ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Setup: Ubuntu 20.04 on a box with 5 physical ethernet ports (let's call them eth1 - eth5). I have joined them all to a bridge ("br0") with brctl and they can all ping each other. What I'm trying to do: allow eth2 - eth5 to all continue chatting freely with each other while limiting what can come in via eth1. (Ultimately eth1 will be the "outside connection"
With IPv4, you used to be able to give a host a static local IP address on the LAN, and use a firewall rule on the firewall/router to forward a port on the (possibly dynamic) Internet-facing IP used by the network to a port on tat particular host, using the host's static LAN IPv4 address as a stable way to identify the host in the firewall rule. But with IPv
iptables (and/or the successor tool nftables ) is the user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, which is implemented as different Netfilter modules. (summary from Wikipedia ) Since iptables and nftables are a user-space utility programs intended to be used by people, by
I am trying to configure wireguard to work as a VPN server. The main problem is, that the gateway only forwards the VPN server ip to other server, not my client IP. My setup is the following: - server A (10.10.0.4) / CLIENT (10.10.1.3) -> wireguard server (10.10.1.2) -- (10.10.0.2) \ - server B (10.10.0.3) The wireguard server runs on a machine with two i
I am attempting a chained/double-hop VPN setup where all client traffic passes through 2 servers before reaching the internet: Client → Server1 → Server2 → Public Internet All peers are on these private address blocks: 10.103.213.0/24 (IPv4) and fd6f:9403:2887:9cd6:10:103:213:0/112 (IPv6). Below are the configurations of the peers and the IPTables rules in p
For some reason I have no such file on my server.. root@serv:~# uname -a Linux serv 5.4.0-87-generic #98~18.04.1-Ubuntu SMP Wed Sep 22 10:45:04 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux root@serv:~# cat /proc/net/stat/nf_conntrack cat: /proc/net/stat/nf_conntrack: No such file or directory But my conntrack is definitely enabled: root@serv:~# lsmod | grep connt
I have an issue with IPv6 on my server. I have nginx configured to listen on port 443 from IPv4 and IPv6. And it works great: my webiste is available form Internet with TLS enabled. Things get complicated when I activate nftables: when I am accessing my website from IPv4 it works, but when I access it from IPv6 connections time out :( Output of sudo nft list
I want to analyze my Debian 9 server's network workload to detect some possible network overloads. The main metrics I need to analyze are: CPS (connections per second) Throughput Is there a way to obtain these metrics from within Linux? I thought that CPS metric could be somehow obtained through conntrack NEW connections events but not sure that this would b
Here I faced with a bit strange rule: iptables -A INPUT -s 10.26.95.20 -j REJECT --reject-with tcp-reset This rule matches all the protocols from specific network and rejects it with TCP RST packet. How is this supposed to work with non-TCP packets? If other end (10.26.95.20) sends UDP packet it then receives TCP RST? This looks extremely strange..