Hot answers tagged

32

They're not supposed to, but some DNS services may treat this as more of a suggestion than a hard rule. They may honor the setting down to some minimum, or they may ignore your TTL completely and always use their own setting (I've heard that 2 days is, or at least was, common). You need to be aware there is nothing you can do that will make those providers ...


17

Only if you make that change to the TTL more than three hours in advance of the IP address change. Remember that the TTL tells other DNS servers how long to cache records. So you must reduce it at least that long in advance of your desired change.


11

You can't use switch port security on the Cisco since all the VMs will be sharing a physical switch port. And you can't use Linux iptables because the traffic is being bridged, not routed, through the hypervisor machine. But you can emulate switch port security on the hypervisor with Linux ebtables, which is a lesser-known layer 2/3 firewall on the Linux ...


7

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


7

I guess I'm going to be the contrarian on this one. IMO, too many people make too much of a fuss trying to correct people when they talk about class-full ip addressing. The RFC 1918 reserved addresses were carved out of what was at the time the class-full address space. In fact, every piece of documentation I've ever read about the RFC 1918 addresses refers ...


7

Those ranges you list are described in this RFC 1918 - Address Allocation for Private Internets The title gives away their use case: "... for Private Intranets". All IP Address ranges are technically routeable including those listed in the RFC. But they are often referred to as non-routable. That's because they are not meant to be routeable or ...


7

You are mixing the roles of switches and routers, and this is the source of your confusion. A switch is a device which connects devices in the same network (this is greatly simplified, but let's roll with it for now). A router is a device which interconnects different networks. In doing this, a router can perform something called Network Address Translation ...


5

The client has no default route via your router box. Try route add -net default gw a.b.c.d on the client, where a.b.c.d is the client-facing address of the firewall.


5

with the route -n command you'll obtain Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.178.1 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 160.98.123.1 0.0.0.0 UG 600 0 0 wlan0 sudo route del -net 0.0.0.0 gw 192.168.178.1 netmask 0.0.0.0 ...


5

It's not a router problem and it has nothing to do with the "Cisco world". You can host multiple websites on a single web server all on port 80 via a single ip address by using Host Headers (or the Linux equivalent).


4

You're probably bit by Linux's uRPF filter, which is designed to avoid packet spoofing but breaks asymmetric routing setups. Disable it with sysctl net.ipv4.conf.all.rp_filter=0 sysctl net.ipv4.conf.eth0.rp_filter=0 (Yes, you need to disable both the all entry and the one specific to the interface.)


4

You need to construct two regex's that are mutually exclusive: only one can be true at a time: How about if you make the second item be a regex like: ^/path[~/] The [~/] means "any character that is not /". Here are three URLs that are mutually exclusive: acl fb1 path_reg ^/path$ # Just /path acl fb2 path_reg ^/path/$ # Just /path/ acl ...


4

As you already mentioned BGP is you basic answer. I'll try to summarize this, but the answer can get pretty long and complicated. IP addresses are distributed by ARIN + few other similar international organizations which are tasked w/ distributing and keeping track of IP address space. An ISP's border routers (where ever they might be) then advertise that ...


4

RFC 922, BROADCASTING INTERNET DATAGRAMS IN THE PRESENCE OF SUBNETS, specifically disallows forwarding the Limited Broadcast (Local Broadcast 255.255.255.255) from one LAN to another which would result in bridging. You say you don't want to bridge because one LAN would swamp another, but allowing the Limited Broadcast from one LAN to another would do exactly ...


4

You seem to be under the impression that merely having devices of mixed speeds will present problems for the lower speed devices. Without getting into the specifics about how switches, hubs and bridges work, I'll just say that it simply isn't likely that this software is capable of transmitting 10Gbps of broadcast traffic on the network. Any one of us here ...


4

Your route command syntax is wrong. Here is the proper syntax: Syntax route [-f] [-p] [Command [Destination] [mask Netmask] [Gateway] [metric Metric]] [if Interface]] Destination : Specifies the network destination of the route. The destination can be an IP network address (where the host bits of the network address are set to 0), an IP ...


