Reputation
3,010
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 18 40
Impact
~239k people reached

1d
comment iptables Tips & Tricks
@Matt no, because Path MTU discovery uses packets only as big as the Ethernet payload size, i.e., 1500 bytes, of which 8 bytes are used by the IP header and ICMP header.
Apr
21
awarded  Notable Question
Apr
8
awarded  Popular Question
Mar
20
awarded  Nice Answer
Feb
11
comment How to share assets between multiple web servers?
Re: #3, the 'dead time' between new asset deployed and new asset synchronized can be minimized if you use a filesystem watcher (such as Facebook's watchman) and a fast sync tool (such as csync2). No, the delay will never go down to zero, but it's very minimal and might be easier to deploy than the other alternatives.
Jan
22
comment Iptables: Forwarding packets doesn't work
Can you post the output of iptables-save, ip addr sh, ip route sh from "B".
Jan
22
comment Forward http traffic to another ip address with iptables
Can you provide the output of: iptables-save, ip addr sh, ip route sh
Jan
22
comment iptables traffic after forwarding
Please provide the output of ip link sh, ip addr sh, ip rule sh, and ip route sh on "Server-A" and "Server-B"
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
Unless if what you're referring is changing its current function from a bridge into a router. Yes, there will be downtime, but not of the Linux box itself; rather, it was a downtime due to the need to change IP addresses of other connected devices. Anyways, if you can't even spare some time for that, there's a way to implement blocking. Let me check out my notes, and I'll get back to you.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
That's the first time ever I heard a Linux router needs to be rebooted to change the router's settings. The Linux router I had on a previous employer has been working nonstop for YEARS without needing a reboot. And through the years, it has seen countless configuration changes. Daily it updates itself to block access to dynamically-addressed sites, once even installing a compressed tunnel to optimize traffic to a subsidiary office, zero downtime.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
@AllanLewis, any reason to use the Linux box as a bridge instead of a gateway/router? It will be much simpler to configure.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
iptables can't block DHCP server generated on the same host, but if you've configured your Linux box to act as a router, it can block DHCP packets. That said, since your Linux box works as a Layer 2 device, ebtables is your friend. (iptables is for Layer 3 and higher).
Jan
12
awarded  Nice Answer
Jan
12
answered Cannot map drive letter to redirected folder when using Microsoft Remote Desktop
Jan
11
revised iptables wiki description
some of us prefer working with `iptables-save` output, which more explicitly lists the relation between chains
Jan
11
suggested approved edit on iptables tag wiki
Jan
9
answered iptables only blocks OpenVPN on server startup
Jan
9
comment Return traffic through same interface as entered
Can you post the output of ip link show and ip route show?
Jan
8
comment Pinging server replies back with incorrect IP address
"Eventually" the user will call back with the same problem. When the problem reappeared, did it happen in the morning as the user starts his workday, or any time of the day?
Jan
5
comment How to isolate servers from other machines connected to a single active directory?
IIRC, it's because with Windows' own firewall, deny rules always win against allow rules. So, it's impossible for me to block a subnet except some hosts within.