Tag Info

New answers tagged

0

This sounds like maybe the pool members need to have their default gateway or route tables updated as well. The F5 is probably routing through the target device, but the return packets are probably going directly to the F5 and bypassing the target device during the responses. F5 solves this by using SNAT automap. Alternatively, you could look for a setting ...


0

This problem is not unique.This is a problem of Routing. Run : route -n to show your routing table. My Routing table is like this : Destination Gateway Genmask Flags MSS Window irtt Iface 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 ...


0

You don't mention how your Firewall is setup. Typically X0 is LAN and X1 is WAN. So by default, traffic from X1 to X0 is blocked. But I don't think that is the problem. The 10.1.0.0/16 doesn't have a routable interface to 172.16.5.1 on the sonicwall. the subnet masks prevent it. even if you add a static route, you still need a routing interface on the ...


2

How about returning it. The usage of a complete /24 for just a few servers is a waste of precious IP space in a world of shortage. This does not mean you do not need or even 'deserve' some address space! Just ask your local provider to route some more to your connections, maybe a block of 8 or even 16 addresses would mostly suffice. PI (Provider ...


0

1Have you enabled IP forwarding? sudo vi /etc/sysctl.conf #uncomment net.ipv4.ip_forward and set = 1 net.ipv4.ip_forward = 1 sudo sysctl -p If you are using TUN then there is a tunnel IP address that your client has. The default pool is 10.8.1.0/24. Unless your router knows about the tunnel IPs and has routes for them, you need to masquerade (NAT) the ...


0

Answer for single cable to port #4: If it is supported, all you need is to mirror traffic to VLAN 5 and configure your port #4 as normal + tagged VLAN 5 (5 is just for example). Also, on the switch you should set the specific port as untagged VLAN 5. Your router should support VLAN mirroring, not simply port mirroring. If it does not, you could make it ...


1

It's not clear to me what it is you're asking, but I'm going to make a few points: A VLAN is a layer 2 construct. Technically there's no such thing as a routable VLAN. A VLAN (again a layer 2 construct) doesn't have anything to do with ip address assignment, DHCP or anything else at layer 3. When you say routable VLAN I suspect what you really mean are ...


2

A non routeable VLAN is simply a normal VLAN that lacks a router, thereby not being routable to other networks. One common use of non-routable VLANs is for storage networks. Servers are configured with multiple network connections, via VLAN trunking or multiple physical NICs, so that they can talk to any application networks that they need to, while being ...


0

The solution to this was quite straightforward, but it throws up an interesting observation re. the use of traceroute to debug routing problems. The source of the problem was that I had not enabled ip forwarding on any host other than Nat Instance 1. ie echo 1 > /proc/sys/net/ipv4/ip_forward When I had been debugging, I had been using the traceroute ...


0

Client(172.17.17.6)<->Router+Firewall<->OVPN Srv(WAN:197.174.211.77)<->Subnet A 197.174.211.0/255.255.255.224 AND Subnet B 197.174.211.64/255.255.255.224 So your OpenVPN server locates in Subnet B. I assume your servers in Subnet A can route to Subnet B. route 197.174.211.0 255.255.255.224 <---- You don't need this, remove it route ...


0

Two possible answers: (1) The ARP cache on the Asus losing the MAC address for the modem router. Is there any other device besides the modem that has an interface on 192.168.0.1 ? You say you can ping 192.168.0.1 while WAN connectivity is interrupted, but can you see the Technicolor web interface on 192.168.0.1:80 or telnet to it ? If that changes, ...


0

when i telnet to my router and do ping -c 1 -w 1 -W 1 212.77.100.101 during incident, the command exits immediately Of course it exits immediately, you are giving it just 1 count and 1 second to be successful. -c count Stop after sending count ECHO_REQUEST packets. With deadline option, ping waits for count ECHO_REPLY packets, ...


0

This is a very common situation and unfortunately the initial response should not be technical. Inter-Vlan routing is fine if it works for your company. Yes there are possible security and performance issues but do you have the staff to manage the requirements if you lock your systems down? As long as you have designed your network properly you should be ...


-1

I understand the problem here is that you need to set routing rules on OpenVPN client machines? Have you tried route pushing in OpenVPN server config? push "route IP MASK vpn_gateway"; (replace IP and MASK accordingly to match your routing targets). Using ccd option you can even push different rules on per-client basis. Consult man openvpn for details. ...


