The gateway in question has been up for years in one office space, connected
to the internet via ATT dsl (well, Pacbell, then SBC, then ATT -- you
know). I had two ip's running on the external interface, let's say
123.123.123.123
123.123.123.124 (alias)

The alias ip forwards connections to a Filemaker Pro server on the inside
lan. Everything works perfectly for ages. Then we move to a new office
space, with T-1 via Paxio. I replace SBC ip's with newly assigned Paxio
ip's. Gateway is ever so slightly broken: it will not route connections to
one specific domain on the internet. Unfortunately, that one single domain
is THE DOMAIN THAT BELONGS TO MY CLIENT AND SERVES THEM THEIR WEBSITE AND
EMAIL! If I disable the alias, everything is perfect, except we've lost
our Filemaker Pro access. The default gateway has been set, and I've tried
applying it both before, and after configuring the alias. One thing I
notice that is probably a clue: let's say the new numbers are

345.345.345.345
345.345.345.346 (alias)

Once these are up, pinging internet sites looks normal to me, except when I
ping the domain in question. When I ping that domain, the IP of that
domain is reported correctly (DNS is working), but the IP that it is being
pinged "from" happens to be the alias IP. That doesn't look right to me --
it should be pinging from the primary, shouldn't it? In any case, I get no
response, and an error that there is no route to host.

I use ipchains, but they are unchanged from before, so I rule them out. In
addition, I've tried flushing them, and the problem remains. There is
nowhere any reference in any of my scripts or chains to the domain in
question, or to the ip's that it resolves to.

I am utterly perplexed. I run this type of configuration here at my home
office, and in various other sites around the Bay Area, and I've just never
had this happen before. In this case, I'm even using the same hardware,
having only changed the ip's and subnet mask to accommodate the Paxio T-1.
I was careful in the move, just out of standard laziness, to keep the
internal and external interfaces the same as they were before. What the
$@$%^&%@! am I missing?

Any help welcome and NEEDED! Be rude if you want. I've got to get this
fixed!

Thanks,

Eric



--
----------------------------------------
Eric Thompson
eTc Computer Consultants
duetc@etc-consult.com
----------------------------------------

EricThompson a écrit :
> Gateway is ever so slightly broken: it will not route connections to
> one specific domain on the internet. Unfortunately, that one single domain
> is THE DOMAIN THAT BELONGS TO MY CLIENT AND SERVES THEM THEIR WEBSITE AND
> EMAIL!

Check your netmask on both interfaces.

--
Nicolas Bouthors -=- Tel : 06 20 71 62 34 -=- Fax : 01 46 87 21 99
NBi SARL -=- http://nbi.fr -=- nbouthors@nbi.fr

They look right. Internal: 255.255.255.0, external: 255.255.255.248

Eric


Nicolas BOUTHORS wrote:

> EricThompson a écrit :
>> Gateway is ever so slightly broken: it will not route connections to
>> one specific domain on the internet. Unfortunately, that one single
>> domain is THE DOMAIN THAT BELONGS TO MY CLIENT AND SERVES THEM THEIR
>> WEBSITE AND EMAIL!
>
> Check your netmask on both interfaces.
>

--
----------------------------------------
Eric Thompson
eTc Computer Consultants
duetc@etc-consult.com
----------------------------------------

> Any help welcome and NEEDED! Be rude if you want. I've got to get this
> fixed!

See if changing your MTU size helps. If it's just one of many internet
sites, that's what it normally ends up being for me. Something about
their servers or the route to them doesn't like talking with 576 sized
packets, or 1500 packets depending on the site.

ifconfig <interface> mtu <packet_size:1500==default>

Oh my GA-A-A-WD! You were right!

The netmask of an alias is supposed to default to that of its interface, but
it WASN'T. So specifying the netmask when I set up the alias fixed the
problem! I'm excited, as you can tell! (note lots of exclamation points)

I probably would have suffered over this for days, or weeks, before falling
on this. Thanks for the help.

I still don't know why only that one domain seemed unavailable. Everywhere
else was accessible. But HEY, whatever. It's fixed!

Thanks again.


Eric



Nicolas BOUTHORS wrote:

> EricThompson a écrit :
>> Gateway is ever so slightly broken: it will not route connections to
>> one specific domain on the internet. Unfortunately, that one single
>> domain is THE DOMAIN THAT BELONGS TO MY CLIENT AND SERVES THEM THEIR
>> WEBSITE AND EMAIL!
>
> Check your netmask on both interfaces.
>

--
----------------------------------------
Eric Thompson
eTc Computer Consultants
duetc@etc-consult.com
----------------------------------------

I'll put this info in my backpack for future. As I have never run into this
before, I've never had to specify packet size. Good to know that this
could cause the same type of problem.

As you'll see from my reply to Nicolas, this problem got fixed by specifying
the netmask for the alias (something that I didn't think I had to do --
supposed to default to that of the interface it's attached to).

Educational day.

Thanks for the input.

Eric


Shadow_7 wrote:

>> Any help welcome and NEEDED! Be rude if you want. I've got to get this
>> fixed!
>
> See if changing your MTU size helps. If it's just one of many internet
> sites, that's what it normally ends up being for me. Something about
> their servers or the route to them doesn't like talking with 576 sized
> packets, or 1500 packets depending on the site.
>
> ifconfig <interface> mtu <packet_size:1500==default>

--
----------------------------------------
Eric Thompson
eTc Computer Consultants
duetc@etc-consult.com
----------------------------------------