2 networks with different routes

[Kay Liesenfeld]

I have 2 networks cards intalled: lan0 and lan1.

lan0: 192.168.1.51 (external network)
lan1: 172.16.1.4 (internal network)

I want to use 2 different routings:

1. traffic to 172.18.1.3 via lan1 and external router 172.16.1.10:
route add 172.18.1.3 172.16.1.10 1

works fine.

2. traffic to 192.168.1.33 via lan0 and external router 192.168.1.59:
route add 192.168.168.3 192.168.1.59 1

doesn't work, because traceroute 195.71.104.21 says

traceroute: Warning: Multiple interfaces found; using 172.16.1.4 @ lan1

Thats the wrong interface, because this time he has to use lan0!

How can I bind the route to 195.71.104.21 on lan0?

Please help!

[harry d brown jr]

Kay,

What OS are you running? If 11, then do a man on "ndd" and change the value or ip_forwarding to 0

ndd -set /dev/ip ip_forwarding 0

live free or die
harry

[Vincent Fleming]

Please post your "netstat -rn" - it's hard to be sure about how to get this to work without that.

[Kay Liesenfeld]

Thanks Harry, thanks Vincent.

I'm using HP-UX 11.11. Setting IP-forwarding to 0 doesn't solve the problem.

Please have a look at netstat-output.

However, I doesn't really want to use the "route" command. The only thing I want is that the traffic to our external network (195....) is going over lan0 and router 192.168.1.1.

The internal traffic should go over lan1, and additionally all traffic to 172.18.3.1 over router 172.16.1.10. (this works!).

I'm sorry -- I've thrown some IP-addresses together in my first mail, but these addresses are correct.

I think I just need two gateways -- but how do I set up gateways and bind them to lan-devices?

Thanks in advance.

[Vincent Fleming]

Well, it looks like your routing table should work... but here are some suggestions:

route add default 192.168.1.1 1

will give you a default route that goes out lan0 to the router.

Also, I don't like host routes - network routes seem to work better for me.

I think this will solve your problem. Your network sounds a little complicated, and I'm not sure I've got it in my head correctly. Do you have a network diagram? Are you all class C?

[Kay Liesenfeld]

Vincent,

yes, that was my idea too. Unfortunately that would be too easy to work... ;-)

It sounds a bit complicated and I found nothing like this in the forums. But in fact it's really easy:

I just want to tell these IP-packets for 195... to go over lan0, not over lan1. As you can see at the traceroute-output, HP-UX tries to use lan1. But it will never get a response, because it uses the wrong ethernet device.

I heard something about a but in HP-UX, talking about routes and firewalls.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x573b7b8d1de3d5118ff40090279cd0f9,00.html

Between the server and the target 195... is a firewall which doesn't reply on ping. As a result HP-UX doesn't receive any answer on this route and turns it off. Something like this. Maybe that's the thing? I'll try it tomorrow.

[Vincent Fleming]

If what you're saying is that the router at 192.168.1.1 doesn't answer a ping, then I think that's your problem.

Can you have them make the router/firewall answer pings on your side of the fence? That's how I have my firewall configured - it doesn't answer pings from the internet, but it will from my internal network.

Let us know how you make out.

[Kay Liesenfeld]

Vincent,

yes I've tried it from another box -- the firewall doesn't reply on ping. But the device I want to reach THROUGH the firewall should.

I can't reconfigure the firewall, this is our admin's box and they doesn't want their box reply on ping.

There has to be a solution on HP-UX, maybe that patch the people in the link talked about.

[Christopher Caldwell · Accepted solution]

I don't believe you can test what you're trying to test with vanilla ping/traceroute on HP.

No matter what way you chalk it up, ping/traceroute will pick the "best route" to a destination according to the routing table.

On Cisco's you can use some thing called extended ping (I'm not sure if there's an extended traceroute), where you tell ping which interface or IP to use (it uses the closest interface to the destintation by default).

The routes look correct. If your client or server application binds to the correct IP, the right thing is going to happen (unfortunately I don't think traceroute from HP will is a valid test).

Given that your client/and or server work - the "best" test is to run a packet dump on the routers or run a sniffer on the LAN to show you that things are working correctly.

[Vincent Fleming]

To quote that link you posted:

***quote***
The fix it to load patches PHNE_20735 and PHNE_20316 and then put the
following entry into /etc/rc.config.d/nddconf

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0
***unquote***

This sounds worth trying.

Nice find! See - it really is worth searching the forums!

Let us know if this resolves your problem.

[Kay Liesenfeld]

Christopher, you are right.

1. Ping/traceroute only tests the first route available.

2. Our firewall doesn't reply on ping, but the external server I want to reach through the firewall does. Normally. Not the HP-UX-ping / traceroute, this seems to be the only problem I have.

Vincent, I tried the patches, but they're already included in 11i.

However, I tried the impossible: to reach the external server I cannot ping with other applications, e.g. Oracle (it's a database server). THIS WORKS!

What we learn: ping is not the only way to test a network connection... If no traceroute / ping comes thru, the route doesn't have to be dead... Just try other possibilities.

I banged by head on a wall because of searching for this traceroute-problem for about 12 hours... ;-)

Thank you all for your help!

Greetings
Kay.

[Steven Sim Kok Leong]

Hi,

If you want to test the network connection to an Oracle database server, then you should use tnsping, an Oracle provided tool in the network/admin subdirectory to test network connectivity at the Oracle listener layer.

Hope this helps. Regards.

Steven Sim Kok Leong