Tag Info

New answers tagged

0

The free sophos appliance allow that


-1

Your PEM file is not the correct format. Checkout this post. http://projectzme.wordpress.com/2013/02/02/tip-sslproxymachinecertificatefile-returns-missing-or-encrypted-private-key/


2

Messing around with how your DNS servers find the root zone is a completely wrong approach to solving this problem. I can't imagine how it could possibly help. I can imagine how it could cause lots of things to break. The IP addresses of other resolvers than your own are not of importance to your setup. If you think you need to know the IP addresses of those ...


1

While you could set up load balancing software to balance your caching name servers, the easiest way to do it is to simply add more name servers to the network and the clients' configuration. Almost every operating system will randomly choose a name server out of the list it's given by DHCP or it's /etc/resolv.conf file, or whatever that particular OS uses ...


1

First of all, in my point of view, I think you should first clearly understand the distinction between forwarding and routing, which is often neglected. According to the book Computer Networks in page 240 by Lary L.Peterson, forwarding is a serials of actions the router will take once receives a package, including looking at its destination address, ...


0

You can achieve this using iptables u32 module. See: http://www.stearns.org/doc/iptables-u32.current.html and TCP packet filter based on TCP sequence


1

There are some problems with how you wrote your rules. -A POSTROUTING -j MASQUERADE This rule applies too broadly. You only need such rule for connections from the LAN leaving your network. One way to do that would be to specify which outgoing interface it applies to: -A POSTROUTING -o eth0 -j MASQUERADE Additionally your filter table does not make ...


1

In addition to Magellan's answer, do not use -j MASQUERADE, unless you really know what that does and must use it. Instead use -j SNAT --to <source address>. Second, your POSTROUTING rule needs to include -o eth0, otherwise it is MASQUERADEing connections coming back in as well, which your internal boxes probably have no idea how to handle.


2

Before one jumps straight into firewall rules, one should also perform a simple forwarding check. Rather like when one checks the power cord is plugged in before taking apart the hardware. Run: cat /proc/sys/net/ipv4/ip_forward If you get a zero, IPv4 will not forward. You'll need to turn this on. To turn it on immediately and ephemerally to verify ...



Top 50 recent answers are included