Tag Info

New answers tagged

0

Rebooting pfsense solved the problem, but it is no good feeling, if you don´t know if your phone will work :-(( I am still interrested in ideas and suggestions of the cause of my problem! Regards, Karl


0

I found a solution, although I don't really understand it yet. I'm using REDIRECT instead of DNAT, and what do you know, it works like a charm! The only thing I could come up with, is the fact that in my DNAT rule I kept my actual IP address to which I want to redirect, whilst REDIRECT actually just reroutes to 127.0.0.1. Kind regards, Xabre


0

After a lot of manpage reading I figured it out: I was missing the iroute directive in the OpenVPN server configuration. After adding these entries to the config it worked: server.ovpn client-config-dir ccd route 192.168.0.0 255.255.255.0 10.8.0.1 ccd\client iroute 192.168.2.0 255.255.255.0


2

OpenWRT is configured by default to split the Internet into a "WAN" zone, a "LAN" zone, and perform NAT-ing between the two. So on all routers except Router 1, you will want to modify the firewall configuration to put all interfaces into the LAN zone: remove the whole config zone for wan from /etc/config/firewall; add list network wan to the config zone ...


3

Figured this out, the solution is to configure iptables rules as below: iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 80 -o eth0 -m statistic --mode nth --every 1 --packet 0 -j SNAT --to-source XX.XXX.XXX.146 iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 80 -o eth0 -m statistic --mode nth --every 2 --packet 0 -j ...


1

If you want to use different source IP addresses when using the file_get_contents PHP function, you should try using PHP contexts and specifying the bindto socket option. If you're NOT using PHP and your client connection does not provide an option to bind to a specific source address, then you nave no other chance than iptables source-nat: you can define ...


0

Most routing protocols use statically assigned metrics — RIP, OSPF, EIGRP, BGP. In RIP, the default metric is 1, which is called the "hop count" metric. While it is possible to assign larger metrics to links in RIP, this is not recommended, since it reduces the maximum diameter of the network (RIP metrics are limited to 15). Using dynamically computed ...


2

Linux provides a number of tools for flexible routing selection. Single routing table In the simplest case, there is just one kernel routing table and no routes with the SRC attribute. This table contains a number of routes, which were placed there manually (ip route add), by the DHCP daemon, or by routing daemons. In this case, the kernel chooses: the ...


1

(Converting my comment to an answer) ICMP redirects, see linux-ip.net/html/routing-icmp.html Your solution is quite unusual, normally one wouldn't bridge to a real interface but setup routing and masquerading on the host.


1

a DNS (or DNS-like) service updated with the mapping {client-name => current ip address} Handing this on the OpenVPN server(s) is relatively easy with a --client-connect script on the OpenVPN servers. The client connect script is passed the IP address of the new connection. You can then use that to call nsupdate to adjust your DNS records. Here is an ...


1

Here's another approach. Instead of marking connections based upon packet count and hoping they don't get reinitialized, duplicated, or otherwise altered, just divide the packets up by source or destination IP. For any sufficiently large set of connections, you should have about a 50-50 spread. I'm posting the following as a drop-in replacement, but you ...


2

After some trial and error, I came to the solution below and it works as designed. Thanks to all that helped. ip access-list extended "100" 10 permit ip 192.168.100.0 0.0.0.63 10.220.1.10 0.0.0.0 20 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 Vlan 300 ip access-group 100 in something strange I noticed I can ping source ...


0

You enable RIP and after do ACL. Like illustrated there a bit for the ACL, http://vmfocus.com/2012/10/14/how-to-configure-access-lists-route-between-vlans-on-hp-v1910-24g/ Would look like that in the config.. (but I'am not the best in HP switch..) ip access-list extended "220" 10 permit ip 192.168.100.0 255.255.255.192 10.220.1.10 255.255.255.255 ...


0

If you are trying to access a single system on a subnet that has more than one system on it... I would put a static route on the end systems that specified to reach the 10.220.1.10 system you need to go through the HP router. Then I would use an access list on the router to ensure it is only routing traffic you intend. You can't use routing to (easily) do ...


0

Not very sure what you want. I assuming that your eth1 is a gateway for the 192.168.56.0 networks. Please try: iptables -t nat -I POSTROUTING -s 192.168.56.0/24 -j SNAT --to 10.0.0.1


0

You are currently specifying a single host using the "host" parameter. Instead try this Access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 This would deny all traffic from .2.0 to .1.0 http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html


0

Link at the bottom of your question is aimed at people who have multiple exit IPs. Since you are trying to push packages through eth0 (192.168.1.5) - you don't have IP aliases and you don't have multiple exit IPs but a single IP. So, lets say ppp0 has ip range: 10.100.100.0/24, initial packet connecting to your host will look something like: | SRC IP ...


0

I notice that you have mentioned that you've successfully established a site-to-site VPN, but you haven't listed its interface in your post - basically you want to alter your default gateway to the VPN gateway interface on the Cisco in your configuration as above (not your WAN IP).


0

Let's consider following scenario: your VPS has a single ethernet interface, configured with IP address 4.3.2.1/24; your VPS can access the Internet via a default-gateway 4.3.2.254 your VPS has not yet activated any OpenVPN connection; hence there are no tun interface active In such a scenario, from your machine (let's suppose your machine is 9.8.7.6/24 ...


0

This can help: put TCPKeepAlive=yes in your /etc/ssh/sshd_config From man sshd_config | less +/'^ *TCPKeepAlive' TCPKeepAlive Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that ...


2

There is an easier way to add routes... This file - /etc/init.d/network - is launched when the PC is booting, and it uses a file /etc/sysconfig/static-routes to add static routes You have to create it because it doesn't exist. If you read carefully the file /etc/init.d/network, it reads in this file each line to add routes, those line must begin by "any", ...


1

you seem to read the information in the routing table wrong. Destination GateWay Genmask ... Iface 192.168.4.0 0.0.0.0 255.255.252.0 bond0.11 192.168.8.0 0.0.0.0 255.255.252.0 bond0.12 The above actually means that network 192.168.4.0/255.55.252.0 is locally connected on bond0.11, thus can be reached without a gateway. A gateway ...


0

Make sure that each computer know the route to the other network. Use route print to validate. Use route add 10.11.0.0 mask 255.255.255.0 10.10.0.1 on B in example, and route add 10.10.0.1 mask 255.255.255.0 10.11.0.1 on A to be sure the packet will go back. Only the machine C that run the openvpn software know all the route.


6

The routes metric is to set preference among routes with equal specificity. That is true of routing in general (i.e. Cisco, Windows, etc). So the model works like: Find the most specific route (aka the longest prefix match*) If there are multiple routes with the same specificity, pick the one with the lowest administrative distance (This distinguishes ...


1

First of all, in my point of view, I think you should first clearly understand the distinction between forwarding and routing, which is often neglected. According to the book Computer Networks in page 240 by Lary L.Peterson, forwarding is a serials of actions the router will take once receives a package, including looking at its destination address, ...


0

You can override the default gateway provided via a DHCP lease by running the following two commands from an elevated Command Prompt (adapted from this Technet thread): route delete 0.0.0.0 mask 0.0.0.0 <DHCP_GATEWAY_IP> route add 0.0.0.0 mask 0.0.0.0 <NEW_GATEWAY_IP> If you don't want any default route, simply omit the route add command. ...



Top 50 recent answers are included