Tag Info

New answers tagged

0

No, there is no convincing and trouble-free way of doing this. At layer 3, once both tunnels are up, the client has absolutely no way of distinguishing 172.16.0.50-via-tunnel-1 from 172.16.0.50-via-tunnel-2; IP just doesn't support that kind of decision-making (modulo source routing, which will be very painful and be badly-supported). There are some filthy ...


0

I can only comment on question 3. You should look at Ethernet bonding (802.3ad). That should be much simpler than IP based load balancing.


2

Thanks for all the inputs. I came up with a shell script to do the job for me. I believe this would be helpful for other users also to perform the task. Please note that the local machine IP. Please do the necessary changes accordingly. #!/bin/sh echo "Enabling Traceroute..." #Outbound UDP traffic Policy iptables -I OUTPUT -o eth0 -p udp --dport ...


2

What you are describing is what happens when a switch's CAM table is full, where it can no longer learn MAC address and it forwards packets out every port. It might be hard to figure out if this is the problem with an unmanaged switch, but with a managed switch you should be able to display the CAM table. What also would help in this question is a diagram ...


3

First of all: the iptables -A command add the new rule after the end of your actual chains. They were processed only after the last rule in your chains. But it won't happen, because the last rule already filters everything out! You need to put these commands before your last rule, which can be done with the -I <n> flag of the iptables. Second: ...


4

There is a simple fix for this, at least when it comes to the most popular Cisco routers: mls cef maximum-routes ip 768 This requires a reboot. Also see Cisco's documentation about adjusting the TCAM to allocate more IPv4 space (and less IPv6): ...


0

You need to make sure that intra interface traffic is allowed. sh run | i same-security-traffic If it isn't, then issue the following command: same-security-traffic permit intra-interface It will allow traffic to arrive and leave the firewall on the same interface (hairpining). Also, your static nat shouldn't be necessary since the traffic won't go ...


0

To write the final solution: iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE iptables -A FORWARD -i eth2 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT echo > /etc/sysconfig/network-scripts/route-eth2 nano /etc/sysconfig/network-scripts/route-eth2 and enter: ADDRESS0=10.96.0.0 ...


1

You have to add route on your server to 10.96.0.0/16 to VPN router, which IP you did not mentioner. Lets call it 192.168.20.1. And then you have 2 options: to put routes on your VPN router to all networks, that you want to reach, that you use in local lan. Like: 192.168.4.0/24 -> 192.168.20.100 192.168.2.0/24 -> 192.168.20.100 other option to NAT ...


0

Two words: route cache UDP is stateless, so the system will build a "connection" to give it state. As long as you keep sending packets, the cache for that connection will remain valid. As such, when the Machine LAN is disconnected, your traffic will default to the Mill LAN. Until the incorrect route cache expires (due to inactivity), the app will not work. ...


1

I was first going to say that this question would be better answered on Superuser or Serverfault, but I want to address a strategic problem you will have: You have chosen to use 192.168.0.0 for your "private" LAN. Unfortunately, you have chosen the most commonly used private network address, and you will likely run into address conflicts often -- you seem ...


3

SOLVED IT!! My drive was mapped with "\computername\share" which means that it will look for "computername" in the default gateway's subnet, right? When i mapped the drive with "\172.x.x.x\share" it worked! Of course without default gateway and the static route "route add 172.0.0.0 mask 255.0.0.0 172.21.61.161 metric 1 if 11" I can't belive that i missed ...


0

There exists a way to list all routing entries of all tables. ip route show table all Using some shell piping magic, you can extract all table names and IDs like this: ip route show table all | grep "table" | sed 's/.*\(table.*\)/\1/g' | awk '{print $2}' | sort | uniq If you only care about the numeric table names, add some grep filtering: ip route show ...


1

What can I do to get all the table names that currently exist? The file /etc/iproute2/rt_tables is the only source of table names on the system. Internally, routing tables have integer identifiers. The rest of your question is a bit confusing. If a table is not referenced by a rule, then it is effectively "deleted" because it has no impact on the ...


0

Routing happens on IP level, ports start at the TCP level. So you can't use routes to switch for ports. If you want to use iptables you might try this approach: iptables forward specific port to specific nic (StackOverflow) Mark packages which should go via eth1: iptables -A PREROUTING -i eth0 -t mangle -p tcp --dports 22,53,80,443 -j MARK --set-mark 1 ...


0

There is no such thing as subnetting in IPv6, every subnet is /64. Do not attempt to subnet a /64, IPv6-mechanisms like SLAAC will wreck your scheme. From your description I understand that you have to bridge the guest interfaces to the host interface, so they are in the same subnet as the host. If, however, the host is a router for the guests, then ...


0

Raw Sockets bypass the netfilter stack, so iptables will have no effect on these packets.


2

When packets are send directly on the Ethernet interface, they won't be going through the IP layer in the kernel's network stack. That means no iptables either. You'll need to either get the program to generate the packet the way you want it to look, or you'll need to have the packet send through the IP layer in your network stack. There are a few ...


2

You specified a route of 0.0.0.0/1. This subnet consists of 0.0.0.0 through 127.255.255.255 inclusive. It's not at all clear why you would want to only route half of the possible IP addresses. I suspect you meant to route all of it (e.g. 0.0.0.0/0) instead.


0

I end up with several solution and the one being retain is the "crontabed" script running with an arping this is the script: #!/bin/sh #remote host to test on public interface REMOTE_TEST_IP="195.168.156.1" REMOTE_TEST_MAC="00:2D:FF:FF:FF:FF" #number of arp request send to test connectivity TEST_COUNT=4 #the rate acceptable of arp request failling, ...


1

I do not know how to configure iptables on this machine to do as you want. I usually use in such case SSH tunneling. I find it easy to set-up (personal opinion here!) ;-) but ... you need to have an SSH connection on your localhost (it does not need to be accessible from remote!). The command syntax in this case is: ssh -f -C -N -L [<bind ...



Top 50 recent answers are included