Tag Info

New answers tagged

0

If your client is running Windows 7 then you have to run the open vpn clients with admin rights otherwise the routing tables would not get populated and you may not be able to ping the hosts on the server network.


4

You can use AWS API Gateway (documemtation). API Gateway helps developers deliver robust, secure and scalable mobile and web application backends. API Gateway allows developers to securely connect mobile and web applications to business logic hosted on AWS Lambda, APIs hosted on Amazon EC2, or other publicly addressable web services hosted inside or ...


0

Assuming bge0 has all IP, you can choose which IP has to be redirected with rules like this : rdr pass on $ext_if inet proto tcp to $PUB_IP port http -> $WEBSERVER port http


0

The solution is the same as for IPv4 - you have to hide a private network behind a NAT with two WAN links. Unique Local Addresses (ULA) is "Private networks for IPv6". Network Prefix Translation (NPt) is "NAT for IPv6". Assign an internal IPv6 Unique Local Address for your network. While it is not required to do so (the chances of colliding ULAs is much ...


1

Your diagram uses x/29 and y/30 while the text uses y/29 and z/30, and your update saying x/29 uses a y/30 gateway further confuses things as you cannot use a gateway on another subnet. Perhaps adding IPs and netmasks would help. I shall assume a/24, b/24, x/29, y/30 and that the gateway you are referring to is the router with x/29 and y/30 interfaces. ...


1

Since I answered your first question, I might as well answer this one too. :) It looks like mod_proxy can do it, but so can Nginx and HAproxy (or here). Those links at least shows that the proxying of WebSockets works, but how you'd actually do it with Apache or Nginx would require some work. On the otherhand, the HAproxy links provided show exactly how ...


1

Is iptables capable of routing rules based on HTTP request headers? No, it's not. IPTables works at layer 3/4, and HTTP request headers are layer 7. Is apache2 capable to routing requests to other IP's based on HTTP request headers? Yes, using mod_proxy, Apache can proxy those requests to another server. Which application is best for handling ...


1

Why not something like this: $ ip -4 addr show eth0 | grep inet | awk '{ print $2 }' 192.168.1.100/24 FYI, ifconfig is deprecated. You should start using the various ip commands in place of what you used ifconfig for previously.


0

I had bridge my connection. This still didn't work, but checking the cable connected box (circled in the image below) fixed my network connection. I don't fully understand why.


0

Seems like OpenVPN in bridging mode can solve your problem. I've used such configurations in the past, and can confirm this works as expected, emulating an ethernet cable and without forcing any additions subnets, etc.


1

I have made it! On UBUNTU1, I have my /etc/iproute2/rt_tables file as: root@ubuntu-primary:/home# cat /etc/iproute2/rt_tables # # reserved values # 255 local 254 main 253 default 1 net1 2 net2 3 net3 0 unspec # # local # #1 inr.ruhep root@ubuntu-primary:/home# I have created created rules with commands: ip rule add from 192.168.1.101 table ...


1

You need to divide the /25 range into /26, /27, /28, /29 or /30 ranges. Then your router would have a separate IP address in each of these networks, and would handle the routing between those subnetworks and the Internet.


0

Connect your VPN to Server1 On Server1: ssh -D 9999 user@server2 On you desktop, configure your browser (or the program you want to tunnel) to use Server1:9999 as a SOCKS4 Proxy. Every connection will be routed via VPN to Server1, re-packed inside a tunnel to Server2, and sent to the internet from there.


0

You cannot add two differents gateway to the same network. From ubuntu1, you must define which interface will be the route to 192.168.4.X, you can go through either 192.168.1.102 or 192.168.2.102 or 192.168.3.102. Once you've set routing by 192.168.1.102, the only way to route by 192.168.2.102 is to remove 192.168.1.102 and add 192.168.1.102. Following ...


0

Looks like I forgot to move the client.conf from the /etc/openvpn/ directory so when I uncommented those lines it just looped all the traffic of the server within the server! Doh!


0

You have 2 IPs in the same subnet(82.79.24.74/29) on the same interface (em2): 𝛌 ~ ipcalc 82.79.24.74/29 Address: 82.79.24.74 01010010.01001111.00011000.01001 010 Netmask: 255.255.255.248 = 29 11111111.11111111.11111111.11111 000 Wildcard: 0.0.0.7 00000000.00000000.00000000.00000 111 => Network: 82.79.24.72/29 ...


0

There is no rule that allows incoming traffic from your gateway, it only allows traffic when it is already established or related. If you want to only allow ping from the gateway you can use something like this: iptables -A INPUT -s <GATEWAY-IP> -i <PUBLIC-INTERFACE> -d <PUBLIC-IP of the client> --icmp-type ping -j ACCEPT


0

http://askubuntu.com/questions/28733/how-do-i-run-a-script-after-openvpn-has-connected-successfully tells how you can execute custom scripts after connection going up or down. So, you should create a down script, which would clean up the routes and make OpenVPN execute that when connection goes down.


