Static route produces host unreachable error

Question

I have a linux server with three interfaces - one for net, two internal, below are shown the internal ones:

eth1
inet addr:192.168.10.253
Bcast:192.168.255.255
Mask:255.255.0.0

eth2
inet addr:10.10.10.253
Bcast:10.10.10.255
Mask:255.255.255.0

Have one internal work machine with gate 192.168.10.253 and ip from that subnet and other with gate 10.10.10.253 and ip from its subnet. I need to be able to have access between those machines.

On the linux box I have the following routing table:

default via * dev eth0
10.10.10.0/24 dev eth2  proto kernel  scope link  src 10.10.10.253
* dev eth0  proto kernel  scope link  src *
192.168.10.0/16 dev eth1  proto kernel  scope link  src 192.168.10.253

I added a static route:

route add -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.10.253

and the result

10.10.10.0/24 via 192.168.10.253 dev eth1 scope link

but when I try to ping from eth1 an up and running interface 10.10.10.2 it always gives destination host unreachable. What am I missing as configuration?

The basic setup is shown here:

When I ping from eth1

ping 10.10.10.2 -I eth1
PING 10.10.10.2 (10.10.10.2) from 192.168.10.253 eth1: 56(84) bytes of data.
From 192.168.10.253 icmp_seq=1 Destination Host Unreachable

and when I ping from eth2:

ping 10.10.10.2 -I eth2
PING 10.10.10.2 (10.10.10.2) from 10.10.10.253 eth2: 56(84) bytes of data.
64 bytes from 10.10.10.2: icmp_seq=1 ttl=64 time=0.547 ms

Answer 1

As per your network diagram, there is no physical link from the 192.168.10.253 device to the 10.10.10.0/24 network so there is no way on Earth you should expect to get a response when you ping 10.10.10.2 out of eth1. The only way to ping 10.10.10.2 successfully is for the ping request to go out of eth2.

If you really need this to work, the solution is to connect 192.168.10.253 to 10.10.10.2 and create a route. How you do this depends on the nature of the two boxes. If they're servers they might have a second network port you can connect up (and configure appropriately). If they don't have a second network interface then you are probably out of luck without completely changing your network configuration. My suggestion, as you are probably in a bit of an XY problem, is to post a new question describing what you need to achieve, not how you are trying to achieve it.

Answer 2

You do not need another route to allow users of the private subnets to communicate. You only need the following commands:

iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth1 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

The first two commands tell the firewall to allow traffic to flow between the two private subnets, and the third command does the same at the kernel level. You need both.

That's all.