Two network cards, Linux

I understand like this

Isp(public ip 88.33.66.99)->router->eth1

now if you want to access your server from outside of your network like this

ssh root@88.33.66.99

then From router you will have to portforward 22 to eth1

this should allow any SSh  from outside to eth1 also for other services you need to do same portforwarding

You don't want to do this.

The box has one interface to your internal net.
If you want to give acces to "http" from outside, then

Outside <-> ext. FW <-> box (DMZ-IP with real IP or priv IP) -<-> int. FW <-> internal net

1) Access from "Outside":
via ext FW
 -- when priv IP (10.1.0.1)-> via NAT
 -- when real IP direct acces via real IP

2) Access fom internal net
 via int. FW from internal net

And one interface is enough, or you want to have failover interface (bonding)

Regards
Chris

It's a web server so I only really care about port 80 on both eth0 and eth1.

eth0 works great. IP address gets assigned by internal LAN, people can connect to it and use it. Great.

eth1 however doesn't work at all. It won't even get an IP address, even if I make it static and bind to MAC address router side. I would like the outside world (Internet) to use this eth1 to view websites hosted via Apache.


So what do you recommend I do? Create static routes or something?

By the way, we have 4 ISPs here at my company. For security reasons, I'd like to use one of the "spare" ISPs we have which is why I'm doing this with two network cards and not one.

Our current crappy Windows based web server uses two cards, was wondering if I could do the same with Linux.

fosiul01:

How can you advice "Any" ssh to a box having one interface to internal net. ? :(

This would open this box to "ANY" of the world.
This should never be done! IMO this is very bad advice.

Chris

What you are trying to do this, Redundancy .

have you hard of a concept call , Load balancing router ??

Suppose if you have 2 Isp line


and if you have a load balancing router
you can add both Isp line in one load balancing router, if Line goes is down WEb request will go via another Isp automaticaly

is that you trying to do ??if one isp is down all http trafiq reqest will go via another ISP??

@jimnix

I dont understand hats wrong with that ??

i will have 2 Ethernet card. adn 2 Isp would be connected in to those 2 Ethernet card , where is security concern ??

if you have 4Isp line then you should of think of Load balancing router concept so you dont have to go through all this hassle .

"Our current crappy Windows based web server uses two cards, was wondering if I could do the same with Linux."

but if you want to do hard way , Isp->router->eth1, then you can do this, i am not seeing any problem.

but if i would of you, I would of Put web server in DMZ

putting webserver in internal network could be a security problem

@@jimnixm, if you meant that putting a public server in internal network is a security issue, then i agree.
but the author already did that ..

Ok then, so far so good. Thanks for all the ideas so far everyone. I don't need to worry about load balancing or anything like that because it's an in-house system and only used by a few people.

Great idea on DMZ but I'd rather go down the ISP -> router -> eth1 route though as we tend to hog the main company ISP for remote management so best to get top bandwidth on a fresh line really. Plus, we have a spare ISP, why not use it.

So then, why won't my Linux box get a nice fresh DHCP IP from spare router? Is it because of IP address takings on eth0?

NIC #1 - eth0 (LAN):
IP Address: 10.0.0.8
Broadcast Address: 10.0.0.255
Subnet Mask: 255.255.255.0
Default Route: 10.0.0.5
Primary DNS: 10.0.0.1

This next bit doesn't work but I'd really like it to be:

NIC #2 - eth1 (WAN):
IP Address: 10.1.0.20
Broadcast Address: 10.1.0.255
Subnet MasK: 255.255.255.0
Default Route: 10.1.0.1

So how would you recommend best doing this?

so eth1 is connected to router

whats the Ip address of the router ??
is Dhcp enabled on the router ???

have you check the link between router and the eth1 ??

i am not seeing any problem why eht1 would not get IP from router, unless there is something wrong like LINK is down or you are not putting correct Ip

can you not try to put IP by hand in eth1 ??

IP Address of our "spare" router is 10.1.0.1

Yes DHCP is enabled on it. Yes I've checked the link between it. I've tried setting eth1 IP manually on linux box, no success. And I've tried setting it on router and with Bind to MAC address...still doesn't work.  (see first post... :p)

This is why I'm posting on Experts Exchange as I have run out of ideas!

My guess is that the linux box is punting all traffic trough eth0, Tx and Rx likewise. It's probably a system setting that needs changing. Any ideas? /etc/hosts? system-config/network-scripts?

Hello, you can't have 2 default routes assigned, thats probably your main issue. If you want the machine to be accessed only externally by the second nic, you should remove the eth0's default route from the configuration file and on-the-fly using the command "route delete default gw 10.0.0.5".
After that make sure the default route points only to 10.1.0.1, if no default route is set, add it with the command "route add default gw 10.1.0.1".

I agree with MiLLeNNiuM.

but by looking your ifconfig

eth1 is not getting any Ip


eth1 should of get Ip atleast

put the IP by hand in linux box , then enabled IP_forward

cat /proc/sys/net/ipv4/ip_forward
if result = 0 then will have to On it by this command :

echo "1" > /proc/sys/net/ipv4/ip_forward

then see if you can atleast ping to the router

fosiul01:

author is talking about:

eth0 (LAN) via DHCP
eth1 (WAN) fixed to router

and this is an secuity issue

fosiul01:

why should he activate ip_forward ?
This is not a router. And the Auther is not planning to use it as a router.

