Hot answers tagged

8

[...] I didn't enable ssh on that virtual machine. I want to connect to that machine without enabling the ssh and execute some shell commands using power shell. Your desire to connect remotely with a shell is completely at odds with your desire to disable remote services that offer a shell. One way or another you have to enable a transport to carry ...


4

You are looking for the static mapping. This is part of your configuration, not part of a dynamically generated files. You can get it with : show service dhcp-server You can also see additional informations in ls /var/lib/dhcp3/*


4

Vyatta supports VRRP, or Virtual Router Redundancy Protocol. This lets two Vyatta routers share a single IP address. To set it up, you assign a priority value to each router. Once enabled, the router with the highest priority claims the shared IP address. If that box drops offline, then the other router determines that it now has top priority, and takes ...


4

Is there a way to assign the public elastic IP address directly to the eth0 interface? No, there is not. Internet traffic to/from EC2 instances always traverse the Elastic IP 1:1 NAT infrastructure. If not, does anyone know a work around to using Vyatta in a VPC configured with an ipsec VPN? I have all manner of IPsec operating in VPC (including ...


3

As far as I'm aware, there's no IPv6 support within PFSense. It was slated for "after" the 2.0 release, but I've been waiting for 2.0 to come out of beta for 18 months now, and I'm not holding my breath. You can track PFSense's progress on IPv6 integration here. It turns out there's a hacked workaround here (the one you referred to), but it's... less than ...


2

The way that we were able to solve this was to change the NAT rule to an SNAT instead of a masquerade.


2

IPv6 is the thing that made me go from pfsense to vyatta. Tired of waiting for pfsense2.0+, tired of ugly hacks that breaks the system uniformity (no proper GUI, packages only working w/ ipv4...) As I'm more of a GNU/Linux guy, I feel a lot more comfortable with Vyatta, and its ipv6 support has proven to be very resilient.


2

There is more than one type of broadcast. Layer 2 (network) broadcasts (traffic to the all-1's MAC address) are used by protocols like ARP to gather information on how to connect to a specific node when it already knows its higher-layer address (typically IP). Layer 3 (IP) broadcasts (traffic to the subnet's highest address) serve entirely different ...


2

What is happening with the squid config above is that it's trying to resolve public DNS via your internal server, then waiting for it to fail, then trying public DNS. I would suggest running a separate DNS proxy on the system and tell squid to use that. Something nice and easy like dnsmasq allows you to set different DNS servers for internal domains, but ...


2

As EEAA mentioned, you can't actually assign the elastic IP to an interface on your instance. That's not how EC2 publicly-routed IPs work. I'm not sure how much it will help you, but if you do want to know the IP programatically, you can query it from the metadata "API": curl -s http://169.254.169.254/latest/meta-data/public-ipv4 If an elastic IP is ...


2

There are two options. 1) Netflow as suggested by Teftin or 2) Analyze the traffic stream To implement option #2, you need either: a. Network tap - more hardware but no performance impact to router. Some taps will provide two traffic streams (think ethernet TX pin in each direction). The two streams need to be bonded in the analysis device. b. Mirror (...


2

It sounds like you want console access to Vyatta without opening the ports necessary. If that's the real requirement, I think you should configure one of the virtual COM ports for the VM as a console. You'll need to configure this according to Vyatta's instructions. I'm not familiar with Vyatta, but I've done this with Ubuntu many times, as described here:...


2

The "filtered" state is just what it sounds like. As you noted, nmap sent a SYN but got no response. Since nmap apparently didn't receive an ICMP error (e.g. "no route to host"), it assumes the probe should have made it to its destination, but was dropped somewhere along the way. Of course, ICMP could have been filtered on its way back to nmap, which is why ...


1

Based on further clarification from the below comment(s), my suggestion would be to set up a DNS server at your primary location as well, configure it to use your upstream public/ISP DNS server for its resolution, and configure conditional forwarding for your secondary locations domain to use the secondary location's DNS server. If your secondary location ...


1

Realize this was asked about a year ago, but Ubiquiti added DPI (deep packet inspection) to the EdgeRouter line of products recently (for free) in the firmware v1.7.0 release. Firmware v.1.8 (currently in beta) will offer DPI for all traffic, where v1.7 only handled traffic that was hardware offloaded. Setting can be enabled fully and does application layer ...


