Reputation
3,139
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 20 41
Newest
 Yearling
Impact
~283k people reached

Jul
2
comment PHP-FPM on Linux, SCHED_BATCH or SCHED_OTHER?
ooh, thanks again!
Jul
2
comment PHP-FPM on Linux, SCHED_BATCH or SCHED_OTHER?
Ah, thank you! Now that's the definitive answer I've been searching for and failing to find! I'll leave them at SCHED_OTHER then :-)
Jul
2
comment How to get decent NFS performance for workloads like git?
@analytik magnetic drive. With SSD, I think fragmentation will never be a problem, and you can safely go with thin provisioned storage. Heck, even if there's a performance hit, considering that the $/GB of SSD is still waaay higher than magnetic drive's, I will go thin provisioned.
Jun
26
comment SaltStack: Requisite not found for watch
Ah, maybe you're right! But in any case, I've approached the problem differently now. Anyways, thanks for the insight!
Jun
26
comment SaltStack: Requisite not found for watch
Also didn't work if I use specific name. I've given up and modified the state completely.
Jun
17
comment Magento's cron.php: Persistent or not? Why putting it into cron?
Omigosh, apparently I accidentally added "-d" before cron.php ... no wonder it seems to be just stuck there --__-- ... thank you for the answer!
May
22
comment How do I MAC filter with DHCP server
@Sarim oh my, I forgot to add one very important line: iptables -t raw -N DHCP_clients -- this line creates the DHCP_clients chain. I'll edit.
Apr
24
comment iptables Tips & Tricks
@Matt no, because Path MTU discovery uses packets only as big as the Ethernet payload size, i.e., 1500 bytes, of which 8 bytes are used by the IP header and ICMP header.
Feb
11
comment How to share assets between multiple web servers?
Re: #3, the 'dead time' between new asset deployed and new asset synchronized can be minimized if you use a filesystem watcher (such as Facebook's watchman) and a fast sync tool (such as csync2). No, the delay will never go down to zero, but it's very minimal and might be easier to deploy than the other alternatives.
Jan
22
comment Iptables: Forwarding packets doesn't work
Can you post the output of iptables-save, ip addr sh, ip route sh from "B".
Jan
22
comment Forward http traffic to another ip address with iptables
Can you provide the output of: iptables-save, ip addr sh, ip route sh
Jan
22
comment iptables traffic after forwarding
Please provide the output of ip link sh, ip addr sh, ip rule sh, and ip route sh on "Server-A" and "Server-B"
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
Unless if what you're referring is changing its current function from a bridge into a router. Yes, there will be downtime, but not of the Linux box itself; rather, it was a downtime due to the need to change IP addresses of other connected devices. Anyways, if you can't even spare some time for that, there's a way to implement blocking. Let me check out my notes, and I'll get back to you.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
That's the first time ever I heard a Linux router needs to be rebooted to change the router's settings. The Linux router I had on a previous employer has been working nonstop for YEARS without needing a reboot. And through the years, it has seen countless configuration changes. Daily it updates itself to block access to dynamically-addressed sites, once even installing a compressed tunnel to optimize traffic to a subsidiary office, zero downtime.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
@AllanLewis, any reason to use the Linux box as a bridge instead of a gateway/router? It will be much simpler to configure.
Jan
14
comment How can I block all traffic to/from an bridged interface while allowing DHCP?
iptables can't block DHCP server generated on the same host, but if you've configured your Linux box to act as a router, it can block DHCP packets. That said, since your Linux box works as a Layer 2 device, ebtables is your friend. (iptables is for Layer 3 and higher).
Jan
9
comment Return traffic through same interface as entered
Can you post the output of ip link show and ip route show?
Jan
8
comment Pinging server replies back with incorrect IP address
"Eventually" the user will call back with the same problem. When the problem reappeared, did it happen in the morning as the user starts his workday, or any time of the day?
Jan
5
comment How to isolate servers from other machines connected to a single active directory?
IIRC, it's because with Windows' own firewall, deny rules always win against allow rules. So, it's impossible for me to block a subnet except some hosts within.
Jan
5
comment Why iptables state setting changes from 1.3.x to 1.4.x?
can you post the output of iptables-save prior to adding the statement with UNTRACKED?