@jimnix
Will you be to more specifi what you meant by security issue ??

I also said in my post that putting a public server is in internal network is a security issue. and author should put the server in DMZ

but it can be done , if you secured your port from specifiq iP,  But again its webserver then offcourse there would be a security problem.

but the author said , he is aware of that.


With Respect to  you, I m just trying to have a discussion. Please dont take me in a wrong way( please)

about the Ip_forward, yes, you are right, it should be for router or internet sharing.. but my logic was, since he will have 2 network card, and as @MiLLeNNiuM mentioned that you can have only 1 default route, so logic was, by enabling ip_forward might allow him to ping to router ..

there is no harm to enabled , is not it ?? ( you can disabled any time)

@author
do this

Put the IP address manually in Linux Server eht1, Now connect a pc in the router , and from that pc try to ping the ip of eth1. see if you can ping ....

[administrator@apache ~]$ ping 10.1.0.1
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
From 10.1.0.20 icmp_seq=2 Destination Host Unreachable
From 10.1.0.20 icmp_seq=3 Destination Host Unreachable
From 10.1.0.20 icmp_seq=4 Destination Host Unreachable

That's with manually entering eth1 address on the linux box and with no 10.0.0.5 default GW on either eth0 or eth1.

I could try your IP forwarding suggestion I guess....

its because its not getting gateway for  10.1.0.1  

can you post the output of

netstat -nr

keep this one in mind

http://www.clintoneast.com/articles/multihomed.php  

if everything fails ...

[administrator@apache ~]$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.0.0        0.0.0.0         255.255.255.0   U         0 0          0 eth0
10.1.0.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1
0.0.0.0         10.1.0.1        0.0.0.0         UG        0 0          0 eth1


Is now the current netstat -nr. That is with both NICs having IP addresses entered in manually:

eth0 (LAN)
IP Address: 10.0.0.8
Broadcast Address: 10.0.0.255
Subnet: 255.255.255.0

eth1 (WAN)
IP Address: 10.1.0.20
Broadcast Address: 10.1.0.255
Subnet Mask: 255.255.255.0
Defalt Route: 10.1.0.1

and that is what linux connection manager says it is apparently atm.

By the way, I should note, on restarting network service (sudo service network restart) it says:
[administrator@apache ~]$ sudo service network restart
Shutting down interface eth0:                              [  OK  ]
Shutting down interface eth1:                              [  OK  ]
Shutting down loopback interface:                          [  OK  ]
Bringing up loopback interface:                            [  OK  ]
Bringing up interface eth0:                                [  OK  ]
Bringing up interface eth1:  RTNETLINK answers: File exists
Error adding address 10.1.0.20 for eth1.
                                                           [  OK  ]

If that helps. Weird problem isn't it. Not like we're trying to work out the trajectory of Earth satellites or anything lol.

Thanks for all the help so far everyone. Seriously, much, much appreciated.

Okies well here is teh report status on the commands MiLLeNNiuM posted (useful commands, thank you! I'll remember these for future reference):

[administrator@apache ~]$ sudo mii-tool eth1
eth1: negotiated 100baseTx-FD flow-control, link ok

[administrator@apache ~]$ sudo ethtool eth1
Settings for eth1:
      Supported ports: [ TP MII ]
      Supported link modes:   10baseT/Half 10baseT/Full
                              100baseT/Half 100baseT/Full
      Supports auto-negotiation: Yes
      Advertised link modes:  10baseT/Half 10baseT/Full
                              100baseT/Half 100baseT/Full
      Advertised auto-negotiation: Yes
      Speed: 100Mb/s
      Duplex: Full
      Port: MII
      PHYAD: 1
      Transceiver: internal
      Auto-negotiation: on
      Supports Wake-on: pumbg
      Wake-on: d
      Current message level: 0x00000001 (1)
      Link detected: yes


Right then, I'm gonna try another Cat5e cable lol. If this IS the problem I am very, very sorry for wasting your time. You have permission to hit me if it's a cable problem.

Are you directly connected to the router ? Is the cable crossover ?

Yup eth01 is directly connected to the router. I'm using another cable now. Look!

[administrator@apache ~]$ ping 10.1.0.1
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=255 time=0.745 ms
64 bytes from 10.1.0.1: icmp_seq=2 ttl=255 time=0.384 ms


So that's working! Hooray!

Ok, in essence of fairness, I'm gonna award points to everyone that helped. I'm really sorry for wasting your time over something as pathetic as a Cat5e cable. Nevertheless, with all the info and commands you've all posted, this should prove useful in the EE knowledge base.

Thanks again everyone. You have permission to hit me now =)

     Link detected: yes

eth1 has link.
did you check "network settings" on router ?
netmask ?
is router allowed to respond to pings ? (Firewall settings)

what was the outcome ??

eth1 WAN is now default connection. All traffic goes through that. eth0 is just there so I and local users can connect to the server. The Internet see's the server through eth1 and it see's the Internet through eth1.

Absolutely perfect. Thank you all.