Tag Info

Hot answers tagged

8

You can't use switch port security on the Cisco since all the VMs will be sharing a physical switch port. And you can't use Linux iptables because the traffic is being bridged, not routed, through the hypervisor machine. But you can emulate switch port security on the hypervisor with Linux ebtables, which is a lesser-known layer 2/3 firewall on the Linux ...


4

The client has no default route via your router box. Try route add -net default gw a.b.c.d on the client, where a.b.c.d is the client-facing address of the firewall.


4

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


2

Well, you configuration seems to be a bit short. I'm attaching the configuration of my router as a working example. Also, you are using '-m state' to track related and established connections, while I usually utilise '-m conntrack'. What you can try - to log dropped packets and see what and why is getting dropped by iptables. I'm writing my configuration ...


1

You have option routers 192.158.66.254; in your configuration, which causes the invalid default route in your client configuration. Comment out this line, and you should be left with the correct default router of 192.168.66.254.


1

I think there are 2 different things at play here - The incorrect setting option routers 192.158.66.254; in your DHCP configuration. This would stop external connectivity, but is not actually the cause of your problem. The inability to ping the Windows box from the Linux boxes is most likely due to the TCP stack on the Windows box (or a firewall running ...


1

I have made it! On UBUNTU1, I have my /etc/iproute2/rt_tables file as: root@ubuntu-primary:/home# cat /etc/iproute2/rt_tables # # reserved values # 255 local 254 main 253 default 1 net1 2 net2 3 net3 0 unspec # # local # #1 inr.ruhep root@ubuntu-primary:/home# I have created created rules with commands: ip rule add from 192.168.1.101 table ...


1

You need to divide the /25 range into /26, /27, /28, /29 or /30 ranges. Then your router would have a separate IP address in each of these networks, and would handle the routing between those subnetworks and the Internet.


1

Why not something like this: $ ip -4 addr show eth0 | grep inet | awk '{ print $2 }' 192.168.1.100/24 FYI, ifconfig is deprecated. You should start using the various ip commands in place of what you used ifconfig for previously.


1

Is iptables capable of routing rules based on HTTP request headers? No, it's not. IPTables works at layer 3/4, and HTTP request headers are layer 7. Is apache2 capable to routing requests to other IP's based on HTTP request headers? Yes, using mod_proxy, Apache can proxy those requests to another server. Which application is best for handling ...


1

Since I answered your first question, I might as well answer this one too. :) It looks like mod_proxy can do it, but so can Nginx and HAproxy (or here). Those links at least shows that the proxying of WebSockets works, but how you'd actually do it with Apache or Nginx would require some work. On the otherhand, the HAproxy links provided show exactly how ...


1

Your diagram uses x/29 and y/30 while the text uses y/29 and z/30, and your update saying x/29 uses a y/30 gateway further confuses things as you cannot use a gateway on another subnet. Perhaps adding IPs and netmasks would help. I shall assume a/24, b/24, x/29, y/30 and that the gateway you are referring to is the router with x/29 and y/30 interfaces. ...


1

Your routing the packets through either eth1 or eth0. tables mangle should address this. To do so, I had to mark packets and set up rules for handling it. First, add a rule that make the kernel route packets marked with 2 through table ip rule add fwmark 2 table 3 Add a route for redirecting traffic over a different interface, assuming the gateway being ...


1

You need to have the IPsec changed from a /32 to an appropriate subnet sized config, like /24. You should not try to find ways to compromise an existing tunnel to do something it's not configured for.



Only top voted, non community-wiki answers of a minimum length are eligible