8

You can't use switch port security on the Cisco since all the VMs will be sharing a physical switch port. And you can't use Linux iptables because the traffic is being bridged, not routed, through the hypervisor machine. But you can emulate switch port security on the hypervisor with Linux ebtables, which is a lesser-known layer 2/3 firewall on the Linux ...


1

I think there are 2 different things at play here - The incorrect setting option routers 192.158.66.254; in your DHCP configuration. This would stop external connectivity, but is not actually the cause of your problem. The inability to ping the Windows box from the Linux boxes is most likely due to the TCP stack on the Windows box (or a firewall running ...


1

You have option routers 192.158.66.254; in your configuration, which causes the invalid default route in your client configuration. Comment out this line, and you should be left with the correct default router of 192.168.66.254.


2

Well, you configuration seems to be a bit short. I'm attaching the configuration of my router as a working example. Also, you are using '-m state' to track related and established connections, while I usually utilise '-m conntrack'. What you can try - to log dropped packets and see what and why is getting dropped by iptables. I'm writing my configuration ...


4

The client has no default route via your router box. Try route add -net default gw a.b.c.d on the client, where a.b.c.d is the client-facing address of the firewall.


0

Create a loopback NAT on your Sonicwall. It would look like the screenshot below.


0

Hosts do not have to be in separate subnets in order to have a firewall between them. Firewalls come in different flavors such as a routing firewall or a bridging firewall. When firewalls are mentioned without specifying which kind, it is generally assumed you mean a routing firewall. But in order to firewall traffic between hosts on a single subnet, what ...


-1

I would solve otherwise. I precede to install a PPPoE server, which all clients are isolated because they are in a tunnel and have to connect to the server


0

Create LAN1 and LAN2 zones. Create Firewall Rules opening LAN1 to LAN2 and vice versa. (Create routes sending subnet1 to subnet2.) Test without (3.) and do a traceroute. See where traffic goes and create routes only if needed.


0

I solved my problem and now it's work for me. I changed the iptables rules both machine to this: iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth1 -j MASQUERADE iptables -t filter -A FORWARD -i tun0 -o eth1 -j ACCEPT iptables -t filter -A FORWARD -i eth1 -o tun0 -j ACCEPT


0

You just need Route policies in place, and they should have been created automatically for you when you set up X0 and X4. Make sure that the computers on both subnets have the firewall set as the default gateway.


0

I ended up completely reflashing the firmware from scratch, and now all these problems are gone. Traceroute works again and the network is functioning correctly again. I am going to assume that the configuration was messed up and that's what caused this. By the way, a couple of my edits were rejected today, I'm guessing because they came from another acct, ...


0

Why can't all systems be servers, with client apps? A computer can be both a server and a client at the same time. It's not mutually exclusive unless there's a poor design in which you're utilizing the same ports. In the instance where you have local systems and remote systems, each behind their own firewalls, having NAT or port-forwarding in place to ...


0

That is not possible. Any reasonable customers have firewalls in their networks that prevent connections from outside networks. The configuration needed on the firewalls depends on the network structure, and is different on each customer.


0

Well, given that you told us: Because I'm not able to easily force the process in question to bind to a specific interface, I am trying to achieve the same outcome via routing. Is this possible? we can start helping you from this very point. Once upon a time in FreeBSD jail system call appeared with the purpose to restrict a process, or group of ...


0

Sadly the iptables extensions manpage (http://ipset.netfilter.org/iptables-extensions.man.html) states no module to fullfill your requirements. I would suggest the same as Mauricio López. You could setuid or setgid the target application to a specific user or group, so that no matter who originally started the application, it will always run as a specific ...


0

I THINK I have found a way to do this. Using OpenVPN, I create a network between the user's machine and our server. (I have to configure it to only route the relevant traffic, not everything like it currently does.) I set up some iptables rules to source-nat all traffic to their server's IP address so it thinks it is coming from our server. The traffic is ...


1

You need to have the IPsec changed from a /32 to an appropriate subnet sized config, like /24. You should not try to find ways to compromise an existing tunnel to do something it's not configured for.


0

The problem here is most likely asymmetric routing. Let's give site A IP address 192.0.2.25, site B address 198.51.100.10. The packet from site A to Youtube goes like this with the tunnel configuration: 192.0.2.25 198.51.100.10 Router 1 Router 2 Youtube website The packet back from Youtube website goes like this: Youtube website Router 3 Router 4 ...


1

Your routing the packets through either eth1 or eth0. tables mangle should address this. To do so, I had to mark packets and set up rules for handling it. First, add a rule that make the kernel route packets marked with 2 through table ip rule add fwmark 2 table 3 Add a route for redirecting traffic over a different interface, assuming the gateway being ...


1

The problem was not in Shorewall config at all. There actually WAS access from VPN to the Internet, but VPN clients had wrong DNS server address. There was a line in OpenVPN's server.conf push "dhcp-option DNS 192.168.0.1" Which didn't make sense in given setup. I corrected the address, and now VPN clients do have access to the Internet.


1

Duplicate your existing P2 (click the + to the right of it), change local from 10.0.2.0/24, leaving same 10.172.0.0/16 remote. Do the same, flipping local and remote, on "other router." Then you'll be able to communicate between.



Top 50 recent answers are included