0

IPv4 local network should be 10.1.10.0/24 if you want your clients to reach 10.1.10.x. Don't use static routes for the networks that are directly connected to an interface of your pfsense box. If your clients are using win7 then "Run as administrator" your openvpn client.


0

What kind of hardware are you using? It sounds like you might be working on an embedded device, in which case you should probably go with the netfilter option. But if you have more resources at your disposal, you should consider using OVS (http://openvswitch.org/), which is the de-facto open source standard for software defined networking. Software defined ...


1

You should probably enable ip forwarding in your servers. It is usually done by $ sysctl net.ipv4.ip_forward To make the changes permanent you must edit /etc/sysctl.conf and set net.ipv4.ip_forward = 1


0

I read there's no chance for public IP on any side (REMOTE and HOME), is that right? If so, go buy a cheap VPS (~ 4-5 USD/month), 128 MB RAM should be enough. Make sure VPS operator allows VPN connections. Then setup OpenVPN on VPS (server role) and in your locations (clients).


1

if you do have a public server there is a number of ways to achieve what you want. easiest solution is to use SSH tunnels. But you need to have a one time access from REMOTE to setup the tunnel. using the command: ssh you@your-public-server.org -N -o TCPKeepAlive -R 12321:ip-of-remote:22 then everytime you connect from HOME to your-public-server.org at ...


5

Netfilter (iptables) has queue module to send frames to a userspace program. Libraries for different languages (c, python, perl, etc...) are available to examine packets. After processing a frame you will return an ACCEPT or DROP verdict, the original or modified frame, and an option to set a mark. My guess that you can use the mark to handle this packet ...


1

Route of 169.254.0.0 is Zero-Configuration IPv4 special block (169.254.0.0/16) as described in RFC 3927. From your current routing table, 169.254.0.0/16 is set up as network route and not as default gateway, so you don't need to remove it. If you still want to disable that route, simply run: echo 'NOZEROCONF=yes' >> /etc/sysconfig/network I would ...


5

Userspace routing can be achieved by pointing a default route at a tun device, and having a userspace program examine each received packet. It's an inefficient and brittle approach, but it has been made to work — there was an AODVv2 implementation that worked that way, due to Henning Rogge. The other option, of course, is to implement your routing protocol ...


0

You're right about marking packets using the firewall, but you should not be routing them at that level — use multiple routing tables. First, set up your main routing table so that it routes through eth0: ip route add default via XXXX dev eth0 Once the tunnel is up, set up a secondary routing table that routes through tun0: ip route add default via YYYY ...


0

This should be at StackOverflow. You need to create a context for your socket. $opts = array( 'socket' => array( 'bindto' => '10.10.1.1:0', ) ); $context = stream_context_create($opts); $a = file_get_contents("http://mxtoolbox.com/WhatIsMyIP/", false, $context); print $a; In this example, this will bind to IP 10.10.1.1. Port 0 is ...


4

Set a route to the payment processor via the dedicated IP. The ip route add command is your friend.


1

SIMPLE ANSWER: Your PC is trying to resolve the Ethernet MAC address of the next-hop interface, but it can not find none (eg: the target PC is powered off). So it reports a "Destination host unreachable" ICMP message originating from its own interface. LONG ANSWER An IP-over-Ethernet network has two complementary network addresses: a non-routable, ...


0

Have you verified that packets leaving the interface have the correct MTU? Are you sure some other device is not altering and fragmenting them?


0

This was a mistake on my end. I assumed when accessing the website through the virtual IP (the one routed through barracuda waf), it would automatically translate other links accessed through that page. I realized to assume it did something like that, it would at least need to know which urls to convert. Regardless I just pointed an entry in my hosts file ...


1

Unfortunately I do not have enough reputation to comment @Dan Pritts post. I have developed a board using Realtek RTL8211E phy chip and I can assure you, that it is able to operate on gigabit speed :) (actually 10/100/1000). The only problem with this phy chip would be if it had not been connected to the CPU using a gigabit interface (like RGMII for ...


0

Given that the CPU isn't 100% in use, the question becomes what else in the system is limiting performance. My bet is that the ethernet chips just don't have the juice. As per the link in the question, your board uses the Realtek RTL8111E chip. I don't know anything in particular about this chip, but I do know that not all ethernet cards/chips are ...


