Tag Info

Hot answers tagged

14

A single anycast IP address does not give you the same redundancy as two unicast IP addresses in distinct IP prefixes would. Often the hardest problem for redundancy is not when something fails completely, but rather when it is misbehaving just enough to still pass the health checks, but not actually be functional. I have seen an anycast DNS setup where a ...


7

Blocking outbound connections to destination TCP port 25 is something that a lot of ISPs do today. While I don't particularly like it, it's a pretty typical thing that gets done. So long as you publish to your users that you're making this change, and perhaps take some packet captures to pre-emptively see who might be effected by the change, I think it's ...


6

No, you can't do that on the host directly. You need a VM to handle the routing. ESX is not a router.


5

Most enterprise firewalls will support what you are trying to do and we use Dell Sonicwall which certainly does. If you are trying to "roll your own" then something link pfSense may do the trick and a quick look at their docs does show that it support multiple WAN links - see https://doc.pfsense.org/index.php/Multi-WAN_2.0


5

This is 100% expected behaviour. In order to route all traffic through your VPN connection, a default route is added with the virtual interface as a target. But this presents a problem - the network packets used to carry the VPN connection itself would also get routed to the VPN interface, creating a kind of routing loop. To resolve this a static host route ...


5

You want network address translation (NAT) for your LAN: source NAT for your clients, destination NAT for your servers. Your LAN firewall probably provides this capability. Then, you need to configure your firewall to forward ports 80 and/or 443 from the external IP address to your server's LAN IP address.


5

The stacking protocol should handle loop detection and prevention. It may be using spanning tree, it may be doing something else. You best bet is to read the docs on how Dell's stacking works. I'm not primarily a network guy, and my beginner-level.. For the love of god if you don't know what you are doing don't turn off spanning tree. There are a few ...


4

In FreeBSD the firewalls (IPF, IPFW, and PF) sit between the Device Driver and the IP Stack. Routing is part of the IP Stack.


4

Part of the problem is that you have 2 DEFAULT GATEWAY which violates the meaning of DEFAULT GATEWAY. Put the default gateway only on one interface. Then with static route, direct the traffic you want to go via the other interface. For example, LAN1 192.168.123.13 Mask 255.255.255.0 and GW 192.168.128.254. That will get all traffic to 192.168.123.x and ...


4

Create a file in /etc/syconfig/network-scripts/route-eth0 add add the following 192.168.20.0/24 via 192.168.20.253 dev eth0 I have always used this approach. I have found this to be the best approach. FYI: Check -- https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s1-networkscripts-static-routes.html


4

You can absolutely use a DHCP server to serve a scope it's not a part of, so long as the traffic can flow between the two subnets. The trick is that DHCP requests are generally only served out to the broadcast domain the client is on, to so get around that, you place an IP-helper address on the piece of network gear the client is connecting through so that ...


4

First off, the cables on the stacking module (if stacking is configured correctly) wouldn't be a loop on your network. These are part of the Stacking Module which is/should be separate from your standard TCP/IP network. It may still be that the stack is misconfigured but that is not part of the question so we'll move on. STP or any variant of STP (MSTP, ...


4

Best practice is to use at least two addresses from different prefixes and giving them a name under two different TLDs. Both those addresses can be anycast if you want. Having only one IP address will give you a single point of failure. If the routing to that address doesn't work (configuration error, an anycast instance not working correctly, the prefix ...


4

There is a simple fix for this, at least when it comes to the most popular Cisco routers: mls cef maximum-routes ip 768 This requires a reboot. Also see Cisco's documentation about adjusting the TCAM to allocate more IPv4 space (and less IPv6): ...


4

What you are describing is what happens when a switch's CAM table is full, where it can no longer learn MAC address and it forwards packets out every port. It might be hard to figure out if this is the problem with an unmanaged switch, but with a managed switch you should be able to display the CAM table. What also would help in this question is a diagram ...


