linux下雙網卡能不能設置同一網段？

01-29

伺服器操作系統：rhel7.0；主板自帶兩個網口，暫稱為1口、2口；設置IP分別為192.168.1.11、192.168.1.21；網關為192.168.1.1；
工控機1 操作系統：XP ；主板網口1（IP：192.168.1.15,；網關：192.168.1.1）通過直連網線連接到伺服器網口1；
工控機2 操作系統：XP ；主板網口1（IP：192.168.1.4,；網關：192.168.1.1）通過直連網線連接到伺服器網口2；
要求：伺服器兩個網口與2台工控機可以同時通信；不需要兩台工控機通過伺服器來互相通信。
目前的情況為：伺服器開機後：

工控機1端ping伺服器網口1（192.168.1.11），可以ping通，ping網口2（192.168.1.21）也可以ping通；通過arp -a指令查看，伺服器兩個網口都對應的網口1的物理地址；
工控機2ping伺服器兩個網口（192.168.1.11、192168.1.21）都ping不通；此時若在伺服器端將網口1down掉，工控機2則可ping通伺服器的兩個網口；但是工控機1此時就不能ping通伺服器的任何一個網口；
若將伺服器的兩個網口設置到不同的網段（192.168.1.11、192.168.2.21）；則工控機1隻能ping通網口1（192.168.1.11），工控機2隻能ping通網口2（192.168.2.21）；
疑問：linux下雙網卡不能設置到同一網段嗎？怎麼解決這個問題！！！抓狂！！！(╯‵□′)╯︵┻━┻

問題其實是出在路由表，當你將兩個網卡設置為同一個網段的時候，默認到該網段的路由，通常會被設置為後啟動的網卡。

也就是類似這樣的句子：

172.16.5.0/24 dev enp2s1 proto kernel scope link src 172.16.5.11 172.16.5.0/24 dev enp2s0 proto kernel scope link src 172.16.5.10

路由是有順序的，所以你看到兩個這樣的句子，工作的只有第一句。

解決的方法是，給每個網卡分配單獨的路由表。並且通過 ip rule 來指定。

詳細的東西請參考《Linux 高級路由》Linux Advanced Routing amp;amp;amp; Traffic Control HOWTO，我這裡只給出簡單的命令參考。

ip route add 172.16.5.0/24 dev enp2s1 proto kernel scope link src 172.16.5.11 table 111 ip route add default via 172.16.5.1 dev enp2s1 table 111

到這裡，創建了一個單獨的路由表，111

接下來告訴系統，某塊網卡出去的時候只看這個路由表

ip rule add from 172.16.5.11 table 111

兩個網卡都這樣設置過以後，肯定能工作了。

補充兩個細節，很多都會發現，當 Linux 有兩個網卡地址，並且在同一個網段的時候，哪怕其中一個網卡不插網線，沒網線的 ip 地址也可以被 ping 通。這是為什麼呢？

因為 Linux 默認的 sysctl 規則，任意一個網卡會對自己所有的 ip 地址在 ARP 請求上作出響應。

當我們將兩個網卡配置在同一網段後，最好給 sysctl.conf 加上這樣的配置：

net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.default.arp_ignore = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.eth0.arp_announce = 2 net.ipv4.conf.eth0.arp_ignore = 1 net.ipv4.conf.eth1.arp_announce = 2 net.ipv4.conf.eth1.arp_ignore = 1


另一點是，在系統有多個路由表之後，我如何指定網路的出口呢？比如 ping，在不給任何參數的時候，ping 只會看默認路由表，看一下 man ping      
 -I interfac interface  is  either  an  address,  or  an interface name.  If interface is an address, it sets source address to specified interface address.  If interface in an interface name, it sets source interface to specified

             interface.  For IPv6, when doing ping to a link-local scope address, link specification (by the %-notation in destination, or by this option) is required.
所以你可以通過 ping -I 192.168.1.1 這樣的方式指定出口。

《Linux 高級路由》是非常基礎的系統知識，建議好好學習一下。

知乎的代碼塊真不好用啊

建議參考 Linux雙網卡設置IP屬於同一網段的問題 - zhaofuguang的日誌 - 網易博客

說的挺清晰的

linux內核的問題。解釋如下。

arp_announce/arp_ignore sysctl

The arp_announce/arp_ignore sysctl on interfaces is available at the Linux official kernel since 2.6.4 and 2.4.26. The description about arp_announce/arp_ignore taken from kernel documentation is as follows:

Linux 官方內核自2.6.4和2.4.26開始，interface上的arp_announce/arp_ignore系統調用就可用了。下面是內核文檔中關於arp_announce/arp_ignore的描述:

arp_announce - INTEGER

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests sent on interface:

0 - (default) Use any local address, configured on any interface

1 - Try to avoid local addresses that are not in the targets subnet for this interface. This mode is useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of their logical network configured on the receiving interface. When we generate the request we will check all our subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no such subnet we select source address according to the rules for level 2.

2 - Always use the best local address for this target. In this mode we ignore the source address in the IP packet and try to select local address that we prefer for talks with the target host. Such local address is selected by looking for primary IP addresses on all our subnets on the outgoing interface that include the target IP address. If no suitable local address is found we select the first local address we have on the outgoing interface or on all other interfaces, with the hope we will receive reply for our request and even sometimes no matter the source IP address we announce. The max value from conf/{all,interface}/arp_announce is used. Increasing the restriction level gives more chance for receiving answer from the resolved target while decreasing the level announces more valid senders information.

arp_ignore - INTEGER

Define different modes for sending replies in response to received ARP requests that resolve local target IP addresses:

0 - (default): reply for any local target IP address, configured on any interface

1 - reply only if the target IP address is local address configured on the incoming interface

2 - reply only if the target IP address is local address configured on the incoming interface and both with the senders IP address are part from same subnet on this interface

3 - do not reply for local addresses configured with scope host, only resolutions for global and link addresses are replied

4-7 - reserved

8 - do not reply for all local addresses

The max value from conf/{all,interface}/arp_ignore is used when ARP request is received on the {interface}

Disable ARP for VIP

To disable ARP for VIP at real servers, we just need to set arp_announce/arp_ignore sysctls at the interface connected to the VIP network. For example, real servers have eth0 connected to the VIP network with the VIP at interface lo, we will have the following commands.

echo 1 &> /proc/sys/net/ipv4/conf/eth0/arp_ignore

echo 2 &> /proc/sys/net/ipv4/conf/eth0/arp_announce

Or, if /etc/sysctl.conf is used in the system, we have this config in /etc/sysctl.conf

net.ipv4.conf.eth0.arp_ignore = 1

net.ipv4.conf.eth0.arp_announce = 2

Note that the arp_announce/arp_ignore sysctls must be setup correctly, before the VIP address is brought up at a logical interface at real servers.

題主好糾結，

我先來說個方案吧，

伺服器：網口1　地址：192.168.1.1　不用網關　　　網口1　地址：192.168.2.1　不用網關

工控機1 地址：192.168.1.2 　網關：192.168.1.1 接網口1

工控機1 地址：192.168.2.2 　網關：192.168.2.1 接網口2

伺服器開啟ipv4轉發兩個工控機就能互訪

你這麼做，讓伺服器如何選路呢？兩條路都去網關，路徑開銷都一樣，介面速率也一樣，如果我是路由器，我會選擇：一邊扔一個包。然後網關就瘋了。如果雙網卡都啟用的話，建議你使用綁定功能，起虛IP，讓網關認為這倆網卡實際上是一個。

為什麼不兩張網卡做bond -。-

網上的方法試過了，rc.local怎麼改都沒用。啊啊啊！！！