Tag Info

New answers tagged

0

Should turn hosts and bridge UP: ip link set host1 up ip link set host2 up ip link set dev vsbr0 up


1

Before one jumps straight into firewall rules, one should also perform a simple forwarding check. Rather like when one checks the power cord is plugged in before taking apart the hardware. Run: cat /proc/sys/net/ipv4/ip_forward If you get a zero, IPv4 will not forward. You'll need to turn this on. To turn it on immediately and ephemerally to verify ...


2

When you are trying to reach localhost, your source address is 127.0.0.1, as is your destination address. So, packet looks something like this: | SRC | DST | | 127.0.0.1 | 127.0.0.1 | Since packets that are locally generated first traverse OUTPUT chain, you modify the packet with DNAT rule: iptables -t nat -A OUTPUT \ -d ...


2

802.1Q tag is inserted into MAC header, and kernel won't decode it if your interface isn't VLAN tagged. So, even if you could mangle outgoing packets, incoming traffic with VLAN tag would stay ignored. What you need to do is create a VLAN tagged interface, just as you did, and add an IP to it within the same rage the switch IP you're trying to access is in. ...


3

iptables and ebtables can't set VLAN tags on packets. That's what VLAN sub-interfaces are for. There's an article on the Ubunut wiki that discusses VLANs that you should probably review. In summary, though, you want to: Make sure the 802.1q module is loaded with a modprobe 80211q. Create the VLAN sub-interface with vconfig add eth0 444. Add an IP ...


0

Solution I found an answer to my problem, and it was the network configuration on the dmz. The dmz is on a Dell Power Edge 1950, where I'm running the hardware node on 10.10.1.2/24, and a venet0, virtual node for OpenVZ. I was not concerned about connecting to the OpenVZ nodes just yet, but could not even connect to the hardware node. After modifying the ...


1

You can selectively DNAT based on source IP address. for example: ipset destroy whitelist # this may error the first time ipset create whitelist hash:ip hashsize 32768 ipset -A whitelist <ip_address1> ipset -A whitelist <ip_address2> iptables -t nat -A PREROUTING -p tcp --dport 80 -m set --match-set whitelist -j DNAT --to 192.168.0.1 iptables ...


1

compare your configurations with settings in this article and it may help you identify the problems.


0

The tap device's mac and the actual mac of the virtual NIC in the VM are different, this is why you see double the amount of MACs in the output. You should only look at the VM's internal MACs, the ones you specify in the -net nic,vlan=0,macaddr=XX:XX... argument, the tap dev MACs aren't important.


0

Buy a $10 switch off eBay, or a refurbished managed Layer 2 Cisco if you're a business. This is not what bonding is meant for, nobody develops or tests for this. Link monitoring may or may not work depending on your NIC. Get a switch.


3

First of all it is important to understand that there is no such thing as "SFTP-only". SFTP is not a stand-alone protocol, it is a subsystem of SSH. The SFTP client connects to the SSH server, authenticates, and then opens the SFTP subsystem (or it opens a shell, which is what your NAS does not allow, but you don't have to worry about that). So... assuming ...


0

And now I can answer my own question on how to do this. Use pipework which I have just patched to work with Infiniband or RDMA IPoIB devices. You run it like this. ~ $ docker run --device=/dev/infiniband/uverbs0 --device=/dev/infiniband/rdma_cm -d container ~ $ pipework ib0 container-id ip/netmask Because IPoIB devices do not support bridging, the ...


0

From the shell, you can just run setup and change the ip range for the blue adapter. The options you do are: Networking -> Address Settings -> Blue Change the IP address to the desired setting and make sure that the subnet is correct to make the network the correct size. Given you have it working with a /23 you don't need to change the subnet.


0

Thanks to Hrvoje Špoljar in the comments above, I have a solution. Turns out that after following this guide, I had the following command in my rc.local: iptables -t nat -A POSTROUTING -j SNAT --to-source %SERVERIP% -o eth+ but %SERVERIP% was the wrong IP address. So I had the wrong rule in my iptables. Unfortunately, ufw on ubuntu "protects" you from ...


0

Run SysInternals Process Monitor on the Windows server, then try the command. It will log what's happening, and show if the file access is denied, or if the file really isn't found (and what path the Windows process is ends up looking for). Since it works on an older server, my guess is it's to do with UAC and accessing the C:\ root directory - try putting ...


0

For the new CentOS 7 AMI, the only way I could get a static hostname set was by commenting out the lines: - set_hostname - update_hostname in /etc/cloud/cloud.cfg. The comment character for YAML is #. This is in addition to setting the hostname normally.


