Skip to main content
added 1086 characters in body
Source Link
dirkt
  • 33.4k
  • 4
  • 53
  • 81

You have a rather complicated routing setup there, with four additional routing tables and extra routing rules for marks set by the firewall. This is almost certainly the problem. So look at the exta tables (ip route list table 99 etc.), look at the firewall rules (iptables -t table_name -n -L for all table_name), then figure out what is going on.

Edit

Routing tables and firewall tables (iptables) are completely different, so iptables -t main -n -L makes no sense because main is a routing table, not a firewall table.

Please edit question with output of ip route list table 97, ip route list table 98 etc. including 99 and 236. Also with output of iptables -t filter -n -L, iptables -t nat -n -L etc. including mangle, raw and any other table that may be mentioned in the rules. If the output is too long, put all in a pastebin and link to it.

There are plenty of tutorials on the web for iptables and policy routing if you want to do some reading. But even if we figure out what prevents the second address from becoming the source address, the more difficult task is to figure out why all these rules are there, what the person making these rules wanted to achieve, and how we can change the rules to make the second address work without breaking other stuff.

So if you are happy with the answer "because some sort of firewall rules prevent it", we can also leave it at that. :-)

You have a rather complicated routing setup there, with four additional routing tables and extra routing rules for marks set by the firewall. This is almost certainly the problem. So look at the exta tables (ip route list table 99 etc.), look at the firewall rules (iptables -t table_name -n -L for all table_name), then figure out what is going on.

You have a rather complicated routing setup there, with four additional routing tables and extra routing rules for marks set by the firewall. This is almost certainly the problem. So look at the exta tables (ip route list table 99 etc.), look at the firewall rules (iptables -t table_name -n -L for all table_name), then figure out what is going on.

Edit

Routing tables and firewall tables (iptables) are completely different, so iptables -t main -n -L makes no sense because main is a routing table, not a firewall table.

Please edit question with output of ip route list table 97, ip route list table 98 etc. including 99 and 236. Also with output of iptables -t filter -n -L, iptables -t nat -n -L etc. including mangle, raw and any other table that may be mentioned in the rules. If the output is too long, put all in a pastebin and link to it.

There are plenty of tutorials on the web for iptables and policy routing if you want to do some reading. But even if we figure out what prevents the second address from becoming the source address, the more difficult task is to figure out why all these rules are there, what the person making these rules wanted to achieve, and how we can change the rules to make the second address work without breaking other stuff.

So if you are happy with the answer "because some sort of firewall rules prevent it", we can also leave it at that. :-)

Source Link
dirkt
  • 33.4k
  • 4
  • 53
  • 81

You have a rather complicated routing setup there, with four additional routing tables and extra routing rules for marks set by the firewall. This is almost certainly the problem. So look at the exta tables (ip route list table 99 etc.), look at the firewall rules (iptables -t table_name -n -L for all table_name), then figure out what is going on.