Tag Info

New answers tagged

-3

I don't mean to be mean, but this is the most nonsensical question I've seen asked in a long time... Network security 101... there's a concept of "zones" that are demarcated by firewalls. Typically you have an external edge firewall for your entire network. This separates your network from the raw internet. Behind that firewall go devices that are used ...


1

I don't know any obligatory to have DNS Records for public IP Addresses. I don't see the anything why this should be important.


7

No. [Body must be at least 30 characters; you entered 3.]


0

Solution is: deny ip from any to any dst-port 6881 out So, it was about NAT and state count and torrent


0

I figured it out! Hopefully it will help someone else too. I forgot to add RIP to all Server's routing protocols. Without RIP the packages seem to be unable to take the addet hop from Server to the Firewall to the net. After adding RIP everything worked like charm


1

Mulaz did come up with the right keyword: http://wiki.mikrotik.com/wiki/Hairpin_NAT The link has diagrams which visualizes the problem and answer more succinctly. Nat settings conflicts with my port forwarding settings on my router so sometimes a local dns server on a linux server may be required. Your mileage may vary.


0

Iptables are wonderful, but if you keep everything in nginx, then it can do the job it was designed for. It's possible to do other advanced tricks with iptables like logging and packet marking, but if you don't have a reason to do it outside of nginx, you should go through nginx. That way if you move to a different system like (Ugly)windows server or ...


0

It sounds like you may be complicating things by trying to route traffic through the server. You can configure a NAT rule on the firewall to send outbound traffic over a specific public IP.


0

I know this question is almost two years old, but it has no answers, so I thought I'd chime in with a way to handle this. This is actually something that works with UDP only because it is stateless, and will not work with TCP. Your described setup with a TCP connection to a third "control" server is actually the perfect setup for this. We'll call the ...


0

You need to define an Dynamic NAT Pool, even with overload. ip nat pool poolname beginningipaddress endingipaddress netmask mask


2

Short answer to your revised question is that there are two ways to do it; both require you remove the second NAT step (which destroys the info you're looking for). Your options after doing that are: 1) Make Server A the next hop for Server B for the traffic in question, which is why it works for your router as mentioned. This could be accomplished, in ...


2

First answer was related to FreeBSD. The issues are the same but the parameters are different on Ubuntu: Stock Ubuntu goes a long way. When you start to tune these parameters you might introduce more problems than you fix. From the lack of information you give my advice would be not to touch these parameters until you understand the networking parts a ...


0

[...] but when tunnel is enabled i lost my internet connection and i can't ping devices on my LAN1 The issue with lost internet connection sounds pretty much like a "Split Tunnel" issue. If you didn't enable Split Tunnel in your VPN configuration, all traffic originating from your VPN client will go through your VPN gateway. When enabling Split Tunnel, ...


1

You do not say which system you are running iptables on. If you are using FreeBSD it stores network packages in mbuf clusters. You can tune the number of mbuf clusters with: sysctl kern.ipc.nmbclusters=65536 By setting it to 65000 you will use 144 MB of memory and you should not go above that without adjusting the address space. Then this opens the ...


0

You haven't advised what "lots" of connections are, nor provided us hardware details,so its difficult to provide a definitive answer. It is possible that you are running up against a hard limit of NAT, in as much as there are a limited number (about 64k) ports, and each connection needs its own port on a Linux implementation. You may be able to ...


1

By default, non-transparent proxy inserts "Via:" field to HTTP request header. Of course, this is configurable option that can be disabled, for example: http://www.squid-cache.org/Doc/config/via/ Transparent proxy tries to be invisible, so cannot be detected: "A 'transparent proxy' is a proxy that does not modify the request or response beyond what ...


2

A silent proxy may be indistinguishable from NAT. But some may add headers, that allow to identify that request comes through proxy.


2

After "Brute Forcing" the configuration (for the second time) I've managed to get this to work. The first time I tried to configure this every conceivable way I could think of, I didn't have the Virtual Interfaces assigned to the WAN interface. Apparently in Zentyal (an possibly the networking world entirely), the router/gateway/whatever it's called ...



Top 50 recent answers are included