Tag Info

Hot answers tagged

37

We run exclusively OpenBSD routers/firewalls to serve FogBugz On Demand. Unless you're operating in a transit role and need the extremely high pps throughput that purpose-built hardware and integrated software can provide, OpenBSD on solid hardware will be a more manageable, scalable, and economical solution. Comparing OpenBSD to IOS or JUNOS (in my ...


15

I found answer on my posting on nginx forum - http://forum.nginx.org/read.php?2,127854 The answer, in my case, is to set: request_terminate_timeout=30s in php-fpm config. Note, you can use values other than 30s also. I used it to match my value in main php.ini file which is: max_execution_time = 30 Thanks All. :-)


12

DEFAULT_ROUTE=$(ip route show default | awk '/default/ {print $3})' ping -c 1 $DEFAULT_ROUTE Should do what you want.


10

To print out only the default gw IP: route -n | grep 'UG[ \t]' | awk '{print $2}' To print out route information on all interfaces: route -n or route -rn


9

Here how it resolved my issue: make following changes to /etc/nginx/nginx.conf in http { section proxy_connect_timeout 600s; proxy_send_timeout 600s; proxy_read_timeout 600s; fastcgi_send_timeout 600s; fastcgi_read_timeout 600s; and then restart nginx /etc/init.d/nginx restart


8

pfsense Is a great FreeBSD based firewall, its very feature rich, easy to setup, and has an active community as well as support options. There are several people using it in commercial / production situations that are active in the forum. I use it at home and I'm pushing it at work, its a really well put together alternative. They even have a VM image for ...


8

If you are just looking at doing raw TCP/UDP packets (network testing) I would look at iperf. It supports both UDP and TCP. You set it up on both sides of the gateway, one will act as the client and the other the server.


8

A gateway and a router are essentially the same. The term "default gateway" is used to mean the router on your LAN which has the responsibility of being the first point of contact for traffic to computers outside the LAN. If your LAN has multiple routers, the router designated as a default gateway can notify your computer, using an ICMP redirect or other ...


7

Open up Network Connections and choose Advanced Settings from the Advanced menu. This will show you / allow you to config the ordering of NICs, service bindings for each NIC and service proivders.


7

Not to take this another route (pun)...but have you considered a single NIC in your machine pointing to a managed switch or firewall that is connected to both the DSL line and the T1? This way you eliminate the routing on the client workstation and let your networking equipment handle the default route(s) and failovers.


7

I just want my clients to connect to the VPN without having to disable their firewall settings, without changing global configuration with potential side-effects (the "security policy" solution) and without having to look at an ugly "Unknown connection" in the Network and sharing center. Is there any way I can do this? The ...


6

if 'redirect-gateway' is required for some but not all clients then add a 'client-config-dir' option e.g. client-config-dir /etc/openvpn/clients and inside that directory put files for each client CN, e.g. file Client1 would contain push-reset that way the servers don't get the 'redirect-gateway' pushed by default. HTH


6

The "default gateway" is simply the IP of the next hop for traffic that is not explicitly routed anywhere else. This will, almost certainly, be an IP address on an interface of a local router. However, it may not be an address on which you can manage the router. If this is for a "home-type network", the inside IP (your default gateway) and the management ...


5

Yes, you can. I've done it without even knowing it, and it worked. Apple AirPort Extreme 802.11n Base Stations actually routinely advertise their LAN-side IPv6 link-local address via IPv6 Router Advertisement, and my clients use it and successfully reach v6-only sites like http://ipv6.google.com/ and the non-mosaic dancing kame at http://www.kame.net/. I ...


5

This might not fix your problem but...any Hyper-V box should have one NIC dedicated to administering the host (ONBOARD NIC for HOST) and one or more NICs dedicated to the VMs (Additional NIC for Hyper-V). I would do this: Delete your existing Hyper-V network in Hyper-V manager. On the host, you should now have only 2 NICs visible, ONBOARD NIC and ...


5

Have a look at this: Using multiple gateways If you have multiple interfaces and you configure a default gateway for each interface, TCP/IP by default automatically calculates an interface metric that is based on the speed of the interface. The interface metric becomes the metric of the default route in the routing table for the configured default ...


5

You should familiriaze yourself with the notion of routing and use the route command.


5

I use firehol combined with a web interface that I developed to manage the configuration file. I really like firehol, it provides a simplier syntax then using iptables directly. You can use the firehol debug command to exactly what iptables commands are generated If you have an error in your configuration and you start the firewall, firehol detects the ...


5

ip route show 0.0.0.0/0 dev eth0 | cut -d\ -f3 is my entry :)


5

You can get the system's default gateway from the output of netstat -r or route


5

It might be simpler and easier to manage if you use a router that supports multiple WAN connections. You can then force certain types of traffic and/or specific sources and destinations to use the internet connection. We also have two internet connections and use a Sonicwall NSA240, and it works perfectly. All the clients point to a single gateway address.


5

If the box has enough CPU/memory/bandwidth, nothing at all; almost every modern computer couldn't care less about handling routing for a 100 MBit network, unless you really throw in lots and lots of rules.


5

Use a router that connects to both ISPs and can handle the fail-over between ISPs when one goes down.


5

Firstly, I would hazard a guess that 90% of the time it's the first IP address in your subnet (so, 10.10.5.0/24, it would be 10.10.5.1) - although my network has one on .17 and one on .23 (and nothing at all on .1); so make of that what you will. If it's a wifi network, you could listen in promiscious mode and look at what the most common destination for ...


5

You were on the right track - use the full 192.168.0.0/16 subnet and you'll have access to plenty of ip addresses (64k). You'll need to expand your DHCP server to publish these addresses and possibly change your netmask to 16 (255.255.0.0) rather than 24 (255.255.255.0) http://jodies.de/ipcalc?host=192.168.0.1&mask1=16&mask2=


5

You have the FORWARD filter set to DROP. So iptables is dropping all forwarding. If you want to keep it set to DROP, you need to add the following rule iptables -I FORWARD -i eth0 -s 192.168.0.0/24 -j ACCEPT iptables -I FORWARD -i eth1 -d 192.168.0.0/24 -j ACCEPT


5

Depends if you want that system to be able to communicate outside its subnet. If not, then it doesn't matter what you set the gateway to. But yes, the default gateway should be set to the router's LAN interface, unless you have an L3 switch with proper routing set up, in which case the default gateway would likely be one of the SVIs on the switch. With an ...


5

Your alternative approach could be achieved by using policy based routing. Something along the lines of (commands should be executed on GW1): # Create rule for matching the source address in route table 999 ip rule add from 1.2.3.4/32 table 999 # Add default router to the table ip route add default via <GW2> table 999 I don't have the possibility to ...


4

You can't drop ICMP fragmentation required messages. They're required for pMTU discovery, which is required for TCP to work properly. Please LART the firewall administrator. By the transparency rule, a packet-filtering router acting as a firewall which permits outgoing IP packets with the Don't Fragment (DF) bit set MUST NOT block incoming ICMP ...



Only top voted, non community-wiki answers of a minimum length are eligible