Hot answers tagged

32

They're not supposed to, but some DNS services may treat this as more of a suggestion than a hard rule. They may honor the setting down to some minimum, or they may ignore your TTL completely and always use their own setting (I've heard that 2 days is, or at least was, common). You need to be aware there is nothing you can do that will make those providers ...


17

Only if you make that change to the TTL more than three hours in advance of the IP address change. Remember that the TTL tells other DNS servers how long to cache records. So you must reduce it at least that long in advance of your desired change.


16

The route command is deprecated, and should not be used anymore. The new way is to use the iproute set of commands, which are all invoked with ip followed by an object. For example: $ ip route show default via 192.168.1.254 dev eth0 192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.1.27 Now, I hear you say, this is basically the same info! ...


11

You can't use switch port security on the Cisco since all the VMs will be sharing a physical switch port. And you can't use Linux iptables because the traffic is being bridged, not routed, through the hypervisor machine. But you can emulate switch port security on the hypervisor with Linux ebtables, which is a lesser-known layer 2/3 firewall on the Linux ...


8

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


8

The easiest way to understand the difference between the two is via an example showing the hierarchical nature of the prefixes. An example hierarchy An ISP has been allocated a prefix from a RIR which in this example we will assume is 2001:db8::/32. This prefix is different from the ones handed down to the customers in the sense that the ISP will have to ...


7

I guess I'm going to be the contrarian on this one. IMO, too many people make too much of a fuss trying to correct people when they talk about class-full ip addressing. The RFC 1918 reserved addresses were carved out of what was at the time the class-full address space. In fact, every piece of documentation I've ever read about the RFC 1918 addresses refers ...


7

Those ranges you list are described in this RFC 1918 - Address Allocation for Private Internets The title gives away their use case: "... for Private Intranets". All IP Address ranges are technically routeable including those listed in the RFC. But they are often referred to as non-routable. That's because they are not meant to be routeable or ...


7

You are mixing the roles of switches and routers, and this is the source of your confusion. A switch is a device which connects devices in the same network (this is greatly simplified, but let's roll with it for now). A router is a device which interconnects different networks. In doing this, a router can perform something called Network Address Translation ...


6

You asked: "Can someone explain why this problem occurs in the first place?" Based on what is reported in the official OpenVPN FAQ I bet it's caused by a routing problem within the OpenVPN engine. To better clarify the scenario, let me refer to following diagram: Here you can see: an OpenVPN "server" connected to the HEADQUARTER internal network ...


5

Userspace routing can be achieved by pointing a default route at a tun device, and having a userspace program examine each received packet. It's an inefficient and brittle approach, but it has been made to work — there was an AODVv2 implementation that worked that way, due to Henning Rogge. The other option, of course, is to implement your routing protocol ...


5

Netfilter (iptables) has queue module to send frames to a userspace program. Libraries for different languages (c, python, perl, etc...) are available to examine packets. After processing a frame you will return an ACCEPT or DROP verdict, the original or modified frame, and an option to set a mark. My guess that you can use the mark to handle this packet ...


5

The client has no default route via your router box. Try route add -net default gw a.b.c.d on the client, where a.b.c.d is the client-facing address of the firewall.


5

In theory, you can do this using something called Universal Plug and Play (UPnP). In practice, it's turned off by default on most equipment, up to and including home routers, and most competent network administrators leave it that way. You'll likely need for your appliance poll a command and control service on a network that you control, or set up a proxy ...


5

It's not a router problem and it has nothing to do with the "Cisco world". You can host multiple websites on a single web server all on port 80 via a single ip address by using Host Headers (or the Linux equivalent).


4

RFC 922, BROADCASTING INTERNET DATAGRAMS IN THE PRESENCE OF SUBNETS, specifically disallows forwarding the Limited Broadcast (Local Broadcast 255.255.255.255) from one LAN to another which would result in bridging. You say you don't want to bridge because one LAN would swamp another, but allowing the Limited Broadcast from one LAN to another would do exactly ...


4

You seem to be under the impression that merely having devices of mixed speeds will present problems for the lower speed devices. Without getting into the specifics about how switches, hubs and bridges work, I'll just say that it simply isn't likely that this software is capable of transmitting 10Gbps of broadcast traffic on the network. Any one of us here ...


4

As you already mentioned BGP is you basic answer. I'll try to summarize this, but the answer can get pretty long and complicated. IP addresses are distributed by ARIN + few other similar international organizations which are tasked w/ distributing and keeping track of IP address space. An ISP's border routers (where ever they might be) then advertise that ...


4

Your route command syntax is wrong. Here is the proper syntax: Syntax route [-f] [-p] [Command [Destination] [mask Netmask] [Gateway] [metric Metric]] [if Interface]] Destination : Specifies the network destination of the route. The destination can be an IP network address (where the host bits of the network address are set to 0), an IP ...


4

He is absolutely correct. Netgear switches are crummy and cheap with low manageability and tiny packet buffers. You're trading capex for opex. Cisco SMB switches are essentially a small step up from Linksys. Catalyst are pricier, but if you want your network to work and be manageable you need something in that class. For a tech company, a network is ...


4

This is impossible. SSH has no notion of a Host header as is present in HTTP. The best you can do is port-based routing.


4

Your hosting provider (Hetzner, at a guess?) is correct. You will need to assign the single static IP address to your VMware server's VMK interface. This will allow you to connect to the server via the VMware console and create VMs. Your hosting provider should be able to route your /29 subnet to the server's MAC address. You will also have a single ...


4

"Relatively easy" is a difficult term, but you might set up routing tables for each of your links - one table per link, with a single default gateway use netfilter to stamp identical marks on all packets of a single stream use the ip rule table to route the packets via different routing tables depending on the mark use a multi-nexthop weighted route to ...


4

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


4

You're probably bit by Linux's uRPF filter, which is designed to avoid packet spoofing but breaks asymmetric routing setups. Disable it with sysctl net.ipv4.conf.all.rp_filter=0 sysctl net.ipv4.conf.eth0.rp_filter=0 (Yes, you need to disable both the all entry and the one specific to the interface.)


4

Set a route to the payment processor via the dedicated IP. The ip route add command is your friend.


3

I was running into this issue while using a home OpenVPN server and connecting to it using the Tunnelblick application on Mac. What was happening on my end is that a route with my home IP as the destination and an incorrect gateway was getting leftover after disconnecting from the VPN. Deleting this route solved the issue, simply $ sudo route -n delete ...


3

Actually it's not colliding. One subnet has more specific mask 192.168.0.0/24 has more specific mask than 192.168.0.0/16 For example default gateway is default because it has less specific mask /0. If you add a route to 192.168.0.3/32 via another interface it would have more specific mask than other two routes.


3

You will only get "failed login attempt" messages on accounts that you're actually logging into. Since SSH scanners typically try some common names of people, and also known system accounts like 'root', what that message tells me is that you're logging in as root directly over SSH. You should not do this. The first thing to do is create a regular user ...


3

No, you can't do this with DNS, IPtables or the hosts file. You'd need to point those domains to a proxy, or something that has knowledge of what you want done, which will in turn re-direct the clients to the "right" place.



Only top voted, non community-wiki answers of a minimum length are eligible