New answers tagged

1

Syntactically, this seems correct, but your approach is not suitable for this purpose. The string patch matches a string anywhere in the packet: You are dropping any packet that has watch or .watch anywhere. This is likely to cause false positives, and even introduces a new vector for denial of service attacks. It cannot handle encrypted traffic. It is ...


2

I think it would be sufficient to describe these metrics' origins based on native Linux API. Throughput By the way, the throughput metric in general is something, that is external in relation to the testing object (OS Linux you're talking about). I.e. roughly speaking we have two hosts (e.g. client and server) and testing object between them. We blow the ...


1

Incorrect syntax: # iptables -A INPUT -m set -–match-set cf src -p tcp -m multiport –dports http,https -j ACCEPT Correct syntax: # iptables -A INPUT -m set --match-set cf src -p tcp -m multiport --dports http,https -j ACCEPT At two places, one or two ‐ (hyphen: u002d) were replaced with a – (en dash: u2013). Be careful when using word processors not ...


1

How can I solve this? The user must use the destination server bandwidth instead the redirect server. Thank you. Generally there's a few ways: Use Round Robin DNS. All servers share the same name, but on different IP's. Clients will pick a random server. Use redirects to send the users to an appropriate server. Use Anycast. All servers have the same IP. ...


0

So after much head banging (not the kind you do to rock music) and gnashing of teeth, I figured it out from this answer: https://www.digitalocean.com/community/questions/site-to-site-vpn-support-any-updates Digital Ocean was dropping packets on private interfaces. So I added a firewall rule to allow traffic from 10.87.0.0/24 and wahlah! IT WERX!!!


1

If anyone is interested, I found trying to use a node port too difficult, and instead opted to just move transocks to its own pod and use host networking, along with the above forwarding rules to make this work. Here is the manifest I used for the transocks pod: { "apiVersion": "v1", "kind": "Pod", "metadata&...


0

If all your traffic is local traffic, so traffic originating from your computer, probably -i wlp3s0 is the culpit here. Your traffic most likely does not get routed via the wlp3s0 interface, but rather via the lo ("loopback") interface.


0

Okay, some basics first. The client opens a VPN connection to Server1. The server has an active connection to server2 and this connection is configured as default route (you did that, correct?) First of all, I would configure this tunnel between server1 and server2 as site-to-site VPN - but that is a different topic. At server1, your iptables rule is wrong. ...


0

Fixed the problem using this code, from: https://stackoverflow.com/a/65248666/3411911 export IF_INET=eth0 export LIMIT=300kbit tc qdisc add dev ${IF_INET} ingress tc filter add dev ${IF_INET} protocol ip ingress prio 2 u32 match ip dst 0.0.0.0/0 action police rate ${LIMIT} burst ${LIMIT} tc filter add dev ${IF_INET} protocol ip ingress prio 2 u32 match ip ...


0

After console reboot able to access the host machine. Thanks


0

As your diagram, your Rasperri Pi is both an L2TP server and an SSH proxy client. So the question lies on how to route all the outbound traffic into L2TP tunnel once established. It has nothing to do with your SSH proxy if you set it with masquerade option, meaning all the traffic from its clients would be masqueraded by the ip of Rasperri Pi itself, so that ...


0

By @TomYan Run ip r add 10.8.0.0/24 via 10.2.0.1 on the VM. For the VPN part, either add route 10.2.0.0 255.255.255.0 to the client conf, or, add push "route 10.2.0.0 255.255.255.0" to the server conf, assuming you are using client / pull on the client conf. Note that these route are not necessary if both the VM(s) and the VPN clients use the ...


0

The sar command that comes with sysstat will do both. To monitor connections per second sar -n TCP 1 active/s is the outbound TCP connections passive/s is the inbound TCP connections for UDP sar -n UDP 1 To look at network throughput sar -n DEV (optionally add a 1 to monitor current per/second)


1

When you run iptables -F, you are deleting every rule in every chain. However, each chain has a policy you are not deleting, which in your case is DROP for the INPUT chain. Therefore, you are deleting all rules and applying a DROP policy for any traffic not matching a rule, which means everything gets dropped. You can confirm this by running: iptables -L -n. ...


0

iptables -t nat -N dnsrewrite iptables -t nat -A dnsrewrite -j DNAT --to-destination 192.168.2.29 iptables -t nat -N whitelist iptables -t nat -A whitelist -s 192.168.2.1 -j RETURN iptables -t nat -A whitelist -s 192.168.2.29 -j RETURN iptables -t nat -A whitelist -d 1.1.1.1 -j RETURN iptables -t nat -A whitelist -j dnsrewrite iptables -t nat -A PREROUTING ...


