Tag Info

Hot answers tagged

7

You'll want to upload and install tcpdump for tomato. You'll need to wget the file and host it somehow and then wget it onto your device. Put in /usr/local/bin or some /bin in your $PATH for easy keeping. See link for file: link Once you get it installed run something like this (modify for proper interface) tcpdump -i eth0 -n port 80 See tcpdump cheat ...


6

We have used DDWRT for over a year now and have never had an prob with it. We run it on a WRT54G that is on and open to the public 24/7. I may have had to restart it 3 times in the last year or so. We frequently have 15-25 wireless users. There is plenty of support for DDWRT online and I would definitely recommend it. If you have read anything about it ...


5

Setup reservations for the specific hosts using the dhcp-host option. Use tag options to flag those for a special set of options. This is completely un-tested, but I suspect your config might look something like this. Check the man page for full details. dhcp-host=00:15:99:27:f8:98,set:specialhosts,192.168.32.20 ...


4

We use them everywhere, I think we got about a hundred used in production, from simple firewalls to asterix nodes. We have standardized on ASUS WL-500GP hardware. We have developed some scripts in-house to handle upgrades and "config" snapshots. The only thing we really miss is accelerated crypto for OpenVPN.


4

Throw hardware at it :-) One option: Start with a home router/firewall device (not one with wifi though). Connect it to your cable modem. Get two wifi routers and plug the WAN port of each into LAN ports on the main router. Now, as long as you don't add any static routes to the main router you have two networks that can't "see" each other. Another option: ...


4

Yes it is possible, but it the performance improvement depends on your traffic patterns and configuration. Bonding will certainly work, how well it works will depend on how it is configured and if your switch also supports some form of bonding and how you configured the switch if it does. Another common usage of multiple interfaces is redundancy. This is ...


3

We use OpenWRT at work, both in the office and DC. It'll handle as many machines as your wireless bandwidth will support, as far as I can tell. I don't know how long we've been using it, it was here when I got here.


3

The Tomato firmware seems to be aimed mostly at use via the GUI, from a quick read over their FAQ. It is possible to do perform configuration tasks from the command line, but the documentation is somewhat sparse. It looks like command line access is there more for diagnostic purposes. Maybe it's time to give the more bare-bones OpenWRT a go? (I recently ...


2

Herea a shot in the dark, but if you look on ebay you can get some truly awesome deals on EoL'd Cisco's, I'm talking 2600/3600, with that you can do exactly what your proposing, There is a need for a little CLI config, but after that you will be truly impressed with what it can do for you, i.e shaping torrents to a minimum throughput during 5pm and 2am, but ...


2

You would need to re-flash the firmware with something like DD-WRT which can get you full access to the underlying Linux OS. From there you can configure the iptables, etc. to do whatever you wish on the different interfaces. You will need a firm understanding of Linux routing, this is not for the casual end-user. The main page for the DD-WRT project is ...


2

Designating one of your "Lan" ports to be connected to the neighborhood wifi network shouldn't be too difficult if you use a firmware that gives you access to the underlying IP stack, such as DD-WRT. However... I'd then like to set up routing so than some traffic is routed to ADSL, and the rest to the Mikrotik. This is the tricky part—What you want to ...


2

Both hosts would appear to be in the same subnet in your example (as I'm assuming a /24 subnet). Without using a layer 2 filtering mechanism (like ebtables) you're not going to be able to filter that traffic. Hosts in the same subnet communicate to each other at layer 2 w/o needing a router to facilitate the communication. Because the router isn't involved ...


2

The OpenVPN feature you're looking for, which will allow the server to authenticate clients based on both their certificate and a credential, is auth-user-pass-verify. This feature allows the server to pass the username/password provided by the remote user to a script that performs the authentication. At that point you can validate the credentials against ...


2

So in your previous setup I suspect your fully qualified domain name was something more then just the bare hostname. Perhaps router.local., or router.lan. or something else like that. With a fully qualified name defined, you could then the DNS search path setting for your network via your DHCP server. So your routers hostname would be router.local., and ...


