| 3:15 pm on Aug 15, 2005 (gmt 0)|
It can be tricky when you have two different interfaces that are both connecting to the Internet via different routers. When you ping the second interface from the Internet, the machine is probably responding to the ping via the first interface, but with a different IP address, the response would be invalid. If I'm right, that would explain why local pings work.
The key is the routing table, but you first need to decide exactly which IP's/subnets the second interface will communicate with.
| 9:50 pm on Aug 15, 2005 (gmt 0)|
What's happening is similar to what the above comment is saying, the packet comes in the right interface, then is sent out the wrong interface.
The problem is going to be that a stateful firewall on the "wrong" interface will see the packet coming back, but didn't see the first packet going in, so it's going to block the response packet as not being in it's connection table.
The basic problem is that the response packets are leaving from the wrong interface. Without more details about at least what operating system you are running (uname -a would be helpful), and preferably what services you plan to run on the new IPs (http via apache?), we aren't going to be able to offer specific advice about the best way fix the issue.
| 3:07 pm on Aug 16, 2005 (gmt 0)|
I believe the above is the problem, but don't know where to fix it :). Running Mandrake linux 10.2. 2.6.11-6mdksmp kernel, apache2.
(thanks for the help!)
| 4:17 pm on Aug 16, 2005 (gmt 0)|
What's the purpose of the second interface?
| 8:45 pm on Aug 16, 2005 (gmt 0)|
Got assigned a 2nd block of IP's that don't go through the ISP's firewall. THe first block on the other port do go through the ISP's firewall. Two seperate physical routes, thus I need two nic's.
And unfortunately I can't get all the IP's outside the firewall or inside. I've got to take the half and half.
| 2:01 am on Aug 19, 2005 (gmt 0)|
I have a machine that is multihomed with two different routers for each interface. I set up separate tables for routes from each IP address, to make sure packets go back out the interface they came in on.
# table 1 has rules for X.Y.151.5 (eth0)
ip route add X.Y.151.0/24 dev eth0 src X.Y.151.5 table 1
ip route add default via X.Y.151.254 table 1
ip route add 127.0.0.0/8 dev lo table 1
ip rule add from X.Y.151.5 table 1
# table 2 has rules for X.Y.131.5 (eth1)
ip route add X.Y.131.0/24 dev eth1 src X.Y.131.5 table 2
ip route add default via X.Y.131.254 table 2
ip route add 127.0.0.0/8 dev lo table 2
ip rule add from X.Y.131.5 table 2
And for default routes - where the connection is initiated from my server - I do load balancing across the two interfaces.
# for default routes, do load balancing
ip route replace default scope global nexthop via X.Y.151.254 dev eth0 weight 1 nexthop via X.Y.131.254 dev eth1 weight 1
| 3:51 am on Aug 31, 2005 (gmt 0)|
Yeah, Danny's got it.
For more details, see [lartc.org...]
The key is the "src" argument, which specifies to only use that route for packets from that source.