I am trying to route packets (actually, trying to change DEFAULT GATEWAY) depending on source IP address with PFSENSE.
ONE-SPECIFIC-IP ---> SPECIAL GATEWAY
ANY-IP ---> DEFAULT GATEWAY
I guess this can be done with some similar to CISCO's PBR (policy based routing). But I need to do it with PFSENSE.
Is it possible? What's the option I should be looking into to do this?
I have the following scenario:
NGINX | | JavaEE
TERMINATING | -> REVERSE PROXY -> | Application
SSL (443) | HTTP | Server
Reverse proxy is done by:
location /app/ {
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Host www.example.com;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header REMOTE_ADDR $remote_addr;
proxy_pass http://192.168.0.10:8080/app/;
}
The problem was that, all relative redirects done at application server (i.e. Location: /app/login) where being redirected to http://www.example.com/app/login instead of its https counterpart https://www.example.com/app/login.
So, to fix it, I added this to NGINX's location configuration:
proxy_redirect http://www.example.com/ https://www.example.com/;
And it started working without issues.
My question is: is it good practice to have such a redirect? Is there another way of doing this?
I have the following config:
LAN 01: 192.168.16.0/24 (LAN for internal servers)
LAN 02: 192.168.67.0/24 (LAN for workstations)
WAN: X.X.X.X
And then:
PFSENSE LAN IP: 192.168.16.1
PFSENSE LAN IP: 192.168.67.1 (it's a virtual IP)
LAN 01 and LAN 02 are physically connected (i.e. in the same switch. I know I should use separate LANs or at least VLANs on them, but I can not easily change this configuration for now).
I have a PFSENSE installation (2.2) working where computers in LAN 02 get their IP addresses from a DHCP SERVER and use PFSENSE as default gateway.
Here's my problem:
If I sit on a computer residing on LAN 02 and I ssh (or any other persistent protocol for that matter) onto a server residing on LAN 01 like this:
$ ssh -l myself 192.168.16.25
I connect without issues. The connection lasts for something in between 20 and 30 seconds, and then it consistently gets dropped.
So my question is: What can I do to avoid getting the connection dropped?
I did a tcpdump from both sides and, at some point, packets start to get duplicated. It looks like this:
I have this option enabled which I thought it would help, but it didn't.
I should mention that this exact same configuration, using a LINUX FIREWALL (iptables) works perfectly.
Any ideas?
I set up a SIP TRUNK in FreePBX/Asterisk that works perfectly for incoming calls. Here' s the relevant configuration:
type=friend
host=201.217.31.10
callerid=mynumber
[email protected]
[email protected]
fromuser=595XXYYZZZZZZ
fromdomain=prepago.com.py
secret=******
dtmfmode=auto
trunkname=covoip
context=from-trunk
hasexten=no
hasiax=no
hassip=yes
registeriax=no
registersip=yes
trunkstyle=voip
nat=force_rport,comedia
insecure=port,invite
disallow=all
allow=alaw,ulaw,gsm
qualify=yes
However, whenever I try to place an outgoing call (through the same trunk) I have a "all lines busy" signal from asterisk. If I enable SIP DEBUG this is what I get (apparently my call is being rejected due to an invalid alias at the other side, which I can't control since it's my VOIP provider):
<--- SIP read from UDP:201.217.31.10:5060 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.16.50:5061;received=190.128.230.22;branch=z9hG4bK6a440fdb;rport=5061
From: <sip:[email protected]>;tag=as3a625f1c
To: <sip:[email protected]>
Call-ID: 59fbc