can only ping locally - not network [message #31471] |
Tue, 01 July 2008 08:58 ![Go to next message Go to next message](/theme/ovz3/images/down.png) |
john32
Messages: 8 Registered: July 2008
|
Junior Member |
|
|
uname -a
Linux deb-prq1 2.6.16-026test020.1-ovz-i386-smp #1 SMP Thu Oct 26 21:57:45 UTC 2006 i686 GNU/Linux
vzctl --version
vzctl version 3.0.22
I did an apt-get upgrade, and it installed new versions of openvz and other various system files. After the installation was complete I rebooted for good measure, and the VMs turned back on properly, but I was unable to access them from the network/internet as before the upgrade.
I can ping VMs from other VMs, and ping the local machine from the VMs and vice versa - but anything on the network can only access the physical machine, not any of the VMs.
Each VM has a unique public IP.
cat /proc/sys/net/ipv4/ip_forward
1
Access to the physical machine seems unaffected, so I am hoping someone more familiar with OpenVZ can tell me what the problem is with my VMs...
|
|
|
|
Re: can only ping locally - not network [message #31486 is a reply to message #31479] |
Tue, 01 July 2008 16:42 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to next message](/theme/ovz3/images/down.png) |
john32
Messages: 8 Registered: July 2008
|
Junior Member |
|
|
I'm not surprised the kernel version is outdated - I will look into upgrading it once I figure out what the problem is with this.
in these examples XXX.XXX.XXX.130 is the VE
XXX.XXX.XXX.94 is the HN
From HN:
ip a l
2: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0
6: eth3: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:18:f3:b6:35:09 brd ff:ff:ff:ff:ff:ff
inet XXX.XXX.XXX.94/26 brd XXX.XXX.XXX.255 scope global eth3
inet XXX.XXX.XXX.131/26 brd XXX.XXX.XXX.255 scope global eth3:0
inet6 fe80::218:f3ff:feb6:3509/64 scope link
valid_lft forever preferred_lft forever
8: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:18:f3:b6:25:05 brd ff:ff:ff:ff:ff:ff
1: venet0: <BROADCAST,POINTOPOINT,NOARP,UP> mtu 1500 qdisc noqueue
link/void
XXX.XXX.XXX.130 dev venet0 scope link
XXX.XXX.XXX.64/26 dev eth3 proto kernel scope link src XXX.XXX.XXX.94
XXX.XXX.XXX.128/26 dev eth3 proto kernel scope link src XXX.XXX.XXX.131
default via XXX.XXX.XXX.65 dev eth3 src XXX.XXX.XXX.131
default via XXX.XXX.XXX.65 dev eth3
arp -n
Address HWtype HWaddress Flags Mask Iface
XXX.XXX.XXX.65 ether 00:04:23:AA:FF:DB C eth3
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
From VE:
ip a l
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
3: venet0: <BROADCAST,POINTOPOINT,NOARP,UP> mtu 1500 qdisc noqueue
link/void
inet 127.0.0.1/32 scope host venet0
inet XXX.XXX.XXX.130/32 scope global venet0:0
ip r l
192.0.2.1 dev venet0 scope link
default via 192.0.2.1 dev venet0
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
I may be able to check the tcpdump results a little bit later, but in the meantime maybe someone can spot a problem with some of those results. Thanks!
|
|
|
|
|
|
|
|
|
Re: can only ping locally - not network [message #32055 is a reply to message #31931] |
Thu, 17 July 2008 22:30 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to next message](/theme/ovz3/images/down.png) |
john32
Messages: 8 Registered: July 2008
|
Junior Member |
|
|
Please note, I used a different VE on the same HN for these tests, that is why the IP is 132 instead of 130.
Here is the arp after the neighbor add - before the add it only contained the first line.
arp -n
Address HWtype HWaddress Flags Mask Iface
XX.XX.XX.65 ether 00:04:23:AA:FF:DB C eth3
XX.XX.XX.132 * <from_interface> MP eth3
tcpdump on the external node shows the ping requests outgoing and host unreachables.
tcpdump on the HN shows one line like this for each ping:
arp who-has XX.XX.XX.132 tell XX.XX.XX.65
There were never any arp replies in the logs, which seems like the problem, though I am not sure how to fix this.
tcpdump on venet0 on HN does not receive any packets
I do not have tcpdump installed on the VE, so I cannot test from inside, but since the HN venet0 does not see any packets I doubt the VE would either.
[Updated on: Thu, 17 July 2008 22:43] Report message to a moderator
|
|
|
|
|
Re: can only ping locally - not network [message #32080 is a reply to message #32069] |
Fri, 18 July 2008 18:09 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) |
john32
Messages: 8 Registered: July 2008
|
Junior Member |
|
|
ip rule list
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
ip route list table all
XXX.XXX.XXX.132 dev venet0 scope link
XXX.XXX.XXX.131 dev venet0 scope link
XXX.XXX.XXX.130 dev venet0 scope link
XXX.XXX.XXX.64/26 dev eth3 proto kernel scope link src XXX.XXX.XXX.94
XXX.XXX.XXX.128/26 dev eth3 proto kernel scope link src XXX.XXX.XXX.131
default via XXX.XXX.XXX.65 dev eth3 src XXX.XXX.XXX.130
default via XXX.XXX.XXX.65 dev eth3 src XXX.XXX.XXX.131
default via XXX.XXX.XXX.65 dev eth3
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast XXX.XXX.XXX.64 dev eth3 table local proto kernel scope link src XXX.XXX.XXX.94
local XXX.XXX.XXX.131 dev eth3 table local proto kernel scope host src XXX.XXX.XXX.131
local XXX.XXX.XXX.130 dev eth3 table local proto kernel scope host src XXX.XXX.XXX.131
broadcast XXX.XXX.XXX.255 dev eth3 table local proto kernel scope link src XXX.XXX.XXX.94
broadcast XXX.XXX.XXX.255 dev eth3 table local proto kernel scope link src XXX.XXX.XXX.131
broadcast XXX.XXX.XXX.127 dev eth3 table local proto kernel scope link src XXX.XXX.XXX.94
local XXX.XXX.XXX.94 dev eth3 table local proto kernel scope host src XXX.XXX.XXX.94
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local ::1 via :: dev lo proto none metric 0 mtu 16436 rtt 9ms rttvar 15ms cwnd 99 advmss 16376 hoplimit 4294967295
local fe80::218:f3ff:feb6:3509 via :: dev lo proto none metric 0 mtu 16436 advmss 16376 hoplimit 4294967295
fe80::/64 dev eth3 metric 256 expires 2017154sec mtu 1500 advmss 1440 hoplimit 4294967295
ff00::/8 dev eth3 metric 256 expires 2017154sec mtu 1500 advmss 1440 hoplimit 4294967295
unreachable default dev lo proto none metric -1 error -101 hoplimit 255
132 is the only real VE on that list currently - 130 and 131 are added in the interfaces file on the HN as secondary IPs for eth3.
Also I got a warning (which I've never seen before) when I restarted 132 that proxy_arp was set to 0, so I set all instances of proxy_arp to 1 but that had no effect.
EDIT: somehow since posting on here the ip_forward got turned off (maybe the kernel upgrade you suggested changed my sysctl.conf?)
anyway, after adding these lines to sysctl.conf and rebooting, the VEs work again. Thanks for your help.
net.ipv4.ip_forward=1
net.ipv4.conf.default.proxy_arp=1
net.ipv4.conf.all.proxy_arp=1
[Updated on: Sat, 19 July 2008 06:42] Report message to a moderator
|
|
|