<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">2014-02-26 15:10 GMT+01:00 Laine Stump <span dir="ltr"><<a href="mailto:laine@laine.org" target="_blank">laine@laine.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class=""><div class="h5">On 02/26/2014 02:56 PM, Michal Privoznik wrote:<br>
> On 25.02.2014 22:45, François Chenais wrote:<br>
>> Hello<br>
>><br>
>> I'm trying to setup a bridged guest on an ubuntu 13.10 but it doesn't<br>
>> work.<br>
>><br>
>> (Everything is ok with NAT)<br>
>><br>
>> Network sniffing shows that arp replies don't come back to the guest.<br>
>><br>
>><br>
>> Test 1<br>
>> ------<br>
>><br>
>> Guest : ping host_bridge_ip (ok)<br>
>><br>
>><br>
>><br>
>> Test 2<br>
>> ------<br>
>><br>
>> Guest: ping other_lan_host (KO)<br>
>><br>
>> other_lan_host<br>
>><br>
>> - receives arp who-is request<br>
>> - sends arp reply<br>
>> - arp -a shows the guest macaddr<br>
>><br>
>><br>
>> => Guest doesn't receive reply<br>
>><br>
>><br>
>> Test 3<br>
>> ------<br>
>><br>
>> other_lan_host ping the Guest (KO)<br>
>><br>
>> - arp -a shows "incomplete" addr<br>
>> - Guest receives nothing<br>
>><br>
>><br>
>> On Host<br>
>> -------<br>
>><br>
>> network tcpdump on bridge or vnet interfaces shows request but no<br>
>> reply ...<br>
>><br>
>><br>
>> Thanks in advance for help or ideas<br>
>><br>
>><br>
>> François<br>
>><br>
><br>
> I suspect firewall. By my experience 99% of network issues is caused<br>
> by firewall. Try flushing all tables and see if that helps.<br>
<br>
</div></div>..except that firewall problems usually prevent passing IP traffic, but<br>
not ARP requests and responses.<br>
<br></blockquote><div><br></div><div>... and tcpdump get IP traffic before FW .. and I have disable the FW ...<br><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Can the guest ping the host? </blockquote><div><br></div><div>Yes : see Test 1<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
If not, then you may have something setup<br>
incorrectly with the bridge. Send "ifconfig br0; ifconfig eth0; brctl<br>
show" (replacing "br0" with whatever bridge device you have, and "eth0"<br>
with the host physical ethernet that is attached to the bridge). The<br>
guest's vnetX (tap device) and the "eth0" should be attached to br0 (the<br>
bridge device), and br0 should have an IP address, but eth0 should *not*<br>
have an IP address.<br>
<br></blockquote><div><br></div><div>That's OK<br><br><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Is this host plugged into a switch port that is locked down to a<br>
particular MAC address? You may need to get the guest's MAC address<br>
enabled at the switch by your IT department.<br>
<br></blockquote><div><br></div><div>I'm the IT department, I'm doing those tests at home :)<br><br><br></div><div>It's works well at work on CentOS ...<br></div><div><br> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Another thing to check is whether or not the ARP request is ever making<br>
it out to the physical network device on the host - try running tcpdump<br>
there as well. I've never encountered a Linux system that rejected<br>
outgoing arp requests for any reason, but this sysctl makes me wonder<br>
how that might get screwed up:<br>
<br>
root@vlap /home/laine>sysctl -a | grep bridge<br>
net.bridge.bridge-nf-call-arptables = 1<br>
[...]<br>
<br>
<br></blockquote><div>I got 0 there ...<br><br><br>I've tried with an DSL box but, because I don't see reply on host, <br>I suspect a special configuration. So I used an alternate switch, <br>a netgear switch (GS608) but it fails to...<br>
<br><br><div>I just tried with a direct cable link between the host and other_computer<br></div><div>and ... ** it's working ... **<br></div><div><br></div>It seems the 2 switches don't support multiple mac on the same port !!! :/<br>
<br><br></div><div>I didn't expect this but it's not so surprising with low price hardware ...<br><br></div><div>Thanks all !!<br><br><br></div><div> François<br></div><div> <br></div><div>PS: do I have to change the subject with RESOLVE ?<br>
</div></div><br></div></div>