Some networking problem, certain traffic ends up as martian

[Ovidiu]

So here goes:

one proxmox host - 4 LXC - 1 KVM

I had installed a graylog2 appliance as KVM and the host and the other 4 guests were sending their log files to the KVM on UDP port 514 and all was good until I decided to install graylog2 by hand into a LXC and get rid of the KVM.

Now I would have had to run graylog2 as root to receive on port 514 (below port 1024) I decided to listen on port 5140, added a "0" to all /etc/rsyslog.conf files on the host and guests like this:

#sending to graylog appliance
*.* @mygraylogserver:5140;RSYSLOG_SyslogProtocol23Format

And it seemed to work until I realized that one guest was not sending anything. A lot of hours of debugging later I noticed some funny log entries on my host inside /var/log/messages

Apr 01 22:35:00 alfred kernel:  [90279.439479] IPv4: martian source 51.xxx.xxx.85 from 51.xxx.xxx.80, on dev eth0

The from IP being the LXC which does not send its logs.

I have double checked any firewall is off, flushed the firewall on the one host where no logs are transferred, stopped it, nothing :-(

Do you think the martian error messages could be related?

There are more in there from/to other LXCs I only copied the relevant one here.

 

[Richard]

And it seemed to work until I realized that one guest was not sending anything. A lot of hours of debugging later I noticed some funny log entries on my host inside /var/log/messages

Apr 01 22:35:00 alfred kernel:  [90279.439479] IPv4: martian source 51.xxx.xxx.85 from 51.xxx.xxx.80, on dev eth0

The from IP being the LXC which does not send its logs.

How does ip configuration in both server and container look like?

 

[Ovidiu]

info taken from relevant /etc/network/interfaces

relevant host part:

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
        address  94.XXX.XXX.XXX
        netmask  255.255.255.0
        gateway  94.XXX.XXX.254
        broadcast  94.XXX.XXX.255
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        network 94.XXX.XXX.0

the guest whose packets are logged as martians:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 51.XXX.XXX.80
        netmask 255.255.255.240
        post-up ip route add 94.XXX.XXX.254 dev eth0
        post-up ip route add default via 94.XXX.XXX.254
        pre-down ip route del default via 94.XXX.XXX.254
        pre-down ip route del 94.XXX.XXX.254 dev eth0

iface eth0 inet6 dhcp

the guest which should receive the logs via port 5140 but doesn't:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 51.XXX.XXX.85
        netmask 255.255.255.240
        post-up ip route add 94.XXX.XXX.254 dev eth0
        post-up ip route add default via 94.XXX.XXX.254
        pre-down ip route del default via 94.XXX.XXX.254
        pre-down ip route del 94.XXX.XXX.254 dev eth0

iface eth0 inet6 dhcp

does that look alright to you?

 

[Ovidiu]

Any more advice here? The problem still persists :-(

 

[Rudo]

address 51.XXX.XXX.80 netmask 255.255.255.240

The network is ".80", the first host is ".81", you may want to try that as the address instead.

 

[Ovidiu]

oh, I see, would I have checked with a CIDR calculator I would have seen that with my 16 IP block I have only 14 usable IP addresses.
I think I was mislead by the dashboard of my provider, where I can assign reverse DNS and MAC addresses for all 16 IPs :-(