New answers tagged

0

So this is the definitive answer i was looking for. You first need to set NAT (prerouting) rule to redirect the traffic to the correct server/computer. Done like this... iptables -t nat -A PREROUTING -p tcp -s yy.yy.yy.0/24 --dport 3389 -j DNAT --to-destination 192.168.1.xx:3389 Then you need a Filter (FORWARD) Rule to allow the traffic to flow to the ...


0

So I ended up using an Etherchannel (ports 23/24 on each switch). I setup VTP. I setup HSRP for fail over routing. This was the key, as with trunks (dot1q). I have my servers running SFT between switches. This way, if one switch fails, I have routing, trunking, and core layer 2/3 capabilities. While it's not VSS, it's getting much of what I need done. One ...


0

Broadcast messages can be sent by any IPv4 host. As you say PCs use broadcast messages, Switches flood broadcasts out of every port apart from the port the broadcast came in on, but technically any IPv4 device has the ability to use broadcast traffic for network communication. take a Network printer for example that is set up to obtain a DHCP assigned ...


0

You can facing three issues here, it's impossible to determine which one, because lack of necessary details like: firewall(s) configuration and routing table setup. It's probably routing problem, main office doesn't have route to remote office. NAT problem, "remote" is NAT-ed incorrectly. Firewall problem, something is droping your traffic, but ICMP ...


0

Answer is that I were needed to add route on both clients


2

iptables -I FORWARD -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -j ACCEPT iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE


0

So it looks like this is working now, in the end the particular devices I was pinging didn't have the right default gateway and/or subnet mask setup by the equipment installers. I incorrectly assumed that if the switch could ping them then it was good enough and the device should be able to ping other subnets but it doesn't look like this is the case.


0

You can't do VSS with the 3850's. You could stackwise through the stacking ports but that would require them to be somewhat near eachother. You can setup HSRP/VRRP/GLBP with a virtual IP to provide next hop redundancy. however, you would not be able to form a functional etherchannel from one device to both switches.


0

What you want is to specify how the Gateway can be reached via the local scope. That is it in fact reachable on the same segment. You example is merely missing the line Scope=link. [Match] Name=enp0s3 [Address] Address=192.168.0.2/32 [Route] Destination=192.168.0.1/32 Scope=link [Route] Gateway=192.168.0.1


0

First PC B must obtain PC A MAC address so it either ARPs or it has already received a gratuitous ARP. Either way it has the MAC address and yes it will send the ping to PC A. PC A receives it because it is directed at its MAC and IP addresses. PC A should now send the response to the gateway as you say. The frame will have PC B's IP address but the ...


0

The gateway sees that there's a packet's sender is in the same subnet as the receiver, so it discards the packet as there's no routing to be done. This likely depends on what kind of device your gateways is and how the gateway is configured. But, assuming your gateway device is using a /24 netmask, any router/switch/firewall will see the packet come in and ...


0

Why is PC B able to ping PC A? Because PC B can send packets to PC A without resorting to going outside it's local network due to the subnet mask it's using - by giving it a /24 you're saying that 192.168.1.1-255 addresses don't need to go to the gateway to access them.


1

You could use HAProxy, or Nginx, or ATS, or Squid, or Pound or just a set of iptables rules. But you've not told us very much about the problem you are trying to solve. If the service requires a nominated IP address, then presumably it has some value which should be protected - anything you put in place should ensure that there is equivalent or better ...


0

Given the diagram I see is specifies that you are using a tun adapter, meaning a routed network, and not a layer 2 vpn network. You need to have IP forwarding working properly. Plus for your situation you will also need to do some NAT on the VPN server due to the security involved in the ssh protocol to ensure that traffic goes back and forth via the same ...


0

Neither of the existing answers explain how to allow an inbound traceroute; the accepted answer doesn't even try to answer the question. We can see from man 8 traceroute that: UDP is the default traceroute mechanism on Linux traceroute expects to get an "ICMP unreachable" message in response to its query traces start at port 33434 and increment by one ...


0

Configure the computer as a router and make it the default router for the devices in the 192.168.59.0/24 network. Configure a DHCP server to issue machines dynamic IP addresses, if desired. It should NAT for those machines. It's default gateway should be the 192.168.195.1 router that has the Internet connection. To prevent machines on the subnets from ...


0

If you don't want computers on the two nets communicating, firewall that kind of the traffic on the box that routes between the two nets. NAT would only protect the machines on 192.168.59.0/24 from being contacted by the machines on 192.168.195.0/24, but not the other way around. But unless the router on 192.168.195.1 knows what to do with traffic from/to ...


0

In addition to everything else Per has said. You're AP gateway is pointed at itself. It needs to be pointed at the router.


0

You need to disable the DHCP server on the TP-link box. Most likely your wireless clients are getting DHCP off your AP and you haven't configured a correct gateway and DNS.


1

You can use the directive route-noexec and manually set up the routing with up and down scripts on this specific client. You should have all required information in environment variables, see section Environmental Variables in the manpage.


0

From your question it seems that you are connected, I guess over ethernet, to a /64 network from your VPS provider. In that case what you ask is not possible. Your upstream router would have to keep a Neighbor Discovery entry for each separate IPv6 address in memory, which will use much more memory than available (1). You can ask your provider to route a ...


0

You could have two different .opvn files in the client that you use depending on your situation. Then in one of these .opvpn files you could use the route-nopull directive and use custom alternative routes (example). It's not perfect, but it's the best I could come up with.


0

You are getting the SYN+ACK responses from ifconfig.co but they are ignored. Firewall should be accepting them but rp_filter might drop them. Is adding a route to ifconfig.co ip route add ifconfig.co dev tun0 fixing the issue ? If yes you might try to disable reverse path filtering (rp_filter sysctl settings)


0

You are probably routing the answers to the wrong interface. ip route add 239.255.255.250 dev wlan0 Should do the trick.



Top 50 recent answers are included