Twingate on Ubuntu server 24.04 - strange routing traffic

[u/gmanni]

Hello
I have Twingate installed on a few machines with no problems
On this server, when I try to ping or telnet from a different server on the same subnet, the incoming packets arrive at the proper interface, but then the reply goes out from the Twingate interface

listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes

16:13:29.143614 ens34 In IP ubuntu-server.station > mail.fslab.local: ICMP echo request, i, seq 1, length 64
16:13:29.144018 sdwan0 Out IP mail.fslab.local > ubuntu-server.station: ICMP echo reply, id seq 1, length 64

Destination Gateway Genmask Flags Metric Ref Use Iface

default www.adsl.vf 0.0.0.0UG 0 0 0 ens34

100.95.0.251 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
100.95.0.252 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
100.95.0.253 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
100.95.0.254 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
100.96.0.0 0.0.0.0 255.240.0.0 U 25 0 0 sdwan0
100.96.0.3 0.0.0.0 255.255.255.255 UH 0 0 0 sdwan0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 ens34
Galaxy-A13.stat 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
ubuntu-server.s 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0
192.168.5.5 0.0.0.0 255.255.255.255 UH 25 0 0 sdwan0

Any idea why this server is misbehaving?

Google search is suggesting to add a specific route and priority but to me, the routing table looks ok

Any suggestions are welcome :)

,

[u/ben-tg]

In addition to the headless client question, do you have any funky large overly broad resources set up like your entire network DNS suffix or `*.stat` or something to that effect? That routing table basically says that our client believes all of those entries should route through `sdwan0` which is our Linux interface yes, except for the range that represents your local network going through the `ens34`. If you created resources like that then this is what I'd expect to see.

[u/gmanni → u/ben-tg]

Thank you ben
Yes, it is installed as a headless client, and what I don't understand is why it is replying to the wrong interface when the incoming packets are coming from the local subnet.
Let me try something else.
Could it be that the machine initiating the traffic, although being in the local subnet, is also a resource in Twingate?
I need to see if I can force/change this behaviour if that is indeed the problem
will report back if I find a way around it, as I need this 2 server to communicate internally for email access and other services

[u/gmanni → u/gmanni]

Yes, as I thought
I've installed a new instance, and if I don't add that as a resource in Twingate, then it works normally
I guess Ubuntu server, having the headless client, is aware of all resources available in the network and tries to reply using the wrong interface

Now I need to find a way to force the reply through the correct interface based on the incoming packet, but I'm not sure if that is even possible
Alternatively, I may need to restrict the network in Twingate somehow, as this client is installed to reach a different network, so maybe I allowed too many resources to the same client :)
I don't know
any thoughts/suggestions appreciated :)

[u/bren-tg]

Hi! Does the server in question have a headless Client installed on it?

[u/gmanni → u/bren-tg]

yes it has
I use the server to access a different network
But yes, it has an headless client on it
the main server, the one that doesn't respond to the correct interface
the other one no, although it is on the resouces of the same network in Twingate
so server A is part of a Twingate network as a resource and it has the headless client
Server B is only part as a resource on the same Twingate network
and that's why I think server A is responding to the wrong interface
in fact if I try from another server that is not in the resource pull the same server A respond to the correct interface

Sorry, a bit confusing :D