FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 10-06-2010, 06:02 PM
Grant
 
Default IP aliasing problem

I'm trying to use a different SSL cert in apache2 for each of the two
domains on my server. I don't want to use SNI or subjectAltName
because of lacking browser support and I want to use port 443 for both
domains. I think this means I need to use separate IP addresses for
each of my domains. I have 5 usable IPs from my host and I've defined
2 of them in /etc/conf.d/net like this:

config_eth0=(
"1.2.3.1 netmask 255.255.255.0"
"1.2.3.2 netmask 255.255.255.0"
)

My apache2 config is not working as expected and I think its due to a
networking problem because eth0:1 reports no RX or TX stats:

# ifconfig
eth0 Link encap:Ethernet HWaddr [removed]
inet addr:1.2.3.1 Bcast:[removed] Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:46047 errors:0 dropped:0 overruns:0 frame:0
TX packets:65703 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6131194 (5.8 MiB) TX bytes:82568335 (78.7 MiB)
Interrupt:40

eth0:1 Link encap:Ethernet HWaddr [removed]
inet addr:1.2.3.2 Bcast:[removed] Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:40

Does anyone know how to get this working?

- Grant
 
Old 10-06-2010, 09:52 PM
Stroller
 
Default IP aliasing problem

On 6 Oct 2010, at 19:02, Grant wrote:
> ...I have 5 usable IPs from my host and I've defined 2 of them in /etc/conf.d/net like this:

>
> config_eth0=(
> "1.2.3.1 netmask 255.255.255.0"
> "1.2.3.2 netmask 255.255.255.0"
> )
>
> My apache2 config is not working as expected and I think its due to a
> networking problem because eth0:1 reports no RX or TX stats:
>
> # ifconfig
> eth0 Link encap:Ethernet HWaddr [removed]
> inet addr:1.2.3.1 Bcast:[removed] Mask:255.255.255.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:46047 errors:0 dropped:0 overruns:0 frame:0
> TX packets:65703 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:6131194 (5.8 MiB) TX bytes:82568335 (78.7 MiB)
> Interrupt:40
>
> eth0:1 Link encap:Ethernet HWaddr [removed]
> inet addr:1.2.3.2 Bcast:[removed] Mask:255.255.255.0
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> Interrupt:40

It's frustrating that you must conceal the IP addresses during a question like this, because it makes it harder to know whether you've misconfigured your host or just made a typo in transcription. It's probably clearer if you alter only the second octet of your IPs, and leave everything else otherwise intact.

However... if you have 5 usable IPs then your subnet mask will not be 255.255.255.0 - it'll be 255.255.255.248. See http://krow.net/dict/subnet.html
The broadcast address will also be affected. This is also known as a /29 subnet - IIRC you actually have 8 IPs assigned to you - one of them is used by the router, one of them is the broadcast, and the other is unused (the way 192.168.0.0 or 0.0.0.0 is normally unused).

Since your router has an IP in the same subnet, you'll know this is all working when you can ping the addresses of your webserver (1.2.3.1 & 1.2.3.2) from the router.

Alternatively, set up a second PC - e.g. your laptop - on the globally-addressable subnet, and try pinging from there.

The normal situation with a home router is that it has a globally-addressable IP on it's "WAN" interface and a private IP (192.168.x.y) on its LAN interface. When you start using your globally-addressable IPs behind the router you usually need to tell it so, and I'm guessing you haven't done that.

If your laptop is currently using 192.168.a.b with a default gateway of 192.168.0.1, then the packets will be sent to the router for routing. And if the router is in the default configuration usual for home users, it won't know there's a 1.2.3.z subnet on your LAN, and it'll be trying to route the packets out into the internet (and those poor little packets will probably get very confused when they reach your ISP and it sends them back again!).

You can triple-home by setting eth0:2 to 192.168.c.d, and can (depending on your bridge/router configuration) continue to use private addresses for additional machines if you have more hosts on the LAN than you have globally-addressable IPs. Watch out for default gateway and DNS stuff! You'll probably want to give your laptop 1 private + 1 global IP whilst you're testing.

