After an additional purchased IP address is mapped to a secondary network interface, you must ensure that the interface is active and recognized by the server operating system. This article explains how to check and configure a Linux server, and how to troubleshoot connectivity issues.
Note: In standard mapping mode, the operating system normally sees only the private IP address of the secondary network interface, not the additional purchased IP address. This is expected. Do not add the additional purchased IP address directly to the network interface configuration.
1. Required Information
Before you begin, confirm the following network and access settings:
- The additional purchased IP address is mapped to the specified private IP address of the secondary network interface.
- The secondary network interface and the server are in the same private network and subnet.
- The access rules associated with the secondary network interface allow the protocols and ports required by your service, such as TCP 22, 80, or 443.
The examples below use the following values. Replace them with the values from your environment:
| Configuration item |
Example value |
| Primary interface |
eth0 |
| Secondary interface |
eth1 |
| Private IP address of the secondary interface |
192.168.10.20/24 |
| Subnet gateway |
192.168.10.253 |
2. Check Whether the Secondary Interface Is Active
Log in to the server and run:
ip addr
Find the secondary interface, for example eth1, and check the following:
- The interface status is
state UP.
- The interface shows the private IP address configured for it.
Check the routing table:
ip route
route -n
Normally, a directly connected route for the subnet of the secondary interface should be present. Recent Linux distributions usually detect the interface and obtain its address automatically. If eth1 is UP and its address and routes are correct, continue to Configure the Application Service.
3. Configure an Interface That Is Not Active
Method 1: Use NetworkManager
This method applies to recent Linux distributions that use NetworkManager.
List the connection names:
nmcli connection show
If a connection already exists for the secondary interface, enable automatic address configuration:
sudo nmcli connection modify "Secondary interface connection name" \
ipv4.method auto \
connection.autoconnect yes
sudo nmcli connection up "Secondary interface connection name"
If no connection exists, create one:
sudo nmcli connection add \
type ethernet \
ifname eth1 \
con-name secondary-eth1 \
ipv4.method auto \
connection.autoconnect yes
sudo nmcli connection up secondary-eth1
Method 2: Use the Traditional Network Configuration File
This method applies to systems that use /etc/sysconfig/network-scripts/. Create or edit /etc/sysconfig/network-scripts/ifcfg-eth1:
DEVICE=eth1
TYPE=Ethernet
BOOTPROTO=dhcp
ONBOOT=yes
DEFROUTE=no
DEFROUTE=no prevents the secondary interface from replacing the primary interface as the default outbound path. After saving the file, reload the connection using the method supported by your system:
sudo nmcli connection reload
sudo nmcli connection up eth1
Warning: Changing network settings may interrupt your remote session. Back up the original configuration first, and make sure that you can use a console terminal to restore network access.
4. Configure the Application Service
The additional purchased IP address is mapped to the private IP address of the secondary interface outside the server. The application should listen on one of the following addresses:
0.0.0.0: listens on all IPv4 addresses on the server.- The private IP address of the secondary interface, such as
192.168.10.20.
Do not bind the service only to 127.0.0.1. In standard mapping mode, do not bind it directly to the additional purchased IP address.
Check listening ports:
sudo ss -lntup
For example, a web service should listen on 0.0.0.0:80, 0.0.0.0:443, or the corresponding port on the private IP address of the secondary interface.
5. Allow the Required Ports
Check both the access rules associated with the secondary interface and the server firewall. For firewalld, allow HTTP and HTTPS as follows:
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
To allow a custom port, such as TCP 8080:
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
Allow only the ports required by your services, and restrict the permitted source addresses whenever possible.
6. Force Return Traffic Through the Additional IP
For common web or SSH services that only receive connections from outside, no additional default-route changes are normally required when the interface and routes are already correct.
If the server has multiple interfaces and requests arrive but responses fail or leave through the wrong interface, configure policy-based routing using the private IP address of the secondary interface:
sudo ip -4 route add default via 192.168.10.253 dev eth1 table 1001
sudo ip -4 rule add from 192.168.10.20 lookup 1001
Check the configuration:
ip -4 route show table 1001
ip -4 rule show
This policy means that traffic with source address 192.168.10.20 leaves through eth1 and its gateway, keeping the request and response paths consistent.
Note: Routes added with the ip command are temporary and are lost after a reboot. After verification, save the rules as persistent configuration using the network management method supported by your Linux distribution.
7. Verify the Configuration
Check the Interface and Listening Ports
ip addr show eth1
ip route
sudo ss -lntup
Test External Access
From another device that can access the Internet, run:
curl -I http://ADDITIONAL_PURCHASED_IP
curl -kI https://ADDITIONAL_PURCHASED_IP
To test SSH:
ssh username@ADDITIONAL_PURCHASED_IP
Test the Selected Outbound Address
If policy-based routing is configured, specify the private IP address of the secondary interface when testing the outbound address:
curl --interface 192.168.10.20 https://ifconfig.me
The result should be the additional purchased IP address mapped to that private IP address.
8. Troubleshooting
- Check the interface status:
ip link show eth1
ip addr show eth1
If the status is state DOWN, enable the interface and check the system network configuration.
- Check the service listener:
sudo ss -lntup
Make sure the service is not listening only on 127.0.0.1 or the primary interface address.
- Check routes and policies:
ip route
ip rule
ip route show table 1001
- Check whether packets arrive:
sudo tcpdump -ni eth1
To capture a specific service port, for example:
sudo tcpdump -ni eth1 tcp port 80
- Check access controls:
Make sure the access rules for the secondary interface, network ACLs, the server firewall, and application-level restrictions all allow the required traffic.
9. Frequently Asked Questions
Why is the additional purchased IP address not shown by ip addr?
In standard mapping mode, the additional purchased IP address is not directly exposed to the operating system. The server only needs the private IP address of the secondary interface to be configured correctly.
Why can the server receive a request but not respond correctly?
In a multi-interface environment, the request and response may use different paths. Check the default route and, if necessary, configure policy-based routing based on the private IP address of the secondary interface.
Why does the interface or route stop working after a reboot?
Make sure the secondary interface is configured to start automatically, and save the verified route rules in the persistent network configuration supported by your operating system rather than using temporary commands only.
