Tag Info

Hot answers tagged

4

Vyatta supports VRRP, or Virtual Router Redundancy Protocol. This lets two Vyatta routers share a single IP address. To set it up, you assign a priority value to each router. Once enabled, the router with the highest priority claims the shared IP address. If that box drops offline, then the other router determines that it now has top priority, and takes ...


3

As far as I'm aware, there's no IPv6 support within PFSense. It was slated for "after" the 2.0 release, but I've been waiting for 2.0 to come out of beta for 18 months now, and I'm not holding my breath. You can track PFSense's progress on IPv6 integration here. It turns out there's a hacked workaround here (the one you referred to), but it's... less than ...


3

You are looking for the static mapping. This is part of your configuration, not part of a dynamically generated files. You can get it with : show service dhcp-server You can also see additional informations in ls /var/lib/dhcp3/*


3

Is there a way to assign the public elastic IP address directly to the eth0 interface? No, there is not. Internet traffic to/from EC2 instances always traverse the Elastic IP 1:1 NAT infrastructure. If not, does anyone know a work around to using Vyatta in a VPC configured with an ipsec VPN? I have all manner of IPsec operating in VPC ...


2

There is more than one type of broadcast. Layer 2 (network) broadcasts (traffic to the all-1's MAC address) are used by protocols like ARP to gather information on how to connect to a specific node when it already knows its higher-layer address (typically IP). Layer 3 (IP) broadcasts (traffic to the subnet's highest address) serve entirely different ...


2

What is happening with the squid config above is that it's trying to resolve public DNS via your internal server, then waiting for it to fail, then trying public DNS. I would suggest running a separate DNS proxy on the system and tell squid to use that. Something nice and easy like dnsmasq allows you to set different DNS servers for internal domains, but ...


2

The way that we were able to solve this was to change the NAT rule to an SNAT instead of a masquerade.


2

IPv6 is the thing that made me go from pfsense to vyatta. Tired of waiting for pfsense2.0+, tired of ugly hacks that breaks the system uniformity (no proper GUI, packages only working w/ ipv4...) As I'm more of a GNU/Linux guy, I feel a lot more comfortable with Vyatta, and its ipv6 support has proven to be very resilient.


1

It sounds like you've already done captures. If you've verified your address resolution requests are being sent, but you're not receiving replies, that sounds like either their router isn't responding or a layer 2 device in the path is dropping them - for whatever reason, be it bug or configuration. If they're willing to provide configurations, you might ...


1

I don't know why you'd want to do this in light of the fact that you're running SBS, which is intended to fill the DHCP/DNS roles, but if you must then make sure that the DNS server you choose is capable of hosting DNS zones and supports SRV DNS records (rather than being just a DNS resolver\forwarder such as a router or firewall would be). The DC must ...


1

Its working the way it should. Are you applying your firewall rules to zones or interfaces? If you are fconfiguring your rules against zones, you havae to make zone policies also. ie WAN-LOCAL,


1

They claim they can do whatever cisco does so ... http://www.vyatta.com/


1

You cannot achieve this with NAT as NAT operates at the network layer (layer 3), not DNS (layer 7) level. As a result, you example of set service nat rule 10 destination address ftp.myhost.com will not work. NAT allows your public IP address to be shared between multiple internal hosts that have difering services. For example, SSH, HTTP, HTTPS and SMTP, ...


1

The behavior makes sense the way its configured. What you are doing with the "other" firewall? This may be as easy as routing your traffic through the second firewall but it begs the question, "Why are there 2 firewalls?" As configured, any traffic originating from 10.10.0.1/24 will be translated to 1.1.1.1 on the other side. (Using Port Address Translation) ...


1

VRRP is the protocol designed for this purpose. Note that the same idea is called CARP in the BSD world (so you will only find CARP in pfSense).


1

There is a known bug (Bug 3877 - Cluster configuration does not load if cluster communication interface is down on boot) in the Vyatta software. If the cluster monitor link is not up at boot time (in your case eth5) it doesn't load the cluster info. If you look at the actual config.boot file, or issue a load command, you will see it. Hope this helps.


1

If you really want to have ipv6 support, use Monowall


1

As EEAA mentioned, you can't actually assign the elastic IP to an interface on your instance. That's not how EC2 publicly-routed IPs work. I'm not sure how much it will help you, but if you do want to know the IP programatically, you can query it from the metadata "API": curl -s http://169.254.169.254/latest/meta-data/public-ipv4 If an elastic IP is ...


1

You could use VLANs and set each host up in its own private (RFC 1918) /30 network, I assume the Vyatta can handle multiple NAT networks behind it. Then each machine will have to go through the router (probably the Vyatta) to talk with the outside world, and with any other machine. You will be able to easily set up firewall rules, and by itself, the machines ...


1

Lets assume You are advertising for example route 192.168.1.0/24 from R1. R1 needs to have this route installed in its routing table. So You need to have any of these for example: - an interface that is actually UP with IP from 192.168.1.0/24. If it is DOWN (no link) You will not get that route advertised via BGP. (Why advertise something if interface is ...


1

On most distro, unless they are set up to serve as routers, they will default to the behavior of refusing to forward IP traffic. Generally I use a packetprotector (linux running on asus home router) for such work. But you will want to check the settings in /etc/sysctl.conf. Look for 'net.ipv4.ip_forward = ', if you wish to forward traffic, this value should ...



Only top voted, non community-wiki answers of a minimum length are eligible