Hot answers tagged

8

You're doing two things there. Enabling IP forwarding. The OS X equivalent might be: sysctl -w net.inet.ip.forwarding=1 ...but since I don't know exactly what you're trying to do, this might be technically correct but unhelpful. Adding a largely unnecessary firewall rule. If you haven't changed the default policy for your FORWARD chain (iptables -P ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


4

The root cause of this problem were some implicit default routes that were not visible in the tables displayed by /sbin/route but were visible in tables displayed by /sbin/ip route and /sbin/ip rule. Then these tables were displayed it became apparent that a rule of this kind: default table route_eth0 via 10.11.11.1 dev eth0 was overriding this rule: ...


4

The SSH protocol has no way for clients to tell the server to bind to a certain address when doing a dynamic port forwarding, so no, you can't tell your SSH client to do it. You can't tell the OpenSSH server to do it either. It will blindly use getaddrinfo to connect to your remote host. The only way to fix is to configure your server so it does what you ...


4

Part of what got me wondering if there's something I'm missing is the question of why ip_forward isn't always set to 1 and instead defaults to 0 - like is there some security risk or undesired behavior if having it set to 1 in certain situations. If your system (as with many others) does not need to be a router there is no reason to enable routing. ...


3

What about your iptables rules? They look rather empty. I use the following rules, I am not sure if it would solve your exact problem though: # Allow TUN interface connections to OpenVPN server iptables -A INPUT -i tun+ -j ACCEPT # Allow TUN interface connections to be forwarded through other interfaces iptables -A FORWARD -i tun+ -j ACCEPT iptables -A ...


3

Your rule is correct. The problem you're having is because you're on a shared hosting plan at Godaddy.com. Putting the IP in here returns: Found 696 domains hosted on the same web server as 184.168.27.44 Since you're not the only site hosted on that IP, when a browser comes to the IP directly, the server doesn't know which site to return, so shows this ...


3

Linux IP forwarding is basically routing. It doesn't by itself proxy, or really alter the traffic at layer 3 and above at all. That said, if you want to have something that masks the location of traffic, you could consider setting up NAT using iptables to masquerade (or source NAT) the traffic so that the source IP is that of the linux server. This works ...


2

I think what you need is an HTTP proxy to do the rewriting of the request headers. IPTables doesn't parse the HTTP header and replace the domains in them. You should look at something like Nginx, or Squid for doing that, just something that understands and rewrites the HTTP request headers into the domain that you want. IPTables does not know any higher ...


2

You cannot do it with iptables even if you use the -d option as the domain names are loaded during iptables startup. The right way to do what you want to do is to use a proxy server like Squid.


2

Yes, in your configuration, assuming your network is routed properly, it should forward correctly. If you can ping FW from LN but not Internet from LN, you need to check your firewall rules on FW and routing rules on LN and FW. Verify that either LN has a public IP address, or your firewall is properly forwarding connections back to LN from the internet and ...


2

You haven't fully explained the problem you're trying to solve, just how you think you can solve it, then asked for other options... So this answer may be somewhat vague, but I'll give it anyway. Firstly, for the love of all things holy, AVOID NAT. Please. A unicorn cries everytime a new NAT is created. Solution 1 If your servers have public IP's, just ...


2

You can do it with something like this: Add a route on your gateway (or your desktop) route add -host 10.1.0.1 gw 172.16.9.8 Add a rule like this on the OtherBox iptables -t nat -A POSTROUTING -i eth0 -s 172.16.9.65 -d 10.1.0.1 -p tcp --dport 80 -j MASQUERADE


2

You need to enable IP forwarding somewhere: sudo sysctl -w net.ipv4.ip_forward=1 One of the place where it could be enabled is in /etc/sysctl.conf.d : echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.conf.d/routing.conf Additionnaly, your iptables rules: -A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE Will only enable NAT for hosts in ...


