[SOLVED] ping not working for all devices on LAN

[tarazed]

More newbie problems. As I have stated in the past, despite using UNIX/Linux for over 20
years I still have very little understanding of networking. At home there is a LAN
implemented via a router with an ethernet connection to machine A, the main workstation.
There is a wireless printer B and four other machines connected by wifi. They all have
ping enabled in the firewall and A can ping any of the other devices on the network.
All of the wifi machines can ping the printer and each other but cannot see A. I use ssh
regularly to login remotely or copy files and it is a nuisance to have to go to A
physically when I need to copy something from A to other machines. /etc/hosts.deny and
hosts.allow are empty on all the computers and the hosts file contains the current LAN IP
addresses of the relevant devices. MAC filtering is enabled on the router and is
complete. .ssh/known_hosts are all correct as well. The RSA keys are generated
automatically when I make an initial connection - I don't know how to do that manually.
So waht could be stopping the other computers from pinging A? The terminal simply hangs
until I do a Control-C. No error messages. How to diagnose this problem?

Len

[tarazed]

No change if the firewall on system A is temporarily disabled, so not a firewall problem.

[doktor5000]

Well, you are talking about different problems, first the ping issue but you're mangling ssh connection into it.
Let's sort out one first, then the other. In general you should use separate threads for separate problems.

What OS is system A running under, and how did you disable the firewall?
Also please show the output from pinging system A, and the routing table of the system you're ping from via

Code: Select all

netstat -rn

and the routing table from system A afterwards.

[tarazed]

Thanks for replying.

I find that if I can ping then I can use ssh, if no ping ssh does not work; just a rule of thumb (for me). The only way I know of manipulating the firewall is through the security section in mcc. Remember, I am totally ignorant and possibly pretty stupid. The OS is Mageia 3 but I think the problem was present in Mageia 2. The other workstation is 3, 1 laptop on 3 and a laptop on Mageia 2.

If I ping system A (from A presumably) it returns this:

Code: Select all

 PING belexeuli (192.168.11.2) 56(84) bytes of data.
64 bytes from belexeuli (192.168.11.2): icmp_seq=1 ttl=64 time=0.063 ms
64 bytes from belexeuli (192.168.11.2): icmp_seq=2 ttl=64 time=0.054 ms


On altair:

Code: Select all

[lcl@localhost ~]$ ping belexeuli
PING belexeuli (192.168.11.2) 56(84) bytes of data.
^C
--- belexeuli ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

[lcl@localhost ~]$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.11.1    0.0.0.0         UG        0 0          0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan0
192.168.11.0    192.168.11.3    255.255.255.0   UG        0 0          0 wlan0
192.168.11.0    0.0.0.0         255.255.255.0   U         0 0          0 wlan0


Then on A:

Code: Select all

[lcl@belexeuli ~]$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.11.1    0.0.0.0         UG        0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
192.168.11.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0


192.168.11.1 is the router but I haven't a clue what 169.254.0.0 is. The router is connected to a Virgin Media SuperHub by ethernet cable.

[doktor5000]

On altair:

[lcl@localhost ~]$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.11.1 0.0.0.0 UG 0 0 0 wlan0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0
192.168.11.0 192.168.11.3 255.255.255.0 UG 0 0 0 wlan0
192.168.11.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0


192.168.11.1 is the router but I haven't a clue what 169.254.0.0 is.

169.254.... is zeroconf aka avahi aka APIPA - automatic adressing, you have that by default, no need to worry about.
Problem is more that weird entry in the routing table on Altair - do you know how it got there?
Seems you have two gateway routes, one via 192.168.11.3 for your local 192.168.11.0 network, this is completely broken.

You should be able to remove it via

Code: Select all

route del -net 192.168.11.0 netmask 255.255.255.0 gw 192.168.11.3

[tarazed]

Yes, I had been wondering about the two gateways. I doubt if anything I did caused that. Anyway, your command removed the odd entry, and it did not appear on one of the laptops when booted. Still no contact with belexeuli (system A) from outside however but belexeuli continues to see the rest of the network. If the remaining entries in the router tables look OK to you would that suggest that something is wrong in the router itself? There are a lot of options, few of which mean much to me. The only thing that I have altered is the MAC filtering, which allows all devices on the LAN. The registration is performed via a wifi menu but the ethernet adapter is included. Could that be a mistake? Should wired devices be excluded from MAC filtering?

[doktor5000]

Well, what about network and internet connectivity in general for both hosts?