4

He is absolutely correct. Netgear switches are crummy and cheap with low manageability and tiny packet buffers. You're trading capex for opex. Cisco SMB switches are essentially a small step up from Linksys. Catalyst are pricier, but if you want your network to work and be manageable you need something in that class. For a tech company, a network is ...


3

I'm looking for a solution through IP chains/tables, firewall rules etc (or at least "plugins" with some history) rather than custom generated code. Not going to happen, sorry. Firewall and routing engines will typically resolve the DNS record to an IP address when the policy is activated, and Linux is no exception to this. The kernel will not perform ...


3

Your clients need a route to 192.168.2.0/24 (the network being used by your vpn clients). The easiest way to do this is to ensure that the default gateway for your network (192.168.1.1) knows you to reach that network, possibly by setting up a static route to 192.168.2.0/24 via your OpenVPN server. How to do this depends on your router; on Linux, that ...


3

In reverse order... Your routing table is actually correct. The L flag means that is the IP address local to the router on that link, while the C flag means that network is attached to the router on that link. The problem would be that your modem doesn't know that the 192.168.10.0 /24 network is reachable via 192.16.1.69, or doesn't have a NAT policy for ...


3

By definition there can only be one default gateway per routing table. Same is true for IPv4. If you want to route traffic to several gateways this is how to do it: Enable source based routing. Create additional virtual routers (a.k.a. routing tables) and create default routes for each table. Create rule defining which router to use with what source ...


3

What you're asking for is pretty much impossible, because the vast, vast majority of L7 protocols have no concept of a hostname, and thus can't be proxied based on a hostname The correct way to achieve what you want is to assign different public IP addresses, because even though you have a router in your diagram, it's actually NATting, which isn't routing ...


3

On pfense you can implement this easily via rules. Create a firewall rule and assign a gateway on the advanced tab of the rule options.


3

There is so much going on here, so I'm going to try and address these one by one (out of order, probably) Servers on the main DHCP network have static IP addresses as well as virtual NICS that enable them to connect to the other IP ranges. What? You have a network with a DHCP server, but then you have static IP addresses? And Virtual NICs? What kind of ...


3

I think your best bet is going to be to contact your ISP and clarify exactly what they are giving you with the 203.0.113.88/29 block. There is no reason for things to be complicated by the uncertainty about these IP addresses. The most ideal scenario is for you to connect a second firewall to that switch and give it one of the IPs on the 203.0.113.88/29 ...


3

In every Active Directory environment, the domain name is mapped in the DNS to all active domain controllers; there is an A record for each DC, mapping the domain name to the DC's IP address. Let's say you have two DCs and your domain name is domain.com; your DNS will then contain something like this: domain.com 192.168.0.1 domain.com ...


3

As you don't mention you added a route on the third system, I'm guessing the problem is that the third system doesn't know how to route return packets to 172.28.11.0/24. So you need to add a route there. Note that the route command has been deprecated in linux for a very long time now. You should familiarize yourself with the ip command, it is very powerful ...


2

As they have explained you already, the issue is that the policy is enforced client-side but setup on the server-side. This is a security feature, which allows the connecting network to avoid clients "bridging" unsecure and secure networks together. The only way is to "hack" the client not to obey the server-side command. There is a tutorial you can find ...


2

I realized I never followed up to this question. Using some excellent internet resources here and here, I came up with the following configuration. Hopefully this helps someone out. Assume you have two interface, eth0 and eth1, with IP addresses of 10.1.1.242 and 10.1.1.243. This is all on a /22 network with a default gateway of 10.1.1.254. First create ...


2

RH style device dependent routes defined using /etc/sysconfig/network-scripts/route-device files has caused lots of problems. So real sysadmins use only /etc/sysconfig/static-routes file without device dependency: any net 10.0.0.0 netmask 255.255.255.0 gw 192.168.0.1 Problems: When physical devices are bonded, you need to remember to chance route-...



Only top voted, non community-wiki answers of a minimum length are eligible