0

I think you should be able to do this with policy routing. Set up the default route for a new routing table (123 for example) to use your WireGuard interface (wg_pub): ip route add default dev wg_pub table 123 And then add a policy rule to use that new table for all packets whose source is your Second VPS IP (say it's 192.0.2.2 for example): ip rule add ...


0

I found a research paper from the university of Poland that makes an analysis between hardware and software firewalls. I will add the conclusion for this paper, and highlight the most relevant parts in bold. It have been observed that the throughput of firewalls strongly depends on the size of packet transmitted over the network. Highest throughput, very ...


0

Let me answer my own question. Not sure why it works this way but it works. I simply allowed "password logins" and it all started working perfectly well. It connects using ssh keys anyway without any password prompts but.. nonetheless allowing password logins in ssh solved the issue (I had it turned off earlier). Hope it will help someone too.


0

Turns out doing DNAT like that for 127.0.0.1 appears to be infeasible (well, at least for the case of OUTPUT), probably due to the fact that 127.0.0.0/8 are of scope host or similar reasons. However, the following nftables ruleset should help you achieve what you want: table ip rewrite { chain unloop { type route hook output priority ...


0

In addition to the other answers, I have made some other experiments. Please note that the following are only my conclusions, I didn't search inside the kernel source (but if you have documentation, please share). Indeed, it seems that the lo interface and 127.0.0.1 follow their own rules. For the other interfaces, here is how I believe the source IP is ...


1

I don't know if it is a bug or an intentional fallback behavior, but from I what can see here, it has neither anything to do with the wlan0 local route you mentioned, or all the default gateway blah blah (no offense but it almost makes no sense to me) stated in the other/"correct" answer. Normally how MASQUERADE works is, it picks the address that ...


1

This is an educated guess. The MASQUERADE option replaces the source IP address in IP packets with the address it decides to use. I think in this case, it replaces the source address with the interface address where default gateway is reachable. So, if your default gateway is 192.168.0.1, the source address of the packet is replaced with 192.168.0.1. The ...


0

The MASQUERADE rule you specified is too broad. You have specified to masquerade all traffic leaving this host via any interface, thus all traffic gets NATted and its source address rewritten, even though it is unnecessary and in this case undesirable. (And for some reason the rule is there three times.) Masquerading should be applied only to traffic leaving ...


1

Thanks a lot @michael-hampton for comments. Short answers to my own questions: This approach works perfectly Issue on ruby side HTTP_PROXY accepts only HTTP[S] proxies (it doesn't handle SOCKS proxy as curl does) Probably iptable the simplest one More details related to programming: My software use git gem which doesn't handle HTTP_PROXY and any proxy ...


1

Yeah, it makes no sense. IPTABLES also errors when I attempt to issue this on the command line (tested on CentoOS 8). It can only work if -p tcp is given which specifies that the rule is dealing with TCP traffic. Then it will work.


0

Thanks to @MichaelHampton I found the issue. A few months ago, I added a backup WAN to my firewall and used it to move around my network connection equipment and when I finished, I did not remove the backup cable to my modem. When the firewall came up and got IP addresses, the backup had the primary IP and the primary got the secondary. I removed the cable ...


2

This may be an old one but there's no answers and 2k views. The reason why netsh interface portproxy add v4tov4 listenaddress=65.55.44.109 listenport=80 connectaddress=127.0.0.1 connectport=80 doesn't work is because you don't actually have an interface 65.55.44.109. But you can add it, as long as you're happy for all your traffic to go to it regardless of ...


1

So I've found a solution for my problem, should anyone be in need and stumble upon this: I ditched iptables and went for ufw. /etc/sysctl.conf: net.ipv4.ip_forward=1 /etc/default/ufw: DEFAULT_FORWARD_POLICY="DROP" /etc/ufw/before.rules: # START OPENVPN RULES # NAT table rules *nat :POSTROUTING ACCEPT [0:0] # Allow traffic between OpenVPN and LAN -...


0

Finally, I came to the conclusion that this is impossible to do. I've tried with iptables until I realized that iptables only reject and accept packets, but do not route, what I was needing was more about routing. I've looked into bridges but it seems to be more about sharing the internet from the computer again. Then I looked into routing tables for Linux, ...


0

This will allow you to stop communications between containers: Create a network with ICC disabled: docker network create -o com.docker.network.bridge.enable_icc=false my_secure_bridge Test with creating two containers: docker run --name cnt1 --network=my_secure_bridge -it --rm -d alpine docker run --name cnt2 --network=my_secure_bridge -it --rm -d alpine ...


Top 50 recent answers are included