🚀 go-pugleaf

> Problem chyba rozwiazany. Az wstyd sie przyznac, no ale... Virtuozzo
> domyslnie wlacza rp_filter na kazdym interfejsie. Z racji ze
> interfejsy podlaczone do SAN nie mialy bram ani nic, same czyste IP,
>  pingi lataly jak chcialy. Zreszta nie wiem czy do konca to prawda,
> bo dla mnie to bardzo dziwne bylo zjawisko, w kazdym badz razie odkad
> ustawielm rp_filter na 0 na interfejsach SAN, wszystko pieknie dziala.

a jaki miales poziom tego filtra ?

> Jedyne co mnie dziwi czemu jak pingowalem serwery w sieci to zawsze 8
> pierwszych pingow nie odpowiadalo...

to moze byc zwiazane z timerami protokolu RIP
rp_filter = 2 "nie lubi sie" z RIPem jak masz wiecej niz jeden link...



* From 2.2.14's Configure.help: 


* If you turn on IP forwarding, you will also get the rp_filter, which 
* automatically rejects incoming packets if the routing table entry 
* for their source address doesn't match the network interface they're 
* arriving on. This has security advantages because it prevents the 
* so-called IP spoofing, however it can pose problems if you use 
* asymmetric routing (packets from you to a host take a different path 
* than packets from that host to you) or if you operate a non-routing 
* host which has several IP addresses on different interfaces. To turn 
* rp_filter off use: 
* 
* echo 0 > /proc/sys/net/ipv4/conf/<device>/rp_filter 
* or 
* echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 



*And from networking/ip-sysctl.txt: 


* rp_filter - INTEGER 
* 2 - do source validation by reversed path, as specified in RFC1812 
* Recommended option for single homed hosts and stub network 
* routers. Could cause troubles for complicated (not loop free) 
* networks running a slow unreliable protocol (sort of RIP), 
* or using static routes. 
* 
* 1 - (DEFAULT) Weaker form of RP filtering: drop all the packets 
* that look as sourced at a directly connected interface, but 
* were input from another interface. 
* 
* 0 - No source validation.