If your router is a fully-configurable Linux box then say so, and someone will be able to point you in the right direction for this. It's been a long time since I messed with this. I'm still using an old Draytek Vigor here, and this is all done by checking a radio button and pasting IP addressy stuff into boxes in the web-based configurator. The router has to operate in bridging mode to do this - on a Linux router you need configure as a bridge and NOT as a router (or, I think, as both).
http://www.google.com/search?q=bridge+5+usable+ips

My initial reaction to your question was, "Oh, Grant, this is simple network stuff", but whilst writing this my memory has been roughly refreshed, and I realise it's really not terribly simple at all. I'm extremely rusty at all this, and I'm also very tired, so I'm not going to write any more right now.

Stroller.
 
Old 10-06-2010, 10:17 PM
Grant
 
Default IP aliasing problem

>> ...I have 5 usable IPs from my host and I've defined 2 of them in /etc/conf.d/net like this:
>
>>
>> config_eth0=(
>> * * * *"1.2.3.1 netmask 255.255.255.0"
>> * * * *"1.2.3.2 netmask 255.255.255.0"
>> )
>>
>> My apache2 config is not working as expected and I think its due to a
>> networking problem because eth0:1 reports no RX or TX stats:
>>
>> # ifconfig
>> eth0 * * *Link encap:Ethernet *HWaddr [removed]
>> * * * * *inet addr:1.2.3.1 *Bcast:[removed] *Mask:255.255.255.0
>> * * * * *UP BROADCAST RUNNING MULTICAST *MTU:1500 *Metric:1
>> * * * * *RX packets:46047 errors:0 dropped:0 overruns:0 frame:0
>> * * * * *TX packets:65703 errors:0 dropped:0 overruns:0 carrier:0
>> * * * * *collisions:0 txqueuelen:1000
>> * * * * *RX bytes:6131194 (5.8 MiB) *TX bytes:82568335 (78.7 MiB)
>> * * * * *Interrupt:40
>>
>> eth0:1 * *Link encap:Ethernet *HWaddr [removed]
>> * * * * *inet addr:1.2.3.2 *Bcast:[removed] *Mask:255.255.255.0
>> * * * * *UP BROADCAST RUNNING MULTICAST *MTU:1500 *Metric:1
>> * * * * *Interrupt:40
>
> It's frustrating that you must conceal the IP addresses during a question like this, because it makes it harder to know whether you've misconfigured your host or just made a typo in transcription. It's probably clearer if you alter only the second octet of your IPs, and leave everything else otherwise intact.
>
> However... if you have 5 usable IPs then your subnet mask will not be 255.255.255.0 - it'll be 255.255.255.248. See http://krow.net/dict/subnet.html
> The broadcast address will also be affected. This is also known as a /29 subnet - IIRC you actually have 8 IPs assigned to you - one of them is used by the router, one of them is the broadcast, and the other is unused (the way 192.168.0.0 or 0.0.0.0 is normally unused).
>
> Since your router has an IP in the same subnet, you'll know this is all working when you can ping the addresses of your webserver (1.2.3.1 & 1.2.3.2) from the router.
>
> Alternatively, set up a second PC - e.g. your laptop - on the globally-addressable subnet, and try pinging from there.
>
> The normal situation with a home router is that it has a globally-addressable IP on it's "WAN" interface and a private IP (192.168.x.y) on its LAN interface. When you start using your globally-addressable IPs behind the router you usually need to tell it so, and I'm guessing you haven't done that.
>
> If your laptop is currently using 192.168.a.b with a default gateway of 192.168.0.1, then the packets will be sent to the router for routing. And if the router is in the default configuration usual for home users, it won't know there's a 1.2.3.z subnet on your LAN, and it'll be trying to route the packets out into the internet (and those poor little packets will probably get very confused when they reach your ISP and it sends them back again!).
>
> You can triple-home by setting eth0:2 to 192.168.c.d, and can (depending on your bridge/router configuration) continue to use private addresses for additional machines if you have more hosts on the LAN than you have globally-addressable IPs. Watch out for default gateway and DNS stuff! You'll probably want to give your laptop 1 private + 1 global IP whilst you're testing.
>
> If your router is a fully-configurable Linux box then say so, and someone will be able to point you in the right direction for this. It's been a long time since I messed with this. I'm still using an old Draytek Vigor here, and this is all done by checking a radio button and pasting IP addressy stuff into boxes in the web-based configurator. The router has to operate in bridging mode to do this - on a Linux router you need configure as a bridge and NOT as a router (or, I think, as both).
> http://www.google.com/search?q=bridge+5+usable+ips
>
> My initial reaction to your question was, "Oh, Grant, this is simple network stuff", but whilst writing this my memory has been roughly refreshed, and I realise it's really not terribly simple at all. I'm extremely rusty at all this, and I'm also very tired, so I'm not going to write any more right now.
>
> Stroller.

