-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Daniel Daniel Hokka Zakrisson schrieb: > Oliver Welter wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Hi All, >> >> I am looking for help to setup my routing ;( >> >> Host: >> Homed in two different vlans >> >> vlan3@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue >> inet 82.135.58.9/25 brd 82.135.58.127 scope global vlan3 >> vlan4@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue >> inet 212.18.24.209/26 brd 212.18.24.255 scope global vlan4 >> >> Guest, having an interface only in vlan4 >> >> I tried different routing setups: >> hosts default route via vlan4 -> works >> >> hosts default route via vlan3 -> I see in the guest: >> 0.0.0.0 82.135.58.1 0.0.0.0 UG 0 0 0 * >> As the guest does not know about vlan3, I cant ping to networks other >> than those connected to vlan4 > > The guest not knowing about vlan3 isn't related at all, most likely it's > your upstream router on vlan3 that doesn't route packets coming from > foreign source addresses (those belonging on vlan4). I guess you are wrong - the guests are connected to a second NIC for the internal LAN, and as the default route is not in the current network, the first interface - which is the internal lan - is taken to send out the packets. Sniffing with tcpdump on a ping on 212.18.0.5 shows (212.18.0.5 is a DNS Server some hops away): IP 192.168.200.99 > 192.168.200.99: ICMP 212.18.0.5 unreachable - need to frag (mtu 1500), length 556 - -> this is going out on vlan4 with a wrong source address... !!! 13:35:19.145519 IP 212.18.24.193 > 192.168.200.99: ICMP time exceeded in-transit, length 36 - -> this one commes in on eth1 as expected >> * default route via both vlan concurrently >> bad idea - route -n shows both routes inside the guest. No routing if >> the first rule is the wrong vlan (thats soemwhat obvious) > > Only the first one will be used, unless you do round-robin using nexthop. > >> * source based routing entries with iproute2 >> removed the gerneal default route from the host, iproute2 settings are >> not imported to the guest - so no routing at all.... > > This is what you want. There's no such thing as "imported to guest", if > you set this up right, things will work. So, how do I "set this up right" Oliver - -- Protect your environment - close windows and adopt a penguin! PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF 8168 CAB7 B0DD 3985 1721 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFIy6aRyrew3TmFFyERAtuIAJ4pXidI79hGddJKc1xkN7+Nnx2OGwCfRKTr npDij/BERMoSy+Oc8wRFy8E= =rdUk -----END PGP SIGNATURE-----