Tag Info

Hot answers tagged

5

I think it's actually more debated than you make it appear. There is an admittedly old, related Linux FAQ: http://www.tldp.org/HOWTO/VPN-HOWTO/ I've used a PPP-over-ssh-over-ADSL for more than 12 years, and it never failed me, so from my experience I'd dare to say that the doomsayers probably largely exaggerate. TCP over TCP is probably a bad idea with RTC ...


5

You're better off doing this at layer 7 versus layer 2 or 3. Devices can have their MAC changed as well as their IP address. (It's harder for a user to change their MAC but it's still possible.) If you've got people changing IP addresses to get around restrictions it's only a matter of time before they'll be changing MAC addresses, too. There are a couple ...


4

You can simply type: echo "$SSH_CONNECTION" Or if you want only the server IP address and not the other fields: echo "$SSH_CONNECTION" | cut -f3 -d' ' If you are using screen and reconnect to a previously started screen session, notice that running these commands inside screen will show the connection from which screen was started and not the session ...


2

The easiest way would be to use netstat and check for connections in there. user@host:~$ sudo netstat -ntp Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 128 0 123.45.67.89:50212 98.76.54.32:22 ESTABLISHED 16774/ssh [more stuff ...


2

A traceroute to 2001:8d8:8f3:579c:517e:a55a:f29f:d4c1 shows me this: 3 2001:470:0:69::1 68.251 ms 33.776 ms 34.043 ms 4 2001:7f8::2170:0:2 36.286 ms 39.953 ms 37.055 ms 5 2001:8d8:0:2::95 44.412 ms 44.052 ms 44.152 ms 6 2001:8d8:0:2::d2 41.018 ms 52.907 ms 47.670 ms 7 2001:8d8:0:9::e7 48.028 ms 46.261 ms 46.272 ms 8 ...


1

The fwd policy is not automatically generated by the kernel but instead gets installed by the keying daemon (strongSwan in this case). It is required to actually forward traffic to and from hosts behind the VPN gateway, and it is symmetrical (src and dst work in both directions here). in and out policies apply if the destination or source IP address, ...


1

The statement "Security Group settings do not affect internal IPs " is incorrect. You have to add the inbound traffic to the security group for the private IP, just like an external IP. I had to add entries from a specific private IP so that I could allow one instance to conenct to another using subversion, CouchDB, map a network drive, etc. However, ping ...


1

Deleting a primary IP address from an interface will, by default, delete all other address on the same subnet. This is a reply to a REHL bug 1136733 reported by the user lain who provided an answer on 12-Mar-13 ... You're adding multiple addresses in the same subnet, thus the second and subsequent ones become secondaries. This can be seen in the "ip ...


1

Given the lack of answers, i am posting now a solution that is not very elegant, but simple: Run another OpenVPN instance on TCP for "bad clients" proto tcp and lower the TCP MSS on the client, e.g. iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o ${OUT_DEV} -j TCPMSS --set-mss ${PATH-MTU-MINUS-40} An advantage of this solution is ...


1

You say that you have delegated the subzone int.books.rmlp.com on the authoritative nameserver for both rmplc.net and rmlp.com, which is ns0.ifl.net.. But I don't think this is so: [me@risby ~]$ dig ns int.books.rmlp.com @ns0.ifl.net. ; <<>> DiG 9.9.4-P2-RedHat-9.9.4-15.P2.fc20 <<>> ns int.books.rmlp.com @ns0.ifl.net. ;; global ...


1

Looks like B is changing the IP SRC header field to it's own address. Could be a result of working NAT. Check your packet filter for any translation rules and modify them accordingly.


1

Start by asking ARIN using the WHOIS tool (it's in the upper right corner) http://whois.arin.net/ui They'll point you to the right affiliate (APNIC or RIPE) if it's not an American IP. You'll either get the Company name (and maybe a Point of Contact, although those are usually outdated) that owns the IP or the name of the ISP hosting the site. I've also ...


1

Each of your compute nodes will need a default route of 192.168.1.2 (head node eth2). You will then need to configure IP forwarding on the head node to allow the compute nodes access through it. You don't need to worry about the managed switch for this - it is "invisible" for the task you're trying to accomplish. You can also, if desired, enable masquerading ...


1

Yes, there is certainly a rate limit and it will be in the order of dozens or hundred calls a day, depending on the registrar providing the data for a given TLD. The whois data and database has a completely different purpose and it certainly is not meant to be abused by people not wanting to pay for quality GeoIP database access.


1

The First IP is the IP that has been resolved by the DNS-Server. The second IP should be your Router that tells you that the TTL expired in transit. So when the destination is not reachable. The last router gives you an error.


1

Yes, you can do this, it's not intuitive though. Also, you should have been able to find the documentation through Google? Here's the document: http://www.sonicwall.com/downloads/supporting_multiple_firewalled_subnets_on_sonicos_enhanced.pdf Example #1 Default NAT Mode with secondary subnet Create Static ARP entry for the gateway address of ...


1

You can create a sub-interface on your LAN interface (X0, usually) and use VLAN tagging to separate the traffic. In Network > Interfaces there is a "Add Interface" button.


1

Have you done any research on the topic? http://www.f5.com/it-management/solutions/global-load-balancing/overview/ While it is not trivial to implement... it certainly is not impossible. Generally speaking, it sounds like a Geographically sensitive DNS server would be your best bet. There are patches to allow Bind to do this in a split horizon setup. ...


1

The general approach to solving this problem would be to interrogate the hosts rather the VMs. The VMs in theory have no idea that they are VMs. To that end the command VBoxManage list runningvms on a given host should display all running VMs on that host. If you NEED a purely networking solution to the problem you will need some pretty fancy switches ...


1

This is possible using Anycast-BGP. A quite good explanation can be found here: https://www.maxcdn.com/blog/anycast-ip-routing-used-maxcdn/



Only top voted, non community-wiki answers of a minimum length are eligible