on one,not on other SteveJ. Wireless Internet 1 02-03-2006 05:11 AM
Strange: Works, doesn't works, then works Anthony Giorgianni Wireless Internet 23 05-24-2005 02:43 AM
File and Printer Sharing, XP to 98, works one way, but not the other Harry Windows Networking 2 05-24-2004 12:10 AM
Wireless LAN works great one direction, but not the other Thomas J. Wireless Internet 0 05-03-2004 12:54 AM
help me : "ping IP" works but not "ping NAME" on windows 98 2nd edition zef Windows Networking 1 08-05-2003 07:49 PM