1

How about the top's "load average" after some time of doing the speedtest? Does it ever reach 1? If it is not the CPU, maybe something is wrong with some lower layers? I suggest checking if ethtool or mii-tool show 1000FD in both cases (with and without router-in-the-middle). Maybe your router board forces some link settings and maybe you have a duplex ...


-2

Type show ip routeon the router, it will show the routing list on routers. And you can point out what kind of routing protocol the router is using by protocol numbers and names.


0

While your description does not provide enough information (such IPs, etc) for us to provide a full/complete answer, the basic idea is that you create a static route so that any traffic for that specific IP you want goes through the GRE tunnel. So if for example you want to route 190.93.247.183 via the GRE tunnel you add a static route with the following ...


0

add a route rule that routes the intended IPs (those on remote LAN)to the remote IP on the GRE network (the remote router)


0

First of all, this is a goofy solution and even if you get it working, it's sloppy. You may already even have a layer-3 switch that could do the job of routing for you if you just enable that functionality. That said, you need to enable IP routing (sometimes called IP forwarding) on the server. Nice walkthrough at wikiHow. Then make sure you have a route to ...


5

Since your question isn't spesific for any OS, I'll answer in some general way too. This can be done two ways: legacy way: you distinguish the processes by uid they run as, and for each specific uid you install specific packet filter rules that forward the traffic as you want. To different gateways, for example. modern way: you bind each process to a ...


0

From what I understand you are trying to build an anycast scheme, and then you are experiencing problems with network connectivity. Well, prior to create complex things you should really understand the simple ones. There's muptiple ways to ensure connectivity won't be lost, some of these that come to my mind are: Use RFC 1918 addressing in A and B as the ...


1

Point the route to the 10.0.10.0/24 to the CentOS LAN IP on the Debians. Enable the ip forwarding in CentOS (net.ipv4.ip_forward = 1 with sysctl). Review the iptables configuration in CentOS to be sure it passes the packets. If HQ LAN doesn't know about your branch LAN addresses - add NAT in CentOS, translate the branch LAN addresses to a CentOS VPN client ...


0

I'd approach this in a totally different way: Configure a PC (laptop) with 3 IP addresses: 192.168.213.250 and 10.0.4.250 and an address on the new subnet. connect the two devices and the laptop on the same VLAN. (no firewall, just (an isolated) hub/switch or direct connect cable) just connect to the old IP adres and start reconfiguring. Then change your ...


1

OK, so after some attempts I figured out how to connect. First thing was to add second IP address to internal interface in same subnet as D-LINK default IP, for example: 10.90.90.1/24. Second was to use SSL VPN to establish tunnel connection to router, but instead of using the default IP range for tunnel I've changed it to point to interface second subnet, ...


0

Well, given the setup, all was needed was to: add a table named backup in /etc/iproute2/rt_tables ip route add 192.168.252.0/24 dev eth0:0 src 192.168.252.12 table backup (local network for fallback purposes) ip route add default via 192.168.252.1 table backup (its default route) ip rule add from 192.168.252.12 lookup backup (use it when replying from ...


16

There are two things you need: First you need an ISP that will act as the sponsoring LIR for you. Their role is just book keeping and maintaining the contractual chain between you and RIPE NCC. Then you'll need an ISP that will route your addresses and announce them to the rest of the world using BGP. Those two functions can be provided by a single ISP ...


-1

Search for a big LIR (Orange, for example) and sign an agreement with them so The IPv4 block remains under the management of the LIR and assigned exclusively to you. You have to contract from the LIR links to your data center using that IPv4 block.


0

If you have remote access to a machine that is on the local LAN of the DLINK the you could: 1) setup a subinterface on the remote machine to some address in the subnet 10.90.90.X 2) after that you should be able to ping the DLINK from that machine 3) then you can use Teamviewer or even setup a Proxy Server using Apache on that remote machine so you can ...


0

Temporarily set your PC address to 10.90.90.something and connect to the D-Link with a cross-over cable, reconfigure it to what you want, and then change your PC back and put the regular patch cords back where they belong.


1

The cpu is not idling at all, one core 68.7% other 34.3% busy processing interrupts is not idle. The userspace is idle not the kernel. Not familiar with openbsd, can you set cpu affinity so that one core processes irq259 and the other irq260. Then see how busy each core is.



Top 50 recent answers are included