Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #273257 > unrolled thread

subnet subset blocked

Started byAdam Weremczuk <adamw@matrixscience.com>
First post2024-09-24 22:40 +0200
Last post2024-09-25 08:50 +0200
Articles 9 — 6 participants

Back to article view | Back to linux.debian.user

Contents

  subnet subset blocked Adam Weremczuk <adamw@matrixscience.com> - 2024-09-24 22:40 +0200
    Re: subnet subset blocked Dan Ritter <dsr@randomstring.org> - 2024-09-24 23:50 +0200
      Re: subnet subset blocked Adam Weremczuk <adamw@matrixscience.com> - 2024-09-25 12:40 +0200
        Re: subnet subset blocked Dan Ritter <dsr@randomstring.org> - 2024-09-25 14:20 +0200
          Re: subnet subset blocked Andy Smith <andy@strugglers.net> - 2024-09-26 04:00 +0200
        Re: subnet subset blocked Erwan David <erwan@rail.eu.org> - 2024-09-25 14:40 +0200
          Re: subnet subset blocked Adam Weremczuk <adamw@matrixscience.com> - 2024-09-25 15:40 +0200
    Re: subnet subset blocked George at Clug <Clug@goproject.info> - 2024-09-25 00:40 +0200
    Re: subnet subset blocked Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-09-25 08:50 +0200

#273257 — subnet subset blocked

FromAdam Weremczuk <adamw@matrixscience.com>
Date2024-09-24 22:40 +0200
Subjectsubnet subset blocked
Message-ID<Jqkud-eAjL-9@gated-at.bofh.it>
Hi all,

I've just launched a Debian 12 VM in VMware (ESXi 7.0.2) and installed 
apache2 / php / postgres stack on it + ssh access.

Generally we have 3 subnets (IPv4 only):

- 192.168.4.0/22 (Ethernet LAN) - which starts with 192.168.4.1 and ends 
with 192.168.7.254

- 10.10.10.0/24 (VPN1)

- 10.10.20.0/24 (VPN2)

The new VM runs at 192.168.4.12

I'm having a weird issue with accessing it:

DNS resolves fine.
I can ping and arp it from all addresses.
There is nothing is switches' config to restrict traffic.

I can access TCP services (22, 443) from 192.168.4.x, 10.10.10.x and 
10.10.20.x but not from 192.168.5.x (a subset of Ethernet LAN).
I have no active 192.168.6.x or 192.168.7.x hosts to test from.

I've done nothing special during OS installation and config.
There is no local iptables running on the VM.

I've run tcpdump on the VM and connections from all 192.168.5.x hosts 
are rejected with R (reset) flag.
It looks like some OS default or some kind of silent auto-ban causing it.
Access rejection only affects TCP services, ICMP - ping go through fine.

I've deployed probably a hundred of various machines in this environment 
but never had this kind of access issue before.

Any ideas?

Regards,
Adam

[toc] | [next] | [standalone]

#273258

FromDan Ritter <dsr@randomstring.org>
Date2024-09-24 23:50 +0200
Message-ID<JqlzX-eAW7-1@gated-at.bofh.it>
In reply to#273257
Adam Weremczuk wrote: 
> Hi all,
> 
> I've just launched a Debian 12 VM in VMware (ESXi 7.0.2) and installed
> apache2 / php / postgres stack on it + ssh access.
> 
> Generally we have 3 subnets (IPv4 only):
> 
> - 192.168.4.0/22 (Ethernet LAN) - which starts with 192.168.4.1 and ends
> with 192.168.7.254
> 
> - 10.10.10.0/24 (VPN1)
> 
> - 10.10.20.0/24 (VPN2)
> 
> The new VM runs at 192.168.4.12
> 
> I'm having a weird issue with accessing it:
> 
> DNS resolves fine.
> I can ping and arp it from all addresses.
> There is nothing is switches' config to restrict traffic.
> 
> I can access TCP services (22, 443) from 192.168.4.x, 10.10.10.x and
> 10.10.20.x but not from 192.168.5.x (a subset of Ethernet LAN).
> I have no active 192.168.6.x or 192.168.7.x hosts to test from.
> 
> I've done nothing special during OS installation and config.
> There is no local iptables running on the VM.
> 
> I've run tcpdump on the VM and connections from all 192.168.5.x hosts are
> rejected with R (reset) flag.
> It looks like some OS default or some kind of silent auto-ban causing it.
> Access rejection only affects TCP services, ICMP - ping go through fine.
> 
> I've deployed probably a hundred of various machines in this environment but
> never had this kind of access issue before.