4

You want policy-based routing. Quick distro-agnostic example: echo 200 custom >> /etc/iproute2/rt_tables ip rule add from 192.168.1.8 lookup custom ip route add default via 10.76.8.50 dev eth0 table custom


4

VLANs have nothing to do with your IP addressing scheme. You're conflating layer 2 and layer 3. At the risk of shamelessly plugging myself I'll suggest you have a look at "How do VLANs work?" and "Best way to segment traffic, Vlan or subnet" (and maybe also "Network: Many subnets in 1 VLAN =? possible"). As a "quick fix": Assuming you're using ...


3

You can use ebtables for this assuming you are assigning a mac to every VM on the host node. http://ebtables.sourceforge.net/ This in simple terms locks it down by mac address and will only allow the VM's to use IP's specifically assigned to them.


3

This depends on the contract you have with the PC and who is registered to change the DNS (registrar). It depends on whether you or the PC has the "contract" with the registrar. The registrar can change the DNS to point to whatever server "they" want. The registrar has nothing to do with the information held by the server at the PC. You need to get legal ...


3

Yes, you can achieve it, and yes it is a (relatively) big deal to set up, though not a huge deal if you're already using automation tools like Puppet or Chef. Ideally, your setup would be the following for true high availability: SMTP 1 (192.168.1.21) <-----> Load Balancer 1 (192.168.1.10) \ / | ...


3

Why introduce a third machine? Just run tcpdump on either of the two machines and you'll be able to capture all of the traffic between the two.


3

Anycast is not a widely accepted type of communication in IPv4, but it is present in IPv6. Three type of communication in IPv4 are 1) Unicast, 2) Multicast 3) Broadcast. 1) IPv4 Unicast One-to-One type of communication. A network device communicates with another network device. Layer 3 address used for Unicast is IPv4 Class A, Class B, Class C addresses. ...


3

You and @joeqwerty had a spirited discussion in the comments for the question and I'm going to echo some of that. Let's start from a simple basis: There are multiple standard and vast numbers of proprietary "auto-discovery" protocols-- that is, protocols by which client and server hosts or programs locate each other. To speak about "auto-discovery" as ...


3

You're not going to get a gateway address inside the allocated /56 or whatever IPv6 block that's assigned to you and routed to your premises. If you somehow do, you politely ask the ISP to put someone on the phone who knows what they're doing. Or perhaps less than politely. Usually, you don't have to worry about the upstream IPv6 address at all, as it will ...


3

Due to the fact that both links have the same IP gateway, you must set in some way the interface you want to use in your routing tables. The syntax is the following: gateway=[ip]%[interface] + specific preferred source; given this fact, in your router these routes should look like the following: /ip route gateway=109.60.164.1%gateway1 pref-src ...


3

The Google term you're looking for is "Looking Glass". Try Hurricane Electric's, at http://lg.he.net/, to get an idea.


3

Nah you can't, there's nothing to refer to anyway (e.g. logical ID). Just create your own main table ;-). This is probably one of the reason it can't be used: One way to protect your VPC is to leave the main route table in its original default state (with only the local route), and explicitly associate each new subnet you create with one of the custom ...


3

You should convert your Wireless routers to Wireless Access points. Use the LAN Port of the device Disable DHCP (Server) Disable NAT This should "downgrade" the device to a standard Access point, and you should be good.


3

10.8.2.12 sees 10.8.2.254 as being on the same subnet, therefore it's requesting the MAC address of 10.8.2.254 to insert it as a dest MAC in future packets to 10.8.2.254. Since 10.8.2.254 doesn't exist, no one is replying and 10.8.2.12 never finds out what MAC to set as the dest MAC. Try using proxy_arp on your main server. echo 1 > ...


3

The RFC 1034 only states that you require two DNS servers. This isn't a mandatory requirement, but a recommendation, so do with it what you will. Regardless, if you want HA, your 2 DNS servers can be assigned the same IP using anycast, and the only thing your end users would notice when one DNS server fails, is a momentary lack of connectivity as the network ...



Only top voted, non community-wiki answers of a minimum length are eligible