3,000 reputation
11739
bio website pandu.poluan.info
location Jakarta, Indonesia
age 38
visits member for 5 years, 8 months
seen Mar 26 at 5:10

I call myself an IT Optimizer, always looking for ways to optimally use whatever IT Infrastructure I have available.

Currently, I work as the IT Infrastructure Manager of Sophie Paris; I manage a department that's responsible for all production-level infra, including networks, storage, and servers.

Previously, I've worked as:

  • System Administrators Manager of PT Carrefour Indonesia, Indonesia's largest hyper-retailer. Here I oversaw the management of Windows- and Linux-based infrastructure throughout the country.

  • IT Manager of Infrastructure at PT Panin Sekuritas Tbk, one of Indonesia's leading securities companies. Here I design, deploy, and maintain 'next-generation IT Infrastructure' (secure, highly-available, and performant).

  • Senior instructor for the CCNA, CCNP, MCSE, and CEH certifications.

If you want to communicate with me, feel free to circle me on Google+. I'm quite active there.


Feb
11
comment How to share assets between multiple web servers?
Re: #3, the 'dead time' between new asset deployed and new asset synchronized can be minimized if you use a filesystem watcher (such as Facebook's watchman) and a fast sync tool (such as csync2). No, the delay will never go down to zero, but it's very minimal and might be easier to deploy than the other alternatives.
Jan
22
comment Iptables: Forwarding packets doesn't work
Can you post the output of iptables-save, ip addr sh, ip route sh from "B".
Jan
22
comment Forward http traffic to another ip address with iptables
Can you provide the output of: iptables-save, ip addr sh, ip route sh
Jan
22
comment iptables traffic after forwarding
Please provide the output of ip link sh, ip addr sh, ip rule sh, and ip route sh on "Server-A" and "Server-B"
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
Unless if what you're referring is changing its current function from a bridge into a router. Yes, there will be downtime, but not of the Linux box itself; rather, it was a downtime due to the need to change IP addresses of other connected devices. Anyways, if you can't even spare some time for that, there's a way to implement blocking. Let me check out my notes, and I'll get back to you.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
That's the first time ever I heard a Linux router needs to be rebooted to change the router's settings. The Linux router I had on a previous employer has been working nonstop for YEARS without needing a reboot. And through the years, it has seen countless configuration changes. Daily it updates itself to block access to dynamically-addressed sites, once even installing a compressed tunnel to optimize traffic to a subsidiary office, zero downtime.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
@AllanLewis, any reason to use the Linux box as a bridge instead of a gateway/router? It will be much simpler to configure.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
iptables can't block DHCP server generated on the same host, but if you've configured your Linux box to act as a router, it can block DHCP packets. That said, since your Linux box works as a Layer 2 device, ebtables is your friend. (iptables is for Layer 3 and higher).
Jan
9
comment Return traffic through same interface as entered
Can you post the output of ip link show and ip route show?
Jan
8
comment Pinging server replies back with incorrect IP address
"Eventually" the user will call back with the same problem. When the problem reappeared, did it happen in the morning as the user starts his workday, or any time of the day?
Jan
5
comment How to isolate servers from other machines connected to a single active directory?
IIRC, it's because with Windows' own firewall, deny rules always win against allow rules. So, it's impossible for me to block a subnet except some hosts within.
Jan
5
comment Why iptables state setting changes from 1.3.x to 1.4.x?
can you post the output of iptables-save prior to adding the statement with UNTRACKED?
Jan
2
comment A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?
Try implementing the rules, then edit your question by pasting the output of the iptables-save command.
Jan
2
comment Filter mirrored port traffic using iptables
Have you configured eth0 to operate in promiscuous mode?
Jan
2
comment iptables: service per physical interface
This doesn't sound like an iptables problem for me. It sounds more like a 'service configuration' issue. Are the physical devices located on the same subnet, or are they attached to different subnets?
Dec
31
comment iptables starts dropping packets; temporarily fixed by doing restart; only from home
PS: Please post the result of iptables-save when you can't access the services on your server.
Dec
31
comment iptables starts dropping packets; temporarily fixed by doing restart; only from home
@elagil So, from home, you can't access the SSH port. Can you access the other ports when you can't do SSH? And, after 'restarting' iptables, you can access SSH again?
Dec
22
comment linux not replying to an arp request
Are the two interfaces connected to the same VLAN?
Dec
18
comment HAProxy graceful reload with zero packet loss
@DmitriDB you're supposed to replace $PORT with the actual port haproxy is listening on. If haproxy is listening on multiple ports, write replace --dport $PORT with --dports $PORTS_SEPARATED_BY_COMMAS, e.g., --dports 80,443.
Dec
17
comment When iptables is started, there is no ftp access because of timeout
When you changed the configuration the first time (i.e., --sport 21 to --dport 21), did you remember to reload the iptables rules?