What does 

ip route show

give you on the VM in question?

Are there other VMs on the same host that work properly for the
same tests?

-dsr-

[toc] | [prev] | [next] | [standalone]

#273268

FromAdam Weremczuk <adamw@matrixscience.com>
Date2024-09-25 12:40 +0200
Message-ID<JqxB7-eIri-1@gated-at.bofh.it>
In reply to#273258
On 24/09/2024 22:29, Dan Ritter wrote:

> What does
> 
> ip route show
> 
> give you on the VM in question?

ip route show
default via 192.168.4.1 dev ens192 onlink
192.168.4.0/24 dev ens192 proto kernel scope link src 192.168.4.12

BINGO!

192.168.4.0/24 is wrong, should say 192.168.4.0/22

Do you know why?

In /etc/network/interfaces looks correct:

allow-hotplug ens192
iface ens192 inet static
address 192.168.4.12
mask 255.255.252.0
gateway 192.168.4.1
dns-nameservers 192.168.4.3
dns-search mydomain.co.uk

[toc] | [prev] | [next] | [standalone]

#273269

FromDan Ritter <dsr@randomstring.org>
Date2024-09-25 14:20 +0200
Message-ID<Jqz9U-eJrQ-13@gated-at.bofh.it>
In reply to#273268
Adam Weremczuk wrote: 
> On 24/09/2024 22:29, Dan Ritter wrote:
> 
> > What does
> > 
> > ip route show
> > 
> > give you on the VM in question?
> 
> ip route show
> default via 192.168.4.1 dev ens192 onlink
> 192.168.4.0/24 dev ens192 proto kernel scope link src 192.168.4.12
> 
> BINGO!
> 
> 192.168.4.0/24 is wrong, should say 192.168.4.0/22
> 
> Do you know why?
> 
> In /etc/network/interfaces looks correct:
> 
> allow-hotplug ens192
> iface ens192 inet static
> address 192.168.4.12
> mask 255.255.252.0
  ^^^^
Spell this netmask instead.

-dsr-

[toc] | [prev] | [next] | [standalone]

#273290

FromAndy Smith <andy@strugglers.net>
Date2024-09-26 04:00 +0200
Message-ID<JqLXr-eQXV-3@gated-at.bofh.it>
In reply to#273269
Hi,

On Wed, Sep 25, 2024 at 08:01:45AM -0400, Dan Ritter wrote:
> Adam Weremczuk wrote: 
> > allow-hotplug ens192
> > iface ens192 inet static
> > address 192.168.4.12
> > mask 255.255.252.0
>   ^^^^
> Spell this netmask instead.

Spell it

address 192.168.4.12/22

(with no "netmask" line at all)

instead. 😀

Thanks,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#273270

FromErwan David <erwan@rail.eu.org>
Date2024-09-25 14:40 +0200
Message-ID<Jqztf-eJy8-1@gated-at.bofh.it>
In reply to#273268
Le 25/09/2024 à 12:30, Adam Weremczuk a écrit :
> On 24/09/2024 22:29, Dan Ritter wrote:
> 
>> What does
>>
>> ip route show
>>
>> give you on the VM in question?
> 
> ip route show
> default via 192.168.4.1 dev ens192 onlink
> 192.168.4.0/24 dev ens192 proto kernel scope link src 192.168.4.12
> 
> BINGO!
> 
> 192.168.4.0/24 is wrong, should say 192.168.4.0/22
> 
> Do you know why?
> 
> In /etc/network/interfaces looks correct:
> 
> allow-hotplug ens192
> iface ens192 inet static
> address 192.168.4.12
> mask 255.255.252.0
> gateway 192.168.4.1
> dns-nameservers 192.168.4.3
> dns-search mydomain.co.uk
> 
> 

It should be "netmask 255.255.252.0" or (I prefer) just set
"address 192.168.4.12/22"
without netmask (man says it is deprecated)

-- 
Erwan

[toc] | [prev] | [next] | [standalone]

#273273

FromAdam Weremczuk <adamw@matrixscience.com>
Date2024-09-25 15:40 +0200
Message-ID<JqApj-eK61-5@gated-at.bofh.it>
In reply to#273270
That was it, thanks everyone.