Thank you for taking the time to write Stroller. This has really got
my head spinning. First of all, you're right about the netmask. It
is 255.255.255.248. I didn't have a good understanding of what a
netmask is so I thought it would be smart to change it for a public
message.

The server is remote and hosted so I don't have any control over the
router or network. I've gone back and forth with the host but they
insist that everything is fine on their end.

I'm confused because I have in apache2 config:

<VirtualHost 1.2.3.1:443>
...
SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
...
</VirtualHost>
<VirtualHost 1.2.3.2:443>
...
SSLCertificateFile /etc/apache2/ssl/www.example2.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/www.example2.com.key
...
</VirtualHost>

But if I request https://1.2.3.2 or https://1.2.3.2:443, I'm presented
with an SSL cert that has www.example1.com for the Common Name. I
used openssl to verify that the Common Name for www.example2.com.crt
is www.example2.com.

My knowledge of networking is weak and I'm unsure of where to look for
the problem.

- Grant
 
Old 10-06-2010, 11:12 PM
BRM
 
Default IP aliasing problem

----- Original Message ----

> Thank you for taking the time to write Stroller. This has really got
> my head spinning. First of all, you're right about the netmask. It
> is 255.255.255.248. I didn't have a good understanding of what a
> netmask is so I thought it would be smart to change it for a public
> message.
>
> The server is remote and hosted so I don't have any control over the
> router or network. I've gone back and forth with the host but they
> insist that everything is fine on their end.
>
> I'm confused because I have in apache2 config:
>
> <VirtualHost 1.2.3.1:443>
> ...
> SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
> SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
> ...
> </VirtualHost>
> <VirtualHost 1.2.3.2:443>
> ...
> SSLCertificateFile /etc/apache2/ssl/www.example2.com.crt
> SSLCertificateKeyFile /etc/apache2/ssl/www.example2.com.key
> ...
> </VirtualHost>
>
> But if I request https://1.2.3.2 or https://1.2.3.2:443, I'm presented
> with an SSL cert that has www.example1.com for the Common Name. I
> used openssl to verify that the Common Name for www.example2.com.crt
> is www.example2.com.
>

I would suggest setting up separate access and error logs for each virtual host
so you can see who is actually getting the connection, and then going from
there.
That will probably point out your real problem.

Ben
 
Old 10-06-2010, 11:34 PM
walt
 
Default IP aliasing problem

On 10/06/2010 03:17 PM, Grant wrote:


The server is remote and hosted so I don't have any control over the
router or network. I've gone back and forth with the host but they
insist that everything is fine on their end.


Hi Grant. I know less than you about networking, but I am curious
about the way you use the word 'host'.

I'm guessing that you are paying a third party (maybe some company
similar to rackspace.com) to serve your (two?) websites on their
hardware?

I'm also guessing that the third party is running apache on their
own servers, right?

These are newbie questions, but I'm hoping to focus our thoughts
on the parts of your questions that seem sorta vague to me.

