All packets dropped, Destination Net Unreachable pinging other Vodafone IP with same default gateway

[cf996]

My relative and I both have a Vodafone FTTP connection. Until around a month ago we could communicate directly with each other's static IP address.

It seems that something has changed and this is now no longer possible. When either IP pings the other, an ICMP "Destination Net Unreachable" packet is received from the default gateway. I notice that we both have the same default gateway (90.247.128.1) whereas previously we did not. I can communicate with either IP from other non Vodafone public IPs without issue, but I don't have access to another Vodafone public IP to try from. I believe that a change of default gateway has occurred and having both connections on the same default gateway is the issue.

Is there some kind of routing configuration issue on this gateway or other reason why this communication is no longer working?

[Cynric]

It may be worth checking your routers to see if ICMP Ping has been switched off.

[cf996]

I have had thinkbroadband.com quality monitors/ping graphs running on both IPs the entire time without any issue. There is no issue pinging the IPs from other hosts that I have access to. Only packets between the two Vodafone IPs have issues. There were no changes made to any config that would have caused this on my end, though it may be that previously the two IPs were not on the same default gateway.

To reiterate, ICMP packets are responded by the default gateway with a "Destination Net Unreachable". All other packets between the two Vodafone IPs are seemingly dropped.

[CrimsonLiar]

Even if the default gateways have changed, devices with the same gateway should still be able to ping each other.  It's something that you probably need CS to forward to a high-level tech, because if true, then the same setting could cause multiple issues!

[cf996]

I am having great difficulty getting support to understand the issue. Is there a way I can escalate the issue via the forum? The issue is almost certainly not related to the two accounts, but a configuration issue on Vodafone's gateways, such as reverse path forward filtering being enabled on an interface where it shouldn't be. I won't share the public IPs here but the gateway is 90.247.128.1.

[broadband_user]

Hello CF996,

Just to clarify, you're trying to ping the public router IP address of another Vodafone user? So there are two physical addresses involved?

You can ping other internet IP addresses from your Vodafone connection and you get a response?

But pinging another Vodafone router IP results in 'Request timed out'?

Pinging the same VF router IP from a non Vodafone ISP results in success?

You don't say what router you're on. On my VOX3 router there is a setting to enable pinging the WAN IP interface and it's disabled by default. You'll need to enable this first.

The only other thing I can think of is that VF are doing something odd with the firewall ruleset - on by default. Sadly, we don't have any control over this ruleset, it's either on or off. Unless you're confident about the security status of all your internally connected devices, then you really want this on all the time. Odd on, it's the 'Allow Ping to WAN interface' setting'. Try that first.

Incidentally, I tried pinging the gateway you listed on 90.247.128.1 and that timed out for me.

[cf996]

I appreciate you taking the time to answer. I normally use a different router but the issue occurs regardless of whether I am using the Vodafone router or not.

This first image shows pings working when being sent to the affected IPs from a non Vodafone IP.

These next images show what happens when I try pinging from one affected IP to the other (that are both using the same gateway).

For avoidance of doubt, here are my thinkbroadband charts for both IPs showing first octet. I don't have any filtering rules applied for ICMP:

If there is no route to the network, my guess is that reverse path filtering is turned on, when it should only used on the upstream (wider internet) facing side. I would also very strongly suspect that this issue would affect any other user pairs who are using the same gateway. This will affect a large number of users.

@Gemma Is there any way to escalate this issue to Vodafone's core networking team from here? I have already spent significant time trying to explain this to technical support, whose only advice is to reset the router. To be clear, this issue almost certainly affects all traffic between any two IPs that are connected to the same gateway. This means any online applications that make direct connections, such as voice/video, video games, can't be used between two users if they are on the same gateway.

I am happy to share my IP with anyone who is interested on the same gateway and wants to confirm this issue.

[broadband_user]

The one thing you've not tried is pinging someone on the VF network that has a different DG to you. I know this used to be your working configuration, but if you can get it to work against another VF IP on a different DG while  those on the same DG are failing then it's defo. a router config error on VF's side. My DG is 84.65.128.1. If you want to ping my router then use ****.****.****.****. I've turned on 'Allow Ping to WAN interface'. Let me know when you've done this. 

Regards.

[cf996]

Much appreciated. There are no issues pinging that IP from either of the connections.

I believe that prior to mid October, both connections were using different default routes. Prior to when I believe this change occurred there was no issue with communication whatsoever.

To anyone who has 90.247.128.1 as their default gateway, if they could try validating my theory by pinging "two hundred and twelve, two hundred and twenty nine, eighty, ninety four", and checking for the "Destination Net Unreachable" message it would be much appreciated.

[Ripshod]

Gotta luv the Edinburgh gateway, so much character and so many of us have been there recently! [/sarc]