35,350 reputation
45497
bio website teaparty.net
location Cambridge, United Kingdom
age 47
visits member for 3 years, 9 months
seen 12 mins ago

What's to say? Check my personal website for a touch more detail, if you want to. I've been a professional UNIX/network sysadmin since 1991, and currently sysadmin free software professionally through my own little company. A long time ago, I and a co-author wrote "Building Linux and OpenBSD Firewalls" (Wiley, 2000). That's it.


32m
comment EdgeRouter - signals blocked like ports not forwarded (but they are)
No, hairpin NAT is what often stops you from testing port-forwarding from inside your network. Click on the link to read our canonical answer on the subject.
34m
revised Vmware/Linux 64 vs 32 bit
deleted 31 characters in body
1h
comment Loopback to forwarded Public IP address from local network - Hairpin NAT
I'm assuing you're referring to the last case, "proper hairpin NAT". The crucial thing is to rewrite the source address on the inbound packet in such a way that it goes back to the router, which can then reverse both the DNAT and the SNAT and thus avoid the problem. Which of its many address the router uses to do this is more a point of taste, and if you're doing this with iptables, is certainly something you can configure if you so choose.
1h
revised EdgeRouter - signals blocked like ports not forwarded (but they are)
edited title
1h
comment blocking udp attack ip with iptables
The more I read this, the less I can agree with most of it. I don't know how people get the idea that iptables is a big resource problem, but I have boxes filtering at 100Mb wireline speeds, with moderately complex rulesets (60-100 rules), which have consistent load averages of about 0.05. The netfilter code is pretty heavily optimised, too, and easier to keep updated. Plus, if you put a router device in front of your server, you still have to carry the traffic on your line, but you can no longer see or manage it at your server.
2h
comment df showing 28G of total space, du showing size of '/' as 400+ G
The very first line of df output makes it pretty clear that sda1 is indeed /, and not /boot, so most of this answer is not relevant.
11h
comment email sent from my server shows up as spam
possible duplicate of How to send emails and avoid them being classified as spam
13h
comment blocking udp attack ip with iptables
You can't; you have no control over what's sent to you, only over what you take notice of. Your ISP can probably block it upstream from you, but they'll need a good reason to do so.
14h
answered blocking udp attack ip with iptables
14h
revised blocking udp attack ip with iptables
added 10 characters in body
16h
comment Inctercept and digitally sign packets data using Squid proxy server
IPSec AH is what you want.
18h
reviewed Edit suggested edit on postfix unable to receive external emails
18h
revised postfix unable to receive external emails
Modified some sentences which were in code.
20h
comment How do I determine where an SSL certificate is being served from?
And what do you get from the server when you do echo ""|openssl s_client -connect 127.0.0.1:9443 |openssl x509 -text -noout|&grep depth=0? The problem with using browsers to check certificates is that browsers do things other than build SSL connections, such as requesting content which can include redirection instructions, and following them if it does. It's much better to use an SSL tool to check SSL.
21h
comment How do I determine where an SSL certificate is being served from?
There is no way that I know of to do what you want. As far as a client is concerned, the SSL handshake is with the IP address that it thinks it's talking to. Since you haven't told us any of the domain names or IP addresses involved, it's hard to add anything more. But you might get some mileage out of using tcpdump on the server to show that an SSL handshake that produces the wrong certificate is not actually coming all the way through to your server.
21h
comment How do I determine where an SSL certificate is being served from?
I thought you wanted to prove that your machines were serving the right one? You asked for help "proving to my ISP that the issue is not on my server", and that lets you do that.
22h
comment How do I determine where an SSL certificate is being served from?
Try openssl s_client -connect server:port, then feed the certificate to openssl x509 -text -noout.
23h
answered For IPv6 migration, should we replace existing L2 switches running VLANs?
1d
revised Can I use --duplicate-cn option for a specific VPN account instead of using at server level?
deleted 75 characters in body
1d
comment Access to multiple FTP servers through a firewall
In my experience, those INPUT rules will need to be FORWARD rules, but apart from that I agree with you; +1 from me.