Linux Policy Routing

[mattschwartz01]

I am having a routing issue. I have an IPSEC tunnel that goes from 172.16.0.4->192.168.1.1. From the PC (172.16.0.4) that is hosting the tunnel, I can reach anything on the 192.168.1.0/24 subnet. Likewise, from any machine on the 172.16.0.0/24 subnet I can reach 192.168.1.0/24.

However, from my 172.16.1.0/24 subnet, I am unable to reach 192.168.1.0/24 despite the static route on the gateway. Below is my routing table on the gateway:

50.243.53.224/29 dev br0 proto kernel scope link src 50.243.53.225
192.168.1.0/24 via 172.16.0.4 dev virbr1
172.16.0.0/24 dev virbr1 proto kernel scope link src 172.16.0.1
172.16.1.0/24 dev br1 proto kernel scope link src 172.16.1.1
169.254.0.0/16 dev br0 scope link metric 1006
169.254.0.0/16 dev br1 scope link metric 1007
default via 50.243.53.230 dev br0

Attempts to ping from 172.16.1.0/24 to any address on 192.168.1.0/24 give me the following:
Pinging 192.168.1.10 with 32 bytes of data:
Reply from 172.16.0.4: TTL expired in transit.
Reply from 172.16.0.4: TTL expired in transit.
Reply from 172.16.0.4: TTL expired in transit.
Reply from 172.16.0.4: TTL expired in transit.

Ping statistics for 192.168.1.10:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),


The virbr1 device is simply a virtual bridge because my server has several virtual machines in addition to being a router. If you could shed any light on this I would appreciate it.

Thank you!

Continue reading...