DocsICP FilingConsole
Documentation

Windows ECS: Internet access loss with a secondary IP

Updated at:
Copy as MD
Product
My Favorites

This topic explains why a Windows ECS instance loses Internet access after a secondary private IP address is configured and provides a solution.

Symptom

A Windows ECS instance cannot access the Internet after a secondary private IP address is configured.

Cause

In operating systems later than Windows Server 2008, Microsoft changed the source IP selection policy for outbound traffic. The system selects the IP address that has the longest matching prefix with the next hop IP address.

For example, assume a Windows ECS instance that runs a version later than Windows Server 2008 has the following configuration for its private IP addresses and gateway. Because the secondary private IP address (192.168.1.252) has a longer matching prefix with the next hop IP address (the gateway at 192.168.1.253) than the primary private IP address (192.168.1.14) does, the system gives the secondary private IP address higher priority. As a result, all outbound traffic originates from the secondary private IP address.

Private IP address

Binary address

Primary private IP address

192.168.1.14

11000000 10101000 00000001 00001110

Secondary private IP address

192.168.1.252

11000000 10101000 00000001 01111110

gateway

192.168.1.253

11000000 10101000 00000001 01111111

Solution

Note

  • Example OS: Windows Server 2022.

  • Primary ENI example: The steps use the primary ENI named Ethernet as an example. Replace this with your actual ENI name, such as Ethernet 2.

You can use the Netsh command to add a secondary private IP address. Setting skipassource=true prevents the system from using this IP address as the default source address for outbound traffic unless you explicitly specify it.

  1. Connect to the Windows ECS instance.

    For more information, see Use Workbench to connect to a Windows instance.

  2. In Windows PowerShell, run the ipconfig command to view the private IP addresses and gateway.

    If the primary private IP address has a shorter matching prefix with the next hop IP address than the secondary private IP address does, proceed to the next step.

    Note

    For more information about the matching prefix rule, see Cause.

    PS C:\Users\Administrator> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet:
   Connection-specific DNS Suffix  . . . . . . :
   Link-local IPv6 Address . . . . . . . . : fe80::99e0:a786:fca5:4601%5
   IPv4 Address. . . . . . . . . . . . : 192.168.1.14
   Subnet Mask . . . . . . . . . . . . : 255.255.255.0
   IPv4 Address. . . . . . . . . . . . : 192.168.1.252
   Subnet Mask . . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . . . . . : 192.168.1.253

  3. Open the Network and Sharing Center.

  4. Click Change adapter settings.

  5. Double-click the primary ENI, which is named Ethernet in this example. In the Ethernet Status dialog box, click Properties.

    In Control Panel > Network and Internet > Network Connections, the model for the primary ENI adapter is displayed as Red Hat VirtIO Ethernet Adapter.

  6. In the Ethernet Properties dialog box, double-click Internet Protocol Version 4 (TCP/IPv4).

  7. In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, select Use the following IP address, and then click Advanced.

    Important

    This action changes the IP assignment policy from automatic to manual. You must also configure the primary private IP address of the primary ENI in the following steps. Otherwise, you will lose your remote connection to the instance.

  8. In the Advanced TCP/IP Settings dialog box, configure the IP addresses.

    1. In the IP addresses section, ensure that only the primary private IP address and its corresponding subnet mask are listed. Remove any other IP addresses, including the secondary private IP address.

    2. In the Default gateways section, click Add and enter the default gateway address that you previously retrieved.

      After you complete these steps, the Advanced TCP/IP Settings dialog box shows the configured IP address (such as 192.168.1.14 with subnet mask 255.255.255.0) in the IP addresses section, and the added gateway (such as 192.168.1.253) in the Default gateways section.

  9. In Windows PowerShell, run the following command to set the skipassource parameter to true.

    Netsh int ipv4 add address <Interface> <IP Addr> [<Netmask>] [skipassource=true]

    The following table describes the parameters.

    Parameter

    Description

    Example

    <Interface>

    The ENI to which you want to assign the secondary private IP address.

    'Ethernet'

    <IP Addr>

    The secondary private IP address.

    192.168.1.252

    <Netmask>

    The subnet mask for the secondary private IP address.

    255.255.255.0

    Example command:

    Netsh int ipv4 add address 'Ethernet' 192.168.1.252 255.255.255.0 skipassource=true

  10. Verify that the ECS instance can access the Internet.