ping receives no packets, but tcpdump can see them coming in

Question

I'm migrating an old Ubuntu OpenVZ instance (Jaunty) to a new CentOS 6.3 host (using vzdump/vzrestore).

Now networking does not work properly. Facts:

It works just fine if a setup a new OpenVZ instance.
I can connect INTO the old instance perfectly well, but it cannot connect to the outside.
It cannot ping the host, nor anything else.
I've cleared all iptables rules both on host and inside the VE.

ping:

root@dolores:/# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
11 packets transmitted, 0 received, 100% packet loss, time 9999ms

At the same time within the VE:

17:49:12.730360 IP dolores > 8.8.8.8: ICMP echo request, id 59701, seq 1, length 64
17:49:12.735095 IP 8.8.8.8 > dolores: ICMP echo reply, id 59701, seq 1, length 64
17:49:13.730305 IP dolores > 8.8.8.8: ICMP echo request, id 59701, seq 2, length 64
17:49:13.735524 IP 8.8.8.8 > dolores: ICMP echo reply, id 59701, seq 2, length 64
17:49:14.730411 IP dolores > 8.8.8.8: ICMP echo request, id 59701, seq 3, length 64

This output occasionally occurs with some delay, I believe because tcpdump tries to reverse-DNS the ips involved:

17:47:20.977819 IP dolores.40623 > 213.133.98.97.domain: 60247+ PTR? 8.8.8.8.in-addr.arpa. (38)

I can run tcpdump on the host and get the same output immediately.

Of course, /sys/devices/virtual/net/venet0/statistics/rx_bytes is updating, and none of the /sys/devices/virtual/net/venet0/statistics/rx_ error files make a peep.

What's the deal? Where would I look now? The problem must be related to the Ubuntu VE itself, I assume, since it works with newly created ones.

Some more output in case it helps:

root@dolores:/# ifconfig -a
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:39652 errors:0 dropped:0 overruns:0 frame:0
          TX packets:39398 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3344760 (3.3 MB)  TX bytes:3303115 (3.3 MB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:78.46.236.xxx  P-t-P:78.46.236.xxx  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

.

root@dolores:/# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 venet0

On the host:

[root@olive ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
static.xxx.236. *               255.255.255.255 UH    0      0        0 venet0
78.46.236.xxx   *               255.255.255.224 U     0      0        0 eth0
link-local      *               255.255.0.0     U     1002   0        0 eth0
default         gw-wan2.little- 0.0.0.0         UG    0      0        0 eth0

``iptables -t nat -L && iptables -t filter -L && iptables -t mangle -L`` is completely empty on both host and VE. — miracle2k, Feb 23 '13 at 15:43
Everything is set to ALLOW. It's nothing obvious like that. Keep in mind that it works for newly created VEs. — miracle2k, Feb 23 '13 at 19:10
`ifconfig` and `route` are deprecated on linux. Please use `ip addr` and `ip route` instead. — BatchyX, Feb 23 '13 at 21:07
I know it's too late but were you able to figure out a problem? I'm facing a similar problem with kvm with linux bridges setup. — Abhijeet Rastogi, Dec 19 '14 at 09:34

score 1 · Answer 1 · edited Mar 30 '15 at 04:06

1

Had the same symptoms but not with a virtual machine. I've fixed it up. There was a problem with my SNAT setup and ip rule which didn't match.

Run ip route, should have one line...

default dev venet0  scope link

Run ip rule, should have 3 lines...

0:  from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default

edited Mar 30 '15 at 04:06

HalosGhost

4,732
10
33
41

answered Mar 30 '15 at 03:55

niknah

31
2

ping receives no packets, but tcpdump can see them coming in

1 Answers1