544070 - cannot route to hg.mozilla.org while connected to build-vpn

Status: RESOLVED WONTFIX

(mozilla.org Graveyard :: Server Operations, task)

Description

[[e-mail] (:bhearsum)]

I just hit this issue today where I cannot route any traffic to hg.mozilla.org while connected to build-vpn with Viscosity:
host hgbitters-2:~ bhearsum$ host hg.mozilla.org
hg.mozilla.org has address 10.2.74.67
hg.mozilla.org has address 10.2.74.66
bitters-2:~ bhearsum$ ssh hg.mozilla.org
ssh: connect to host hg.mozilla.org port 22: Operation timed out

Once I disconnect from the VPN it works fine again:
bitters-2:~ bhearsum$ ssh hg.mozilla.org
No interactive shells allowed here!
Connection to hg.mozilla.org closed.


This is a pretty big issue for me -- working with hg.m.o and machines on build-vpn are things I have to do all day.

Comment 1

[Aki Sasaki (not active)]

Also seeing this & need to disconnect build-vpn to get to nagios as well.

Comment 2

[Aki Sasaki (not active)]

We appear to be unable to get to https://10.2.75.6/admin/login.php through build-vpn (bouncer).

Should we file new bugs for each issue or continue adding?

Comment 3

[Derek Moore [:dmoore]]

This is all as designed.

The build VPN is for access to build resources only. If you need to access MPT resources in addition to build, you should also connect to the MPT VPN. You may be connected to both VPNs simultaneously.

Comment 4

[Aki Sasaki (not active)]

Ok, that's good to know. But shouldn't hg.m.o be accessible with or without any vpn turned on?

Comment 5

[Derek Moore [:dmoore]]

The catch is that the hostname "hg.mozilla.org" (and many others) will resolve to a different IP depending on if you're talking to an internal or external DNS server.

If you're not connected to a VPN, you'll get the external IP. As soon as you connect to a VPN (build or MPT) you'll get the internal IP. If you're connected to only the build VPN, you'll get the internal IP but be unable to reach it due to the VPN segregation.