2

In the firewall's INPUT chain, logdrop line kills your connection. It is a catch-all chain for dropping all unwanted traffic. The rule processing never reaches the web rules. You must move the ACCEPT rules above the logdrop rule.


1

VPN connections are secure "by definition". Otherwise you would not call it a VPN. Security is reached by crypto keys. Looking at MAC addresses in this context does not make sense. It is not clear what the connection shall look like but I assume that no routing is intended. So you need at least four rules in your firewall (for the physical interface, say ...


1

iptables -A ... puts the rule at the end of a chain. Thus your one never matches (or at least with no effect) because the second (-s ! $PROXY_SERVER) already got those packets / connections. Instead of iptables -A PREROUTING you need iptables -I PREROUTING 2. Or you create chains to make the structure easier to understand: #!/bin/bash ...


1

If you found this thread due to a similar problem without using ddwrt, but using dnsmasq on linux and using windows hosts that query it, requiring you to add a "." to make it actually do a dns lookup (mostly a problem with local domains/hostnames for intranet sites or LAN resourses) here is the solution: For statically assigned addresses you have to add a ...


1

The challenge password is a passphrase used to allow decryption of the key. That's the only way you can really do a "password" and a key. You can really only verify by password or key, not both. If you have both methods enabled, it will try key authentication first, and if that fails, it will fall back to password authentication. Not having a passphrase ...


1

auth-user-pass-verify is the right thing todo. In addition you can force auth-user username has to be the certified CN you can also force openvpn to make only one connection each cert at a time. That way an "mimic" has to have the right user compared to the certc CN and the right pass and he has to logon at a time the real owner doenst In addition you may ...


1

Something is wrong. Apache is listening on IPv6 only. Can you change the Listen parameter in Apache configuration file to Listen 0.0.0.0:80 And then restart Apache. Do netstat again, and make sure the output includes 0.0.0.0:www or something along those lines of IPv4.


1

I have no idea what may be the problem but a useful next step might be to attach to the listening process (and its forks) with strace and have a look at what's going on when you try to connect. strace -o apache.strace -f -p $PID Puts the result into the file apache.strace.


1

If you're talking about 4MBytes/s, i'd say that this is near the max that a wrt54gl can handle. Here is the result of a IxChariot test, with streams in both direction. Note the avg speed of 36Mbps, which 4.5MB/s.


1

You need to add a route to 10.1.1.0/24 on the VPN server for the clients to be able to reach it: root@vpn-server:~# ip route add 10.1.1.0/24 via 10.14.0.9


1

I wanted to know if its possible to "boost" the speed of my LAN connection to my server by having both Ethernet ports connected? Set up teaming for the ethernet ports server side and compatible teaming on the switch you use - if you have a switch that supports that. Otherwise: no ;)


1

We use DD-WRT on a Linksys router. It handles 20 users just fine, been using it for over a year, much more powerful than standard Linksys firmware.


1

If you actually read the URL in the error message it will explain why this happened and what your options are. The summary is that you have two options: Disable certificate verification, which means that cURL will not check that you're connecting to the right server and you may be subject to a MITM attack. That's probably okay in this case, so specify the ...


1

Instructions for setting up load balancing under dd-wrt are at: http://www.dd-wrt.com/wiki/index.php/Dual-WAN_for_simple_round-robin_load_equalization However load balancing is usually profoundly dissapointing.


1

If you don't need to apply any firewall rules for the second network, then you don't even need iptables, just a static route like.. ip route add 172.16.0.0/24 via 192.168.0.3 where 192.168.0.3 is the address assigned to the lan interface on the Mikrotik device. according to http://en.wikibooks.org/wiki/Tomato_(firmware)/Menu_Reference#Advanced there is ...


1

Firewalls control traffic that flow through them, so your internal LAN traffic should be unaffected as it doesn't or shouldn't flow through the firewall. Your inbound and outbound internet traffic is another matter though. does the Comcast router\modem support "bridging", or "passthrough" for all traffic, meaning can you turn off the firewall and NAT ...



Only top voted, non community-wiki answers of a minimum length are eligible