Hot answers tagged

26

Is that how IPv6 is intended to work? In short, yes. One of the primary reasons for increasing the address space so drastically with IPv6 is to get rid of band-aid technologies like NAT and make network routing simpler. But don't confuse the concept of a public address and a publicly accessible host. There will still be "internal" servers that are not ...


18

We use public IPv6 addresses in our company network for all devices. We use a stateful firewall on our gateway, that: allows all icmpv6 allows new connections from internal network out allows established connections from public to internal No public traffic (except ICMP and established connections) should get into our network. So far we had no problems ...


14

If there is no need for outside connectivity, then private networks can be used. That is the reason for defining private address space also in IPv6. NAT is a hack that was invented to delay IPv4 address space exhaustion. NAT causes issues with applications, and to get the applications to work with NAT, more hacks are needed which conflict with the original ...


6

As stated, this is the way IP was designed to work, and it does work well. NAT introduces annoying problems at times. Some have described NAT's "hiding" of the internal IP as an advantage, but it can also be a disadvantage. I worked in a place with a /16 and we used publicly routable IPv4 addresses on every device (including printers and mobile phones and ...


3

The IPv6 proponets saw NAT as a temporary hack to alleviate IPv4 address exhaustion and hence NAT would not be needed with IPv6. However NAT has a few advantages other than stopping address exhaustion. NAT decouples your internal addressing from your internet connectivity. At least on linux, NAT tends to fail-closed. If the iptables rules fail to load ...


3

My bad. I didn't notice i was using --internal. Self-explanatory!


2

The issue may be the -k flag. From what I see, you set up a very unusual setup creating high volumes of connections with the same source/destination. IPtables is a statefull firewall and tracks each connection individually. I would speculate that you end up creating a high volume of collisions in a hash table. This generally slows down access which may ...


1

Not quite the answer to your current problem, but it will render the whole issue moot since you're trying to trigger the script from the same host running your site anyway: When you need to run PHP scripts from cron you're generally better of running them from the PHP command line interface rather than making a web request to the script. Depending on the ...


1

Take a good look at the actual running iptables configuration ipatables -L -vn and ensure that nothing is blocking the source IP of the system running he curl/ping commands - take appropriate action. If there is nothing there then something upstream, between the systems may be blocking. As ping is being blocked I guess you could try mtr mtr -4 example....


1

AT&T's flash of the NVG599 does not support port forwarding where the same destination port routes to two devices. The workaround was to change the RDP port on the second PC to something besides 3389 and create the port forward to that.


1

Internal Switch will only allow communication between VM and Host, but will NOT allow external, in your case LAN, communication. Try changing switch to external and see if you're able to get in to CentOS.


1

After getting an overwhelming number of responses on SF... not!?!, I did my own research the figured it out. This is how I did it. Configuration -SSH to Host A and update /etc/network/interfaces as below: auto lo iface lo inet loopback iface eth1 inet manual auto vmbr1 iface vmbr1 inet static address 10.0.2.99 netmask 255.255.255.0 ...


1

I just recently got a USG100 which is pretty much same and I was struggling with the LAN -> Server connection, so here is what i did to get it working for me. Created Object / Address for the server. Add Service if needed, I used HTTP/HTTPS in my case but tested with custom one succesfully. Created NAT rules using public ip address as original ip and NAT ...


1

Is there a way to do a 1-to-1 NAT in IPv6 (I'm using Linux machine as a router)? This is known as "network prefix translation" and yes linux does support it. You use the "SNPT" and "DNPT" targets in the "mangle" table (the "nat" table is only used for stateful NAT). How do I do it? You use the SNPT target to change the source prefix on outgoing ...



Only top voted, non community-wiki answers of a minimum length are eligible