Questions[address](server)

I have a Centos 5 box with a sub interface:

ifconfig eth0 10.1.1.1 255.255.255.255
ifconfig eth0:1 10.1.1.2 255.255.255.255

The netmasks need to be 32bit in the environment this server is in. So in order to specify the default route, we let the server know where the gateway is, and then default route to it:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.1.1.10       0.0.0.0         255.255.255.255 UH        0 0          0 eth0
0.0.0.0         10.1.1.10    0.0.0.0         UG        0 0          0 eth0

So 10.1.1.10 is the default gateway, and it is out interface eth0

However, all packets that leave the server have the IP address associated with eth0:1. They need to have the IP on eth0.

The routing is defined in route-eth0:

10.1.1.10/32 dev eth0
default via 10.1.1.10

And I have tried to force the issue with GATEWAY and SRCADDR in ifcfg-eth0:

DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
IPADDR=10.1.1.1
SRCADDR=10.1.1.1    
NETMASK=255.255.255.255
GATEWAY=10.1.1.10

No gateway is defined in ifcfg-eth0:1:

DEVICE=eth0:1
IPADDR=10.1.1.2
NETMASK=

The eth0 IP address is the one used for the fqdn in /etc/hosts. If I ping the fqdn, I get the eth0 IP address.

Could some let me know how I can force outgoing packets to use the IP bound to eth0 rather than the IP bound to eth0:1 as the source IP.

My hosting provider has supplied me with global static IPv6 for my machine. It appears that auto configuration has been successful and I can successfully ping my machine and tracepath6 appears to function correctly. I am running a 64bit Arch Linux distro.

However I am unable to ping any ipv6 device from the machine and all traceroutes fail at the auto configured link local router address.

How would you further troubleshoot this issue?

I have a dedicated server (which I only use a lab/testing environment). On the server CentOS 5.6 is running and it is functioning as a KVM host.

To secure things a little I want to do the following use 'iptables' to only allow traffic from certain IP addresses (my own addresses).

My current iptables configuration is looking as following:

[kvm]# iptables -L -v
Chain INPUT (policy ACCEPT 4927K packets, 6424M bytes)
 pkts bytes target     prot opt in     out     source               destination         
   41  2744 ACCEPT     udp  --  virbr0 any     anywhere             anywhere            udp dpt:domain 
    0     0 ACCEPT     tcp  --  virbr0 any     anywhere             anywhere            tcp dpt:domain 
   66 21810 ACCEPT     udp  --  virbr0 any     anywhere             anywhere            udp dpt:bootps 
    0     0 ACCEPT     tcp  --  virbr0 any     anywhere             anywhere            tcp dpt:bootps 
3573K 3515M fail2ban-SSH  tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 470K  700M ACCEPT     all  --  any    virbr0  anywhere             192.168.122.0/24    state RELATED,ESTABLISHED 
 171K 9558K ACCEPT     all  --  virbr0 any     192.168.122.0/24     anywhere            
    0     0 ACCEPT     all  --  virbr0 virbr0  anywhere             anywhere            
    0     0 REJECT     all  --  any    virbr0  anywhere             anywhere            reject-with icmp-port-unreachable 
    0     0 REJECT     all  --  virbr0 any     anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT 3115K packets, 5798M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain fail2ban-SSH (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  any    any     somehost1.net        anywhere            
   19  2176 DROP       all  --  any    any     somehost2.net        anywhere            
   21  1668 DROP       all  --  any    any     somehost3.net        anywhere            
3573K 3515M RETURN     all  --  any    any     anywhere             anywhere

I did not make any changes myself to the iptables configuration although I think that KVM (virt-manager or the like) and fail2ban that made some changes to it.

Could somebody help me to create the iptables script that ensures that KVM is still working but only traffic from certain IP address is allowed. ALL the rest can be dropped. There should not be any restriction from the server itself to the Internet.

Update: as requested output above is now with -v.

I have a web site that uses a couple hundred domain aliases, including franchise-dallas.info, franchise-delaware.info, and detroitfranchise.info (see more below).

I have been getting ten to twenty hits per day via Google AdWords PPC. I set up a log file so that I could see the variables in the URL.

I was surprised to see that the page is getting hit about once per minute. I looked up the IPs and they are all in China.

My site has ZERO content that would be of use to anyone outside the U.S.A.

Can you tell me why my site would be getting this type of hit? Is this normal? Is this a bot?

TIME, IP, DOMAIN, PAGE
20:9, 66.249.71.138, franchise-st-petersburg.info, Why-Buy-a-Franchise
20:13, 66.249.71.21, franchise-ok.info, Frequently-Asked-Questions-About-Franchises
20:16, 66.249.71.44, franchise-dallas.info, Frequently-Asked-Questions-About-Franchises
20:20, 66.249.71.36, franchise-delaware.info, Frequently-Asked-Questions-About-Franchises
20:21, 66.249.71.136, detroitfranchise.info, What-We-Do-Free-Franchise-Advice
20:21, 66.249.71.10, philadelphiafranchise.info, Privacy-Policy
20:21, 66.249.71.144, denverfranchise.info, Franchise-Terminology
20:22, 66.249.71.59, franchise-tx.info, Get-Started-Ask-a-Franchise-Expert
20:24, 67.195.114.240, franchise-ky.info, Franchise-Terminology
20:27, 66.249.71.138, franchise-st-petersburg.info, Why-Buy-a-Franchise

In my network I run dhcpd3 set up to assign IP addresses only to specific MAC addresses. It works wonderfully, I even integrated it with bind9 to automatically create direct and reverse DNS hostnames with a custom TLD and all.

But one thing I haven't figured out yet: if the user sets up a static IP on his machine he will have access to the network. Using iptables to filter IP addresses not in the range assigned by dhcpd3 also doesn't help much, because if the user with the IP address 192.168.0.20 is not on the office, that IP address would be still on the allowed list. And when he plugs his computer, we would have a lot of trouble with duplicated addresses and such.

A solution where dhcpd3 (or some other DHCP server) runs an external script that calls iptables to unblock the address would be very nice, but I were unable to find a DHCP server that does that.

I considered using 802.1X with RADIUS, but I have some printers and IP phones on the network that doesn't support it, so I would need to tell the switches that some ports wouldn't use 802.1X. That opens a hole where they could add small 8-port switches to the network and plug their machines there. Also, the IP phones have an embedded 2-port switch.

I know there's something called RADA where you allow specific MAC addresses to circunvent the RADIUS authentication, but my switches doesn't support it unfortunely.

I'm really out of ideas on this one. Maybe there's a very simple and elegant solution but I really couldn't find out by myself.