2

Short answer to your revised question is that there are two ways to do it; both require you remove the second NAT step (which destroys the info you're looking for). Your options after doing that are: 1) Make Server A the next hop for Server B for the traffic in question, which is why it works for your router as mentioned. This could be accomplished, in ...


2

I believe that's exactly what it would affect (assuming your DHCP client machine was running Linux, and your DHCP client supported that option[1]). Remember, DHCP stands for Dynamic Host Configuration Protocol. While it is most commonly used for just supplying the most basic network information (IP Address, default route, DNS servers), it was designed to ...


2

Ok, after a small chat with Yahia Zakaria I managed to pinpoint the problem. The app uses more than TCP to communicate, so the proper DNAT should look: iptables -t nat -A OUTPUT -d 192.168.1.15 -j DNAT --to-destination 54.3.22.1 And that's basically it.


1

Routing RFC1918 subnets over the public internet is unreliable at best, and is frequently impossible due to public internet routers being configured with ACLs that drop RFC1918 subnets (and others that shouldn't be on the public internet). You'll need to build up some sort of VPN tunnel for this traffic. I'd recommend IPSec.


1

The networking layer receives the packet for MAC 22:22:22:22:22, but since the MAC address does not belong to tap1, the packet is ignored. Setting the interface to promiscuous does not disable that check, it only moves it to later in the network code. Forwarding packets that have a MAC destination that is not that of the interface the packet is received on ...


1

There is no inherent insecurity with IP forwarding itself, other then how your firewall is configured, if they are the same machine. On the contrary, it can provide some sort of security by hiding the real server ip. By enabling ip_forwarding one can turn a linux box into a router (that can do packet forwarding between networks) which is not always needed ...


1

ip_forwarding: ip_forwarding could be dangerous in situations where public ip addresses are used. A newly installed Linux machine could then be used as a router for networks that are not supposed to be routed this way. iptables: The main problem with your iptables setup is probably the routing on the new machine. That machine has to use the old machine as a ...


1

You can use haproxy for this. The config can be found below: global chroot /var/lib/haproxy pidfile /var/run/haproxy.pid maxconn 4000 user haproxy group haproxy daemon stats socket /var/lib/haproxy/stats defaults mode http option abortonclose no option ...


1

You need to set trusted proxy. In that case getClientIp() will use X-Forwarder-For header to get client IP address.


1

Ok, I found the problem. I am running windows server 2012 and turning on IP forwarding was not enough.. I had to enable LAN routing in "Routing and remote access" in server manager by right - clicking "configure and enable routing and remote access" and following the steps in the wizard..


1

The problem can be at two different layers: at the forwarding level: ipforwarding can be disabled, or iptables rules be misconfigured at the routing level: your corporate network must be informed that the various 10.2.80.x networks can be reached via IP 10.2.82.195. If this is not possible, you had to "masquerade" (NAT) yours 10.2.80.x network using the ...


1

I have moved data centers a few times, with a full class C block changing along with the move. It is wise to use conntrack in iptables as well as snat. Here is a handy little script I used a few times. Simple and works like a charm. Add additional ports as needed. Once DNS has refreshed and you have no more connections, remove the iptables rules. ...


1

You also have to make sure that -A Forwarding is not set to ACCEPT as your Server would become an Open Router which could (and most likely will) be used for malicious activity. With that said just add a rule to Forward only the traffic you need and you should be good to go. Forwarding is probably disabled for 2 reasons: Number 1 being that every module ...


1

Your iptables NAT redirects will work but be aware that this method is dependent on the conntrack module. If your server has too many simultaneous requests, the conntrack table will become full and you will experience downtime. You can of course increase the size of the conntrack hash-table and how the hash-lookups are done, but this may impact performance. ...


1

Your configuration seems pretty flawed. Maybe you should look into the general use of DNS. First of all you use URL Redirect on registryrocket a lot. I'm not sure that is what you want. You want to make an alias of for your heroku app. That is done with a cname. Then registryrocket cannot redirect the traffic of "rudolflabs.net" if it is not the nameserve ...



Only top voted, non community-wiki answers of a minimum length are eligible