New answers tagged

0

Using packet based equal cost balancing does not work with GRE as it will introduce reordering in the packet streams and break them. You seem to actually want a conntrack-based multipath routing which can be easily configured on any linux-based router/firewall. Multipath routing based on IP addresses is even simpler in configuration.


0

Generally, in order to accomplish this, you will need to do this: Make sure that host C will receive the packet, for example by capturing it at the interface using tcpdump or other pcap procedure on the interface. You have to make sure that the packet will be delivered to host C. This depends on the link layer used. Assuming you have ethernet and 1 NIC ...


2

You should be able to accomplish what you want using this command: ip route add 10.10.0.10 dev eth0:1 src 192.168.111.5 If you enter ip route list you should see the change of src.


0

Here is a cmd-script that extracts the static routes from the registry, and issues route delete commands for each of them. This method removes them both from the stored list of persistent routes, and from the currently active routes. @echo off set key=HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes for /f "tokens=1,2,3,* delims=," ...


0

There are different ways of achieving this. You may add firewall rules using iptables in the proxy server that will block outgoing connection to port 80/443 for local LAN, so that the users won't be able to use internet without using the proxy. Disable IP forwarding in the proxy server and configure proper route to the other network using route command so ...


0

Maybe you can try to put interface ip and add that interface into vlan, after that assign port to that vlan.


0

The solution I have come up so far is: iptables -t nat -A PREROUTING -p tcp -s 10.10.10.20 -d 1.2.3.4 --dport 53 -j DNAT --to-destination 10.10.10.10:53 iptables -t nat -A PREROUTING -p tcp -s 10.10.10.20 -d 1.2.3.4 --dport 53 -j DNAT --to-destination 10.10.10.10:53 the same rules goes for other services if any. So far I have not met any pitfalls and it ...


0

Buy yourself new camera. This is a bad design you want to do. The only thing you can do is to have a switch that can enable port easilly. Thus you enable the correct for the cam you want to control after. I have difficulty to think its hard coded IP. That mean you ajusted your LAN setting for those Cam.


0

I guess, saying without any research, that you maybe could use a proxy server for both camera's and then call the proxies, instead of the camera's themselves. I don't know if that will work out fopr you, but that's the only thing I can think of now. Regards.


0

A complete solution that wouldn't need customer action and would use the least moving parts needs a reverse connection and a connection broker. You could reverse the connection ends, and get those "homekit" or "home servers" phone home (your servers) instead. This is called Reverse Tunneling, and can be used to bypass firewalls and dynamic IPs; and can be ...


0

You're close. Your second line should be server= instead. address=/#/127.0.0.1 server=/google.com/# Whereas address means "Resolve this domain and its subdomains as this address", server means "Ask this nameserver to resolve this domain and its subdomains." The server directive supports # in the second position to mean "the default upstream server". ...


0

The penultimate step in bsdinstall asks if you would like to open a shell to make manual modifications. At this point, you could edit either /etc/rc.conf and add some suitable directives or add an /etc/rc.local with the commands listed in your question. I tested an Auto (UFS) and an Auto (ZFS) install and both times the newly created rc.conf file was ...


0

This is a typical beginning of each failure story in deploying ASA. Someone decides he needs ASA instead of the router and starts to use it like router. But ASA isn't quite a router, it's a security appliance. It's not intended to be used instead of the router, it's intended to be used with a router. The fact that it's capable of doing some of the router's ...


1

A link prefix is used between your router and your ISP. The routed prefix is used inside your network. If you receive a /64 routed prefix from your ISP, then you would simply have your router advertise that prefix on your LAN. If you got a prefix smaller than /64 (perhaps a /48?) you should consider how to subnet that prefix in a logical way, to be used ...


0

Post the output of netstat -ranf inet. What happens if you disable pf and ping a host on the Internet that’s known to respond using ping -I xx.xx.98.193? I also find your ISP providing a MAC address for xx.xx.98.193 unusual—it leads me to believe your problem is on your ISP’s end.


0

Add an iptables rule that will reference your PPTP-server internal interface (facing the LAN) that VPN clients will match. Probably with the VPN IP addresses pool you are using for your PPTP server. In order to reach your LAN SMB servers VPN client's packet will need to cross your VPN server's LAN interface, there you will filter them out.


2

You'll have to add DEFROUTE=no To all the interfaces that should not have the default route. In your case, adding DEFROUTE=no to /etc/sysconfig/network-scripts/ifcfg-eth1 should do the trick. Alternatively, instead of setting GATEWAY in /etc/sysconfig/network you can set it in /etc/sysconfig/network-scripts/route-eth0 instead. I.e. echo 0.0.0.0/0 via ...


1

The feature you are looking for is "policy based routing" (PBR), so you have to find a router that support it. Product recommendation is off-topic here, but among the various options, you can use a free network OS like VyOs It runs on any x64 platform.


1

Any VPN solution will do. OpenVPN that connects from client to server (to cloud) will be nice solution, and you can easily tune the encryption level etc. And yes you can also filter who connects to your cloud if you wish to. Just don't forget to block inter-client traffic on server side! As you are able to communicate with client you are free to use and ...


