Debian – NetworkManager changes default routing policy

debiannetworkmanagerrouting

I have a machine with a built-in NIC (eth0), which serves as a DHCP server for a Raspberry Pi. I also have a USB 3G modem, which shows up as ethernet device eth1. eth0 has the static ip 192.168.100.1 in /etc/network/interfaces.
When I connect the Pi to the server, /var/log/syslog shows

NetworkManager[2366]: <info> Policy set 'Ifupdown (eth0)' (eth0) as default for IPv4 routing and DNS.

and after, ip route show gives

default via 192.168.1.100 dev eth0  proto static

I then need to manually

ip route delete default
ip route add default via 192.168.1.1

to get it to connect to the internet via the 3G modem again.
I am using CrunchBang Linux, based on Debian 7 wheezy, on the server, and the latest Raspbian on the Pi.

How can I choose the default pathway for NetworkManager to prefer?

Edit: here's my /etc/network/interfaces:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

allow-hotplug eth0
auto eth0
iface eth0 inet static
    address 192.168.100.1
    netmask 255.255.255.0

allow-hotplug eth1
auto eth1
iface eth1 inet dhcp

Note that I've changed /etc/NetworkManager/NetworkManager.conf to have

[ifupdown]
managed=true

because I want to be able to disconnect eth1, the 3G Modem, using nm-applet.
Here's /etc/NetworkManager/NetworkManager.conf:

[main]
plugins=ifupdown,keyfile

[ifupdown]
managed=true

Best Answer

If using GUI, try checking the "Use only for resources on this connection" checkbox.
If using the config files (like you are :) ), in the [ipv4] section add never-default=true .
If using commandline tools, run sudo nmcli con mod "connection name" ipv4.never-default yes

This way you will be able to delete the default route going in the tunnel & add your own.

Related Solutions

How to forward traffic across two Ethernet cards

Your issue is mainly the route configuration of the hosts. I assume your current setup is as follow:

enp1s0 interface has ip address 192.168.1.1/24
enp3s0 interface has ip address 192.168.176.1/24

For hosts between the two IP network to communicate, they need a dedicated entry in their routing table.

The hosts on 192.168.1.0/24 that need to access the IP camera need to know that 192.168.1.1 is the router for 192.168.176.0/24.
The hosts on 192.168.176.0/24 need a route to 192.168.1.0/24.

Now I assume that the static/DHCP configuration for the IP cameras is to route default traffic through 192.168.176.1, so they know where to send packets for the PCs. But the PCs on 192.168.1.0/24 have only one default entry the internet router. So any packet to 192.168.176.0/24 get sent there and lost.

You can either

configure your DHCP router on 192.168.1.0/24 to advertise a static route to 192.168.176.0/24 via 192.168.1.1 with the "classless static route" option
add manually 192.168.1.1 as a gateway to 192.168.176.0/24 on the PCs

You will also need to flush your iptables rules. The POSTROUTING rule will mess up the routing and the FORWARD rule is useless (unless you have a DROP policy).

iptables -t nat -F POSTROUTING
iptables -F FORWARD

Your cameras could see the PCs because they were configured with a default gateway of 192.168.176.1 and the nat POSTROUTING entry. For example if IP camera 192.168.176.10 sends a packet to PC 192.168.1.20, the packet will first be sent to 192.168.176.1 (enp3s0) the default gateway. The Ubuntu PC will forward the packet to enp1s0, rewriting the sender's address as its own, 192.168.1.1. When 192.168.1.20 replies the packet, it sends it back to the substituted address, 192.168.1.1. When the Ubuntu PC receives it, it knows it is a reply to the IP camera 192.168.176.10. So it rewrites the destination address to 192.168.176.10 and fowards it through enp3s0.

Now you don't want to mess packets with NAT, you just need IP routing. In the preceding example, the PC sees the camera IP address as 192.168.1.1, as it was substituted by the Ubuntu PC. Once you have set correct routes,

in a connection initiated by the PC to the camera, the PC will see the camera IP address as 192.168.176.10.
in a connection initiated by the camera to the PC, the PC will still see the camera IP address as 192.168.1.1 (NAT'ed address)

For simple IP devices, the second is unlikely to matter. But that could lead to buggy behaviour. As an example, if you had a managed switch and you wanted to use SNMP traps. You should delete the iptables -t nat -A POSTROUTING -j MASQUERADE rule.

One issue that will arise: Do you want your IP cameras to access the internet? If not, I would include an iptables FORWARD route to deny packets from 192.168.176.0/24 going anywhere except 192.168.1.0/24. If you wish to grant access, you will need to configure your router with a static route to 192.168.176.0/24.

Related Question