Every output describes the machine the command ran on. Before fixing anything, describe the connection as a whole.
A connection is described by its connection tuple: the addresses from and to, the protocol and the ports. Here it is 192.0.2.11 → 192.0.2.12, TCP, port 8080. The request on lab-node2 itself went from 192.0.2.12 to 192.0.2.12. That is a different connection, and its success says nothing about the neighbour.
Machines on one /24 network exchange packets directly: each one gets by with its connected route and needs no gateway. From the routing lesson: the server sends its reply by its own table — that is the return path. An exchange needs both tables: the client's on the way there, the server's on the way back.
| Machine | What to check on it |
|---|---|
lab-node1, the client |
the route to the server, the request to the site |
lab-node2, the server |
the listener, the filter, the route back to the client |
sudo ip -n lab-node1 route is the short form for ip commands in a namespace. Other programs are started with ip netns exec.
The lab-node1 table has one line: 192.0.2.0/24 dev lab0. There is no gateway and no default. Will a packet reach 192.0.2.12?
-
A gateway leads to other networks. A neighbour on the same
/24gets the packet directly, with no go-between. -
The reply follows the
lab-node2table, which has the same connected192.0.2.0/24. Without extra entries the reply comes back. -
A default route is for addresses outside the known networks.
192.0.2.12is inside192.0.2.0/24, andip route get 192.0.2.12showsdev lab0.
The connected network is enough to talk to neighbours on it. A gateway and default are needed for addresses outside 192.0.2.0/24.
Key points
- An observation belongs to the machine where the command ran; success on the server does not test the neighbour's request.
- The client's table picks the way to the server, and the server's table picks the way back.