Outgoing IP packets routing

[Enrico Venturi]

Hello colleagues,
I've a machine equipped with two LAN cards, configured on different IP subnetworks; even if the subnetworks are logically different, they are mixed through some devices (i.e. there's a hub where the two IP networks are connected to);
when the lan0 is unplugged I want that the outgoing IP packets are "blocked", instead they are sent through the lan1 (different subnetwork); we don't use default gateways; how can I force to route the outgoing packets ONLY on the LAN card belonging to the proper subnetwork?

BTW: this problem makes Kerberos fail when the lan0 (first one declared in the /etc/hosts) is unplugged but the lan1 is connected.

Thaks
Enrico

[Muthukumar_5]

We can control with route table entries there.

By deafult it will be routing every network entries using default entries. Can you post your routing and lan configurations as,

#netstat -rn
#netstat -in

#grep -v '^#' /etc/rc.config.d/netconf

we can modify routing informations so that we can send packets based on it via networks.

Example:

destination gateway



like that we can manage. You have removed default so that we can block any other packets transmission other than defined on routing can be blocked / not routed there.

May be because of hostname resolvation / ip-address resolvation , "Kerberos fail when the lan0 (first one declared in the /etc/hosts) is unplugged but the lan1 is connected" there.

check as nslookup hostname / ip-address

You have to use lan1 if you disconnect lan0 from the same network machine there.

[Prashant Zanwar_4]

What I understand from your question is You want to direct IP traffic to the card which is connected at the time.

In my view: This is possible as:

- Make your second NIC a standby one, when you disconnect the primary/main NIC, make the standby NIC to take over..there would be some sofware available for it.

- If you want to use both NIC's at a time and when one fails, other should take care of IP traffic of other. This is possible using IP Alissing. You have to put an alias in the DNS..(check for it)..
Or at application level you have to manage it by saying that "IP1:NIC1|IP2:NIC2" shall take care of your IP traffic.
For incoming traffic for your server, still it is difficult unless the applications are just internal..then you can change peers and client too in similar too. In theory it might be easy, but at application level you will have to do lot of things.
Try aliasing at DNS level, that would be best.

Thanks
Prashant

[Enrico Venturi]

No,
I want to direct subnetwork1 traffic to lan1
and subnetwork2 traffic to lan2.

[Sridhar Bhaskarla]

Hi Enrico,

If lan0 is unplugged, then the default behaviour is *not* to route all the packets through lan1 if they are on different subnets. In your 'netstat -rn' output you can see two routes with the flag "U" flag indicating that network is directly routed through the local interface. That route is determined automatically based on the IP address and subnetmask you configure for the interface.

Post for your 'netstat -rn'.

-Sri

[Prashant Zanwar_4]

IC..Hmm..

You have to address this at application level than at host level.

Applications shall not talk at hostname level. There shall communicate at NIC hardware address and/or IP address only.

Otherwise create a logical name to your host and talk on that level.

IP hostname
logicalhostname

As we do in serviceguard...use a logical hostname/package name for application.
This takes care of it.
Application are bind to talk on logical hostname level this time.

Prashant

[rick jones]

You _may_ (I've never tried it myself) get the behaviour you want if you set ip_strong_es_model to a value of 1.

[Mohanasundaram_1]

Hi Enrico,

You should look to disable IP forwarding. By default, I guess, this is enabled.

Search in this forum with that keyword for more details.

set the ndd parameter

ndd -set /dev/ip ip_forwarding 0

Edit /etc/rc.config.d/nddconf and put an entry like this

TRANSPORT_NAME=ip
NDD_NAME=ip_forwarding
NDD_VALUE=0

This will retain the ndd setting after reboots.

With regards,
Mohan.