0

https://devcentral.f5.com/questions/redirecting-to-different-port-based-on-url F5 irules apparently are the answer, only ever used this for basic load balancing so i wasnt aware of some of its more advanced features.


5

It's not a router problem and it has nothing to do with the "Cisco world". You can host multiple websites on a single web server all on port 80 via a single ip address by using Host Headers (or the Linux equivalent).


0

If the packet come thru the WAN's port you have no choice but to activate the setting. (Enable management via WAN) If the packet is seen from a LAN's port, but only from another subnet you need to define those subnet in the sonicwall, and to make allow rule for them. See that picture for an actual example; nb. You miss a network diagram to help


0

In the end I solved this by getting second network interface to my router device. I configured second interface to connect the other other network. Then I just created new static route to my virtual network using ip route add command.


0

You have two different gateways configured for two interfaces, which is never going to work the way you want. If you need only one default gateway then configure also one. You don't need a gateway for the LAN (192.168.0.0/24) to communicate internally. If you have ip_forward enabled then the lan computers will be able to go to internet anyway. Try this: ...


0

I think, eth1 brings up before eth0 and script trying to delete a non-exist route. Try this: source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto eth1 allow-hotplug eth1 iface eth1 inet static address 1.2.3.4 netmask 255.255.255.0 gateway 1.2.3.1 ...


0

If this is Linux, I might suggest looking into prerouting and postrouting. Have a look at the man pages, this should be a start. If this is a application, depending on your protocol, create your own custom packet with a final destination IP (what I had to do). Hope this helps!


0

Yes, it is possible to do that by updating source and destination MAC address before sending the packet onto the network again but leaving the IP addresses unchanged. This principle is used in some DSR based load balancers. Quoting a HAProxy blog post: In DSR mode, the load-balancer routes packets to the backends without changing anything in it but the ...


1

In addition to Ondra Sniper Flidr and the comment by Michael Hampton, I wanted to provide the official statement by Citrix. Quoting this pdf (didn't found this in HTML), chapter "XenMotion", page sixteen: But in this example setup, the external real switch device is expecting the MAC address of the VM to be on one port, while it‟s actually just ...


0

It will work well, live migration is standard in production environment. But your infrastructure is not so reliable as you think it is, there are many SPOFs in that. What will happen when your switch will die? Or even on port on that switch? What will happen when your NAS will die? If you need high availabiliy, every component of your infrastructure must be ...


0

I don't think there's a good answer for this. I don't think iptables lets you change the destination IP address after routing. What I want to do is: iptables -t nat -A POSTROUTING -o eth0 -p udp -d 10.0.0.0/8 --dport 53 -m comment --comment "Redirect DNS when VPN is down" -j DNAT --to-destination 8.8.8.8 But that isn't legal. I want to change the ...


1

This script works OK although it is quite old. Many other have used it such as: https://forums.plex.tv/discussion/173977/limiting-bandwidth-per-user Note tc does not work very well for input traffic unless you use an ifb virtual deivce and route packets through that. It's much better and recommended to use the OUTPUT chain in IP tables. There are loads ...


1

The reason it is not working as intended is that DHCP will look at interface and try to find one network that matches the most You need 2 interfaces (or 2 IPs on one interface) with different network size. But you should avoid having overlapping networks Proper config would be having 2 non-overlapping networks and each of DHCP configs having its own ...


0

Try these declarations: shared-network "mynet" { # No subnet 10.10.0.0 netmask 255.255.0.0 # since it would overlap with other subnets subnet 10.10.10.0 netmask 255.255.255.0 { option routers 10.10.0.1; } subnet 10.10.1.0 netmask 255.255.255.0 { option routers 10.10.1.1; # the range should not overlap with ...


0

It seems that the return path for the packets is not known. To be sure you would need to check intermediate routes, I'll get to that in the end. When you ping 10.10.3.50 from the 10.10.2.0/24 host it is forwarded your default gateway (lets assume 10.10.2.1), then itself checks its own routing table and sees the route for 10.10.3.0/24 via 10.10.1.5. A ICMP ...


0

If you want to send traffic from a source to a destination you need to use static routes instead iptables. Iptables let you accept or deny any traffic going trough your machine, but it will no redirect any data. For your purpose, you can try with the following route in your Ubuntu Server Router 192.168.1.254: ip route add 172.16.1.0/24 via 192.168.2.254 ...


1

Firstly, google's DNS service (which is provided on the IP addresses you list above) is anycast, which means there are systems all over the world that provide service on those addresses, and you get directed to the nearest one to you when you request it; their main website is similarly distributed. Try pinging 8.8.8.8 from the UK, and look at the RTTs - ...


0

You need to add route-nopull option (and remove redirect-gateway if it exists) to your OpenVPN client's configuration file on your VPS. That way connecting to a VPN server won't modify any routes on your VPS, so you would be able to set those you need by yourself.



Top 50 recent answers are included