I'm also hoping to learn something along the way, of course
 
Old 10-07-2010, 01:48 AM
Michael Orlitzky
 
Default IP aliasing problem

On 10/06/2010 06:17 PM, Grant wrote:
> I'm confused because I have in apache2 config:
>
> <VirtualHost 1.2.3.1:443>
> ...
> SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
> SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
> ...
> </VirtualHost>
> <VirtualHost 1.2.3.2:443>
> ...
> SSLCertificateFile /etc/apache2/ssl/www.example2.com.crt
> SSLCertificateKeyFile /etc/apache2/ssl/www.example2.com.key
> ...
> </VirtualHost>
>
> But if I request https://1.2.3.2 or https://1.2.3.2:443, I'm presented
> with an SSL cert that has www.example1.com for the Common Name. I
> used openssl to verify that the Common Name for www.example2.com.crt
> is www.example2.com.

Make sure you don't have SSLCertificateFile/SSLCertificateKeyFile
defined anywhere outside of the virtual hosts.
 
Old 10-07-2010, 03:02 AM
Grant
 
Default IP aliasing problem

>> I'm confused because I have in apache2 config:
>>
>> <VirtualHost 1.2.3.1:443>
>> ...
>> SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
>> SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
>> ...
>> </VirtualHost>
>> <VirtualHost 1.2.3.2:443>
>> ...
>> SSLCertificateFile /etc/apache2/ssl/www.example2.com.crt
>> SSLCertificateKeyFile /etc/apache2/ssl/www.example2.com.key
>> ...
>> </VirtualHost>
>>
>> But if I request https://1.2.3.2 or https://1.2.3.2:443, I'm presented
>> with an SSL cert that has www.example1.com for the Common Name. *I
>> used openssl to verify that the Common Name for www.example2.com.crt
>> is www.example2.com.
>
> Make sure you don't have SSLCertificateFile/SSLCertificateKeyFile
> defined anywhere outside of the virtual hosts.

It was ServerName. I had ServerName defined as www.example1.com in
/etc/apache2/vhosts.d/default_vhost.include. I removed it from there
and added it to each of my SSL VirtualHost blocks and now everything
works. I noticed that removing ServerName entirely works for Firefox,
but in that case SSL wouldn't work for either domain in Opera.

I thought ServerName was just a label like ServerAdmin. Should I be
OK only having it defined in each of my SSL VirtualHost blocks?

Thanks a lot for everyone's help with this. You helped me realize it
was an apache2 config problem.

- Grant
 
Old 10-07-2010, 07:32 AM
Stroller
 
Default IP aliasing problem

On 6 Oct 2010, at 23:17, Grant wrote:

>>> ...I have 5 usable IPs from my host and I've defined 2 of them in /etc/conf.d/net like this:
>>>
>>> config_eth0=(
>>> "1.2.3.1 netmask 255.255.255.0"
>>> "1.2.3.2 netmask 255.255.255.0"
>>> )
>>>
>>> My apache2 config is not working as expected and I think its due to a
>>> networking problem because eth0:1 reports no RX or TX stats:
>>>
>>> # ifconfig
>>> eth0 Link encap:Ethernet HWaddr [removed]
>>> inet addr:1.2.3.1 Bcast:[removed] Mask:255.255.255.0
>>> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
>>> RX packets:46047 errors:0 dropped:0 overruns:0 frame:0
>>> TX packets:65703 errors:0 dropped:0 overruns:0 carrier:0
>>> collisions:0 txqueuelen:1000
>>> RX bytes:6131194 (5.8 MiB) TX bytes:82568335 (78.7 MiB)
>>> Interrupt:40
>>>
>>> eth0:1 Link encap:Ethernet HWaddr [removed]
>>> inet addr:1.2.3.2 Bcast:[removed] Mask:255.255.255.0
>>> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
>>> Interrupt:40
>>
> ...
> Thank you for taking the time to write Stroller. This has really got
> my head spinning. First of all, you're right about the netmask. It
> is 255.255.255.248. I didn't have a good understanding of what a
> netmask is so I thought it would be smart to change it for a public
> message.
>
> The server is remote and hosted so I don't have any control over the
> router or network. I've gone back and forth with the host but they
> insist that everything is fine on their end.
>
> I'm confused because I have in apache2 config:
>
> <VirtualHost 1.2.3.1:443>
> ...
> SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
> SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
> ...

Suggest you first establish you can ping *both* IPs.

Stroller.
 