1

Using the VPN server (being a normal node on your VPN) as a gateway is a client-side issue. You can enable it with redirect-gateway def1 in the client config. Keep in mind that the server has to do proper masquerading (with iptables) for packets being routed from tun0 to the internet and IP forwarding has to be enabled.


1

I don't think this is an unreasonable configuration, per se. Since you're doing everything in kernel space (versus something like fail2ban, which runs in userland and acts upon the kernel's syslog messages) it should be reasonably efficient. Be aware that you have a major denial-of-service attack potential here, though. An attacker can send SYNs with ...


0

I'd be cautious, as IP was designed to route based on destination IP address, and you will be better off if you can make that happen. For instance, if what you really want is all traffic from a particular virtual server to be sent out a particular interface then use bridging instead. That being said, you can use multiple routing tables along with routing ...


1

Check out http://www.ntop.org/ . It has comprehensive traffic stats and web interface easy to use by non-technical person. The part with quotas is not that trivial, but ntop can certainly provide statistics based on which block can be applied.


1

I was able to make this work using Custom route tables Create a custom route table: echo 2000 CustomTable >> /etc/iproute2/rt_tables Add rule: ip rule add from 10.0.0.100 lookup CustomTable Add route: ip route add default via 10.0.0.254 dev eth1 table CustomTable This will send any traffic from 10.0.0.100 out on dev eth1 Keep in mind these ...


0

I would use iptables to accomplish that. With masquerading it would look like: iptables -t nat -A POSTROUTING -o tsgw -j MASQUERADE


0

This is not possible unless all your internal network computers have public IP addresses. This is because your router is performing NAT from private address to its public address. Every outgoing link has an individual public IP address, and the other endpoint for the connection sees only that IP address. So, when the link goes down, that public IP address ...


2

I ran into problems with the accepted answer (which, I hasten to add, I found very helpful) because I was using bonded interfaces. It took me a while to discover what was happening but I found that when bringing up a bond, or even when bringing up a bond slave individually, the ifup-local script would not be called for the slave interfaces. I assume that ...


1

You forgot to make your firewall rule stateful. Like your working ssh rule, it should include -m state --state NEW. You may also need to check for external firewalls, such as Amazon's "security groups" on EC2.


3

Check your /etc/hosts file for this record. nslookup will not use this file in resolving DNS. Also, check your /etc/nsswitch.conf it should say something like hosts: files dns


2

If I'm reading you comment correctly, you can connect to localhost (127.0.0.1). However, in any scenario - by connecting via domain name to any protocol, you experience failure. Since you stated things have changed, this leads me to believe that a firewall rule has been introduced where 127.0.0.1 is allowed, but IPs (including 50.100.XXX.YYY) are ...


0

It was SQL. By default, each time bacula-fd sends a new file, bacula-sd tries to (via bacula-dir) insert file attributes into SQL batch table. If you have a lots of small files, and your SQL is not blazingly fast, it will insert small delay. Many small delays = throttled speed = canceled backups due to Max Run Sched Time exceeded. And due to architecture ...


0

In situations like this it's best to be explicit. There are many reasons why you might not be able to ping or ssh to the IP on eth1 but for starters you should configure policy based routing that forces traffic to use the same interface for TX that was used for RX. You want traffic to use eth0 for the faster connection so we'll leave that for THE default ...


1

I have not tested this, but if this works at all, I expect your choices are limited to active-backup (aka Mode 1) bonding, with the fail_over_mac=active bonding option. See: bonding.txt This is because almost every WiFi card will not send frames which have a non-local source MAC, and load balancing modes like balance-xor and 802.3ad (aka LACP) want to ...


1

If rpm -q lists the package, it is installed. Try starting that specific telnet binary with its full path as mentioned in the answer you linked to: /usr/kerberos/bin/telnet. If that works, add it to your $PATH if that's the binary you want to use. I doubt that you need the telnet included with Kerberos, though. There is a separate telnet package as well. At ...


1

You should try this: iptables -t nat -A PREROUTING -i ppp0 -d 192.168.2.0/24 -j NETMAP --to 192.168.1.0/24 The following references may help you: Iptables massive 1:1 NAT http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-4.html


1

Since you have no Internet connection, you will need to download the RPM, move the RPM to a USB stick or something, put that USB stick into the new server and the install the telnet rpm. Another option would be if you have an internal satellite server, internal repo or something to get the package from. Normally you would just do a: yum install telnet and ...



Top 50 recent answers are included