[tarazed]

Um. Not sure I understand. I have registered the wired interface in the MAC list and removed the wifi MAC because that adapter is unlikely to be used. At this stage I am completely stumped - don't know enough about how routers work. From belexeuli's point of view the network is all there but from any wifi device belexeuli is invisible except when there is a remote login from belexeuli. The latter means that information is passed back from the wireless device so there is a route which allows two way communication at that time. It does not make any sense to me that this cannot be initiated from the wifi side.

[tarazed]

I have decided that this problem is intractable so will have to shelve it. I spent some time poking around in the router and found no solution. I found out that you cannot set up a route to something on the same subnet as the router (don't laugh - the guy is cerebrally challenged). It looks like the policy of not allowing access from wifi to ethernet on the same subnet is hardwired into the router.

[oj]

Are the two interfaces on the same network? i.e are they both on a 192.168.1.0 network? Or is there separate dhcp on the router's wireless interface? If wifi has dhcp, maybe you could disable it. A request for an address would be forwarded upstream, which would probably be whatever dhcp is running on the wired ports.

[tarazed]

Yes, all the devices are on the same subnet as the router; 192.168.11.1 and upwards. I let the router dhcp assign addresses because if I assign them manually I have very little luck with wifi. The disadvantage of that is that addresses sometimes change which means I have to edit all the hosts files.

[doktor5000]

Well, some routers have security options to disallow wireless devices communicating to each other. This could be the case here.
Within the same subnet, you don't need any routes, you don't even need a standard gateway, if netmask is correctly set and both devices attached to the same router.

Can you please tell exactly which router you have currently?

[tarazed]

There seems to be no problem with one wifi device talking to any other wifi device on the same network. It is just the wired device which is blocked or invisible. My router is the Buffalo nFiniti which has four RJ11? sockets. One of these connects to the main workstation and another plugs into the VirginMedia SuperHub which simply acts as a modem (although it could be used as a wireless access point and router as well if not in modem mode). So the Buffalo is the gateway to the internet. And as I said before, the workstation (on ethernet) is able to communicate with any of the wifi devices; printer, laptops, but the laptops cannot initiate any communication with the workstation. It is an inconvenience but one whose provenance I would like to understand.

[doktor5000]

What's the model number, or can you give me a direct link to the documentation?
As "Nfiniti" is only part of the model, full name would be something like
Buffalo Airstation Nfiniti WZR-HP-G300NH or Buffalo Airstation Nfiniti WZR-HP-G300NV2

http://www.buffalotech.com/support_and_ ... umentation wants a model number, probably starting with "wzr" or "whr"
I've had a look at this one: http://www.buffalotech.com/support-and- ... .1-web.pdf
and it seems some relevant settings to check could be available under Network Config -> IP Filter

[tarazed]

Sorry to be so vague; it is a Buffalo Airstation Nfiniti WHR-G300N V2.

[doktor5000]

I've had a look at this one: http://www.buffalotech.com/support-and- ... .1-web.pdf
and it seems some relevant settings to check could be available under Network Config -> IP Filter

[tarazed]

Had a look at Security->IP filter - been there before. Only two directions available: Internet->LAN and LAN->Internet. Will search further.

[tarazed]

I am going to have to start a new topic. After a firmware update everything broke down. All the wireless connections have vanished and the wired connection to the router web page is very very slow. It can take minutes to change a page. Internet connection is flaky also. Will move this later. Might even have to get a new router.

[tarazed]

As you were... Back in business after working most of the night. Very poor connectivity until I changed from channel 6 to 5. Same picture as 24 hours ago; wifi to wifi fine, ethernet to wifi fine, wifi to ethernet nulla.

[tarazed]

Well, things deteriorated over a period of a few hours so I set the channel to auto. Fingers crossed.

[tarazed]

The network had become so unstable that I had to bin the router and replace it with an ASUS RT-N66U Gigabit router. That works a treat. Everything up and running so I tried the ping tests and found exactly the same behaviour, which would suggest that router networking does not allow wifi devices to send messages or open connections to wired devices on the same LAN/subnet. It would be interesting to hear if anybody can confirm or deny that.

[oj]

A lot of routers do have that feature. You should be able to allow the connections with some setting or other in the router's setup.

It might be the restriction is a default setting on routers sold in your 'jurisdiction.' I've never had this problem with any routers or switches I've used.

[tarazed]

Thanks oj. Your reply prompted me to look at every setting in the router interface. There was nothing that seemed relevant there so I went back to the firewall settings on the main workstation and found that under "which interfaces do you wish to protect?" both eth0 and wlan0 were checked. According to the fine print these should be unchecked to allow unrestricted exchanges on the LAN. Never noticed that before. Now unchecked and wifi to wired communication is established. Solved!

Thanks again to all who responded.

Len