Old 10-07-2010, 04:32 PM
Grant
 
Default IP aliasing problem

>>>> ...I have 5 usable IPs from my host and I've defined 2 of them in /etc/conf.d/net like this:
>>>>
>>>> config_eth0=(
>>>> * * * *"1.2.3.1 netmask 255.255.255.0"
>>>> * * * *"1.2.3.2 netmask 255.255.255.0"
>>>> )
>>>>
>>>> My apache2 config is not working as expected and I think its due to a
>>>> networking problem because eth0:1 reports no RX or TX stats:
>>>>
>>>> # ifconfig
>>>> eth0 * * *Link encap:Ethernet *HWaddr [removed]
>>>> * * * * *inet addr:1.2.3.1 *Bcast:[removed] *Mask:255.255.255.0
>>>> * * * * *UP BROADCAST RUNNING MULTICAST *MTU:1500 *Metric:1
>>>> * * * * *RX packets:46047 errors:0 dropped:0 overruns:0 frame:0
>>>> * * * * *TX packets:65703 errors:0 dropped:0 overruns:0 carrier:0
>>>> * * * * *collisions:0 txqueuelen:1000
>>>> * * * * *RX bytes:6131194 (5.8 MiB) *TX bytes:82568335 (78.7 MiB)
>>>> * * * * *Interrupt:40
>>>>
>>>> eth0:1 * *Link encap:Ethernet *HWaddr [removed]
>>>> * * * * *inet addr:1.2.3.2 *Bcast:[removed] *Mask:255.255.255.0
>>>> * * * * *UP BROADCAST RUNNING MULTICAST *MTU:1500 *Metric:1
>>>> * * * * *Interrupt:40
>>>
>> ...
>> Thank you for taking the time to write Stroller. *This has really got
>> my head spinning. *First of all, you're right about the netmask. *It
>> is 255.255.255.248. *I didn't have a good understanding of what a
>> netmask is so I thought it would be smart to change it for a public
>> message.
>>
>> The server is remote and hosted so I don't have any control over the
>> router or network. *I've gone back and forth with the host but they
>> insist that everything is fine on their end.
>>
>> I'm confused because I have in apache2 config:
>>
>> <VirtualHost 1.2.3.1:443>
>> ...
>> SSLCertificateFile /etc/apache2/ssl/www.example1.com.crt
>> SSLCertificateKeyFile /etc/apache2/ssl/www.example1.com.key
>> ...
>
> Suggest you first establish you can ping *both* IPs.

Thanks Stroller. It's working now. I needed to define apache2's
ServerName differently for each VirtualHost. Strangely though, I
still don't get stats for RX/TX from ifconfig:

eth0 Link encap:Ethernet HWaddr [removed]
inet addr:1.2.3.1 Bcast:[removed] Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:923677 errors:0 dropped:0 overruns:0 frame:0
TX packets:1444212 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:124904402 (119.1 MiB) TX bytes:1880087116 (1.7 GiB)
Interrupt:40

eth0:1 Link encap:Ethernet HWaddr [removed]
inet addr:1.2.3.2 Bcast:[removed] Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:40

- Grant
 
Old 10-07-2010, 05:51 PM
BRM
 
Default IP aliasing problem

> ServerName differently for each VirtualHost. Strangely though, I

> still don't get stats for RX/TX from ifconfig:
>
> eth0 Link encap:Ethernet HWaddr [removed]
> inet addr:1.2.3.1 Bcast:[removed] Mask:255.255.255.248
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:923677 errors:0 dropped:0 overruns:0 frame:0
> TX packets:1444212 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:124904402 (119.1 MiB) TX bytes:1880087116 (1.7 GiB)
> Interrupt:40
>
> eth0:1 Link encap:Ethernet HWaddr [removed]
> inet addr:1.2.3.2 Bcast:[removed] Mask:255.255.255.248
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> Interrupt:40

Remember eth0:1 is an alias for eth0.

Your above info is slightly wrong in that eth0 should be listed as eth0:0; where
instead ifconfig is showing eth0 generic information and eth0:0 information
combined.
That's probably the source of your confusion.

Don't know how to remedy it though.

HTH,

Ben
 

Thread Tools




All times are GMT. The time now is 03:51 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org