Tag Info

Hot answers tagged

17

There are two things you need: First you need an ISP that will act as the sponsoring LIR for you. Their role is just book keeping and maintaining the contractual chain between you and RIPE NCC. Then you'll need an ISP that will route your addresses and announce them to the rest of the world using BGP. Those two functions can be provided by a single ISP ...


15

The route command is deprecated, and should not be used anymore. The new way is to use the iproute set of commands, which are all invoked with ip followed by an object. For example: $ ip route show default via 192.168.1.254 dev eth0 192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.1.27 Now, I hear you say, this is basically the same info! ...


10

You can't use switch port security on the Cisco since all the VMs will be sharing a physical switch port. And you can't use Linux iptables because the traffic is being bridged, not routed, through the hypervisor machine. But you can emulate switch port security on the hypervisor with Linux ebtables, which is a lesser-known layer 2/3 firewall on the Linux ...


8

Blocking outbound connections to destination TCP port 25 is something that a lot of ISPs do today. While I don't particularly like it, it's a pretty typical thing that gets done. So long as you publish to your users that you're making this change, and perhaps take some packet captures to pre-emptively see who might be effected by the change, I think it's ...


8

Without further details it's difficult to give an appropriate answer. In the simplest case, with everything on the same IP subnet (including router2's clients), same VLAN, dynamic IP attribution, etc., i.e. the routers can communicate directly without any special switching/routing configuration, all you need is cabling and: set router1 as default gateway ...


7

The routes metric is to set preference among routes with equal specificity. That is true of routing in general (i.e. Cisco, Windows, etc). So the model works like: Find the most specific route (aka the longest prefix match*) If there are multiple routes with the same specificity, pick the one with the lowest administrative distance (This distinguishes ...


7

You must create a default vhost configuration file and include it before of others. For example you can save this default config to /etc/nginx/conf/default.conf: server { listen 80 default_server; return 444; } And include it in nginx.conf: http { .... include "/etc/nginx/conf/default.conf"; include "/etc/nginx/vhosts/*.conf"; } Be sure ...


5

Since your question isn't spesific for any OS, I'll answer in some general way too. This can be done two ways: legacy way: you distinguish the processes by uid they run as, and for each specific uid you install specific packet filter rules that forward the traffic as you want. To different gateways, for example. modern way: you bind each process to a ...


5

Userspace routing can be achieved by pointing a default route at a tun device, and having a userspace program examine each received packet. It's an inefficient and brittle approach, but it has been made to work — there was an AODVv2 implementation that worked that way, due to Henning Rogge. The other option, of course, is to implement your routing protocol ...


5

Netfilter (iptables) has queue module to send frames to a userspace program. Libraries for different languages (c, python, perl, etc...) are available to examine packets. After processing a frame you will return an ACCEPT or DROP verdict, the original or modified frame, and an option to set a mark. My guess that you can use the mark to handle this packet ...


5

Short answer: No Longer answer: A router which implements just the router functionality does not and cannot verify UDP and TCP checksums. However routers do exist with additional functionality. If the router has NAT and/or firewall functionality, the answer may differ. There are many reasons for a router not to verify the checksums: It would slow down ...


5

The client has no default route via your router box. Try route add -net default gw a.b.c.d on the client, where a.b.c.d is the client-facing address of the firewall.


5

In theory, you can do this using something called Universal Plug and Play (UPnP). In practice, it's turned off by default on most equipment, up to and including home routers, and most competent network administrators leave it that way. You'll likely need for your appliance poll a command and control service on a network that you control, or set up a proxy ...


4

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


4

This is impossible. SSH has no notion of a Host header as is present in HTTP. The best you can do is port-based routing.


4

In RedHat Entrprise Linux 7.0 (the "upstream" of CentOS 7.0) the intended interaction with iptables is through firewalld. Manually modifying the iptables configuration, while possible, is not the intended method if interaction. If you do want to modify the iptables configuration directly you might want to have a look at documentation about iptables. You're ...


4

Ok, this can be done, but it's definitely not as easy as it could (and should) be. Basically, the trick is using Azure's "local networks" to configure Azure gateways as we want, even if we can't directly touch their configuration. In order to set up a connection between two Azure virtual networks, you need to define two matching "local networks", and then ...


4

VLANs have nothing to do with your IP addressing scheme. You're conflating layer 2 and layer 3. At the risk of shamelessly plugging myself I'll suggest you have a look at "How do VLANs work?" and "Best way to segment traffic, Vlan or subnet" (and maybe also "Network: Many subnets in 1 VLAN =? possible"). As a "quick fix": Assuming you're using ...


4

Set a route to the payment processor via the dedicated IP. The ip route add command is your friend.


4

"Relatively easy" is a difficult term, but you might set up routing tables for each of your links - one table per link, with a single default gateway use netfilter to stamp identical marks on all packets of a single stream use the ip rule table to route the packets via different routing tables depending on the mark use a multi-nexthop weighted route to ...


4

Your hosting provider (Hetzner, at a guess?) is correct. You will need to assign the single static IP address to your VMware server's VMK interface. This will allow you to connect to the server via the VMware console and create VMs. Your hosting provider should be able to route your /29 subnet to the server's MAC address. You will also have a single ...


3

Check that your VMs have ip addresses on 10.x.x.x/24 (netmask 255.255.255.0) Set 10.x.x.11 (br0 ip address) as the default gateway of your VMs Enable ip forwarding on the physical host Enable SNAT with: iptables -t nat -A POSTROUTING -s 10.x.x.x/24 -o eth1 -j SNAT --to y.y.y.102


3

No, you can't do this with DNS, IPtables or the hosts file. You'd need to point those domains to a proxy, or something that has knowledge of what you want done, which will in turn re-direct the clients to the "right" place.


3

Actually it's not colliding. One subnet has more specific mask 192.168.0.0/24 has more specific mask than 192.168.0.0/16 For example default gateway is default because it has less specific mask /0. If you add a route to 192.168.0.3/32 via another interface it would have more specific mask than other two routes.


3

Please have a look at the following: http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.


3

Seeing a the route "hop around" on your network is really bizarre. You should see a traffic flow that hops form your edge router through your distribution routers. You definitely shouldn't be seeing traffic being routed through end user Customer addresses / devices. I tend to think you're seeing some kind of artifact of your configuration in these traceroute ...


3

The intended use for BGP on HP's 5000 series (comware) switches is for smaller internal BGP routing schemes with a few hundred subnets to route. If you intend to peer them with Internet routers I would recommend something more purpose built.


3

While most users should use ports 465 or 587 to drop mails with their providers, you can't be sure of this and there might be many users still use port 25 (e.g. with STARTTLS or even unencrypted).


3

You'll need to use ACLs. Also make sure "ip routing" is enabled in your config. See the HP Advanced Traffic Management Guide. Can you share the model(s) of the switches involved? ip access-list extended "SecureVLAN20-30" 10 permit ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 20 permit ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255


3

DHCP is a broadcast protocol you cannot forward (there is no destination IP on another network). What you need is an IP Helper showing to the DHCP Server (the router has to work as a DHCP Relay Agent, transforming the broadcast into a unicast).



Only top voted, non community-wiki answers of a minimum length are eligible