I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I have a problem I could not yet solve:

One of the interfaces contains a subnet (192.168.2.*) with devices that send out a UDP broadcast to discover another kind of devices. Those other devices are in another subnet in another interface (192.168.3.*). The udp broadcast is global (255.255.255.255) on a certain port.

I want the global UDP broadcast sent out in 192.168.2.* to also be sent to 192.168.3.* - and to allow the way back as well, of course.

On other Cisco devices, I already found out that one can do that with ip helper-address and ip forward-protocol commands - but the ASA models do not support those, as far as I can see.

So, how do I get the global UDP broadcast across the interfaces?

Summary

There is a virtualbox host (1.1.1.5) and a routed guest (1.1.1.6). Something redirects any traffic on port 25 with the guest, whether ingoing or outgoing, to 1.1.1.5 port 2525 and I cannot find out what.

The ips and macs are changed for this post, of course.

Setup

I have the following setup:

• there is a debian root server with IP 1.1.1.5, hosting a virtualbox server
• a second IP (1.1.1.6) is routed to this server
• this second IP is routed to a virtual network interface "virbr1" which is used by a debian virtualbox guest mailserver
• on the root server, iptables is running and configured with ufw

The setup works flawlessly - I can ping the mailserver on 1.1.1.6 and reach its web interface etc, the mailserver can reach the internet, everything is fine, EXCEPT that one port: trying to reach the mailserver on port 25 is not working.

This is not about an ISP blocking port 25 or something like that, its more complex. Read on :)

Diagnosis of the problem

Telnetting from external

When I try to telnet from another server:

telnet 1.1.1.6 25

the connection will timeout. In the syslog of the host system (1.1.1.5), the following message from ip tables appears:

[UFW BLOCK] IN=eth0 OUT= MAC=c8:c8:c8:c8:c8:c8:c8:fe:3d:46:e6:0f:08:00 SRC=2.2.2.5 DST=1.1.1.5 LEN=64 TOS=0x00 PREC=0x00 TTL=55 ID=45855 DF PROTO=TCP SPT=64059 DPT=2525 WINDOW=65535 RES=0x00 SYN URGP=0

There is one important thing to note here: I tried to connect to 1.1.1.6 on port 25, but the iptables block happens on 1.1.1.5 on port 2525

Telnetting from the guest box

When I SSH to the mailserver guest and then telnet another server:

telnet 9.9.9.5 25

the connection will timeout as well. Note that all other ports or connections work. In the log of the host system, the following wild messages appear:

[UFW BLOCK] IN=virbr1 OUT= MAC=aa:aa:ab:ac:ad:af:af:ag:ag SRC=1.1.1.6 DST=1.1.1.5 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=3529 DF PROTO=TCP SPT=45250 DPT=2525 WINDOW=14600 RES=0x00 SYN URGP=0

Important to note: the DST should rather be 9.9.9.5, but is the host servers IP. The DPT was expected to be 25, but is 2525.

Assumption

It looks like something on the host system 1.1.1.5 redirects any traffic on port 25 that passes through it to itself on port 2525.

Looking for the cause

I tried the following ways to find the cause for this behavior:

• netstat -lnp on the host shows nothing bound to port 25 or 2525
• the config files in /etc/ufw, especially before.rules, contain nothing about port 25 except the necessary -A ufw-before-forward -i eth0 -d 1.1.1.6 -p tcp --dport 25 -j ACCEPT
• using iptables -L -n | grep "25" shows only the rule mentioned above in the forward chain
• even on ufw logging high, the syslog contains nothing prior to to the block messages mentioned above that is related to the packets in question
• Disabling the firewall with ufw disable does not change the problem
• No config file mentions a 2525: egrep -R "2525" /etc returns nothing.

So now, I'm clueless. How should I diagnose that problem further? What might be the cause?

I am evaluating a system for a client where many OpenVPN clients connect to a OpenVPN server. "Many" means 50000 - 1000000.

Why do I do that? The clients are distributed embedded systems, each sitting behind the system owners dsl router. The server needs to be able to send commands to the clients. My first naive approach is to make the clients connect to the server via an openvpn network. This way, the secure communication tunnel can be used in both directions.

This means that all clients are always connected to the server. There are many clients summing up over the years.

The question is: does the OpenVPN server explode when reaching a certain number of clients? I am already aware of a maximum TCP connection number limit, therefore (and for other reasons) the VPN would have to use UDP transport.

OpenVPN gurus, what is your opinion?

We are a small web software company (~ 10 people). At present, every dev works on his local machine (some windows, some ubuntu) using a local apache. We have a samba share for shared files and central SVN repositories.

I would like to centralize our infrastructure in the future, making everybody work on a central server. There are 2 options:

• Virtualization: everybody gets an own virtual box on a central, fat server.
  Pro: quick setup, isolation of the users, new boxes added fast.
  Con: as every user has its own OS, a little hungry for hardware. Updating software (new Eclipse versions etc.) does not affect everybody unless they start to use a new vm, which leads to fragmentation or lost working time again. Potential security issues due to missing security updates and users using the box as root.
• Remote Desktop: everybody connects to a central ubuntu server, using a remote desktop from there. Options are a real X client, xrdp, VNC and the like.
  Pro: easy to use, central data storage, software updates effective immediately, central control easy. Does not need as much hardware. Users are not root. SVN repositories might be local, meaning speedup.
  Con: users are not isolated (potential security issues inside of the team), an apache restart etc. hits everybody.

Both solutions need a fast network and a fat server. At the moment, I would tend to use xrdp as remote desktop access. What experiences do you have? Any downsides to one approach over the other? Options I've missed? Is there anybody out here that successfully virtualised a software dev team?

On one of our debian squeeze servers, we use a setup of postfix + amavis + dovecot as mailserver. Spamassassin is part of amavis.

Once a day, the process "sa-learn" is started. It is part of spamassassin, training the bayesian filter for it. A good thing, but unfortunately, it exhausts the servers ressources dramatically - the load goes up from 0.5 to 12, the server becomes unresponsive. I have to kill the sa-learn process.

What can I do about it? Is there any chance to make sa-learn behave nice? If there isn't, where can I disable sa-learn? (I did not find any cron start script - the only reference to sa-learn I found is in /usr/sbin/amavisd-new-cronjob, which I commented out with no effect.