On 25/09/2024 13:39, Erwan David wrote:

> It should be "netmask 255.255.252.0" or (I prefer) just set
> "address 192.168.4.12/22"
> without netmask (man says it is deprecated)

[toc] | [prev] | [next] | [standalone]

#273260

FromGeorge at Clug <Clug@goproject.info>
Date2024-09-25 00:40 +0200
Message-ID<Jqmml-eBu1-1@gated-at.bofh.it>
In reply to#273257
Adam,

I doubt this is your issue. But there has been times when my VM's [virtual] MAC address is the same as another in the network.

You have not mentioned about firewalls?  Have you installed and configured any firewalls?

>From your VM can you ping and/or connect to a computer in the 192.168.5.x network?

>From at least two computers in the 192.168.5.x network can you ping or connect to your VM ?  (I presume not, from what you said).

George.





On Wednesday, 25-09-2024 at 06:31 Adam Weremczuk wrote:
> Hi all,
> 
> I've just launched a Debian 12 VM in VMware (ESXi 7.0.2) and installed 
> apache2 / php / postgres stack on it + ssh access.
> 
> Generally we have 3 subnets (IPv4 only):
> 
> - 192.168.4.0/22 (Ethernet LAN) - which starts with 192.168.4.1 and ends 
> with 192.168.7.254
> 
> - 10.10.10.0/24 (VPN1)
> 
> - 10.10.20.0/24 (VPN2)
> 
> The new VM runs at 192.168.4.12
> 
> I'm having a weird issue with accessing it:
> 
> DNS resolves fine.
> I can ping and arp it from all addresses.
> There is nothing is switches' config to restrict traffic.
>  
> I can access TCP services (22, 443) from 192.168.4.x, 10.10.10.x and 
> 10.10.20.x but not from 192.168.5.x (a subset of Ethernet LAN).
> I have no active 192.168.6.x or 192.168.7.x hosts to test from.
> 
> I've done nothing special during OS installation and config.
> There is no local iptables running on the VM.
> 
> I've run tcpdump on the VM and connections from all 192.168.5.x hosts 
> are rejected with R (reset) flag.
> It looks like some OS default or some kind of silent auto-ban causing it.
> Access rejection only affects TCP services, ICMP - ping go through fine.
> 
> I've deployed probably a hundred of various machines in this environment 
> but never had this kind of access issue before.
> 
> Any ideas?
> 
> Regards,
> Adam
> 
> 
> 
>

[toc] | [prev] | [next] | [standalone]

#273265

FromMichael Kjörling <c9bc136c6063@ewoof.net>
Date2024-09-25 08:50 +0200
Message-ID<Jqu0x-eGgq-3@gated-at.bofh.it>
In reply to#273257
On 24 Sep 2024 21:31 +0100, from adamw@matrixscience.com (Adam Weremczuk):
> I've just launched a Debian 12 VM in VMware (ESXi 7.0.2) and installed
> apache2 / php / postgres stack on it + ssh access.
> 
> Generally we have 3 subnets (IPv4 only):
> 
> - 192.168.4.0/22 (Ethernet LAN) - which starts with 192.168.4.1 and ends
> with 192.168.7.254
> 
> - 10.10.10.0/24 (VPN1)
> 
> - 10.10.20.0/24 (VPN2)
> 
> The new VM runs at 192.168.4.12

> I can access TCP services (22, 443) from 192.168.4.x, 10.10.10.x and
> 10.10.20.x but not from 192.168.5.x (a subset of Ethernet LAN).

To me this smells like a subnet mask length issue.

Triple-check that `ip a sh` shows the IP address and subnet mask that
you expect.

-- 
Michael Kjörling                     🔗 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web