1

In general, usual way of achieving this kind of monitoring is using netflow. This will require: netflow collector running on separate server (for instance ntopng + nprobe) router has to be configured to export the flow information


1

Common issue, make sure that you Disable Source/Destination Check on the instance ( right click -> Networking -> Change Source Dest. Check ) You'll only need to do this on the Vyos box. You also don't really need a second interface. You could create a second subnet and on that route table for that subnet make the 0/0 route point to the Vyos instance if ...


1

(Assuming that Vyatta supports BGP...) Why don't you use iBGP among Edge1, Edge2, Edge3 and Core routers instead of redistributing BGP to OSFP? Redistributiong full bgp routes to OSPF is highly discouraged because OSPF is not designed to handle such a large amount of routes. If you use iBGP for distributing routes from your ISPs, then use local-preference ...


1

Lets assume You are advertising for example route 192.168.1.0/24 from R1. R1 needs to have this route installed in its routing table. So You need to have any of these for example: - an interface that is actually UP with IP from 192.168.1.0/24. If it is DOWN (no link) You will not get that route advertised via BGP. (Why advertise something if interface is ...


1

You could use VLANs and set each host up in its own private (RFC 1918) /30 network, I assume the Vyatta can handle multiple NAT networks behind it. Then each machine will have to go through the router (probably the Vyatta) to talk with the outside world, and with any other machine. You will be able to easily set up firewall rules, and by itself, the machines ...


1

There is a known bug (Bug 3877 - Cluster configuration does not load if cluster communication interface is down on boot) in the Vyatta software. If the cluster monitor link is not up at boot time (in your case eth5) it doesn't load the cluster info. If you look at the actual config.boot file, or issue a load command, you will see it. Hope this helps.


1

Vyatta has removed IPS from 6.4, and rule updates stopped working for ALL versions of IPS on March 31st. This is detailed in their Version 6.4 FAQ http://www.vyatta.com/files/pdfs/Vyatta_6_4_FAQ_Final.pdf While ThreatSTOP does not do the signature based profiling that SNORT does, it does block many of the same attacks, more efficiently than a signature ...


1

Its working the way it should. Are you applying your firewall rules to zones or interfaces? If you are fconfiguring your rules against zones, you havae to make zone policies also. ie WAN-LOCAL,


1

I don't know why you'd want to do this in light of the fact that you're running SBS, which is intended to fill the DHCP/DNS roles, but if you must then make sure that the DNS server you choose is capable of hosting DNS zones and supports SRV DNS records (rather than being just a DNS resolver\forwarder such as a router or firewall would be). The DC must ...


1

It sounds like you've already done captures. If you've verified your address resolution requests are being sent, but you're not receiving replies, that sounds like either their router isn't responding or a layer 2 device in the path is dropping them - for whatever reason, be it bug or configuration. If they're willing to provide configurations, you might ...


1

If you really want to have ipv6 support, use Monowall


1

On most distro, unless they are set up to serve as routers, they will default to the behavior of refusing to forward IP traffic. Generally I use a packetprotector (linux running on asus home router) for such work. But you will want to check the settings in /etc/sysctl.conf. Look for 'net.ipv4.ip_forward = ', if you wish to forward traffic, this value should ...


1

VRRP is the protocol designed for this purpose. Note that the same idea is called CARP in the BSD world (so you will only find CARP in pfSense).


1

The behavior makes sense the way its configured. What you are doing with the "other" firewall? This may be as easy as routing your traffic through the second firewall but it begs the question, "Why are there 2 firewalls?" As configured, any traffic originating from 10.10.0.1/24 will be translated to 1.1.1.1 on the other side. (Using Port Address Translation) ...


1

You cannot achieve this with NAT as NAT operates at the network layer (layer 3), not DNS (layer 7) level. As a result, you example of set service nat rule 10 destination address ftp.myhost.com will not work. NAT allows your public IP address to be shared between multiple internal hosts that have difering services. For example, SSH, HTTP, HTTPS and SMTP, ...



Only top voted, non community-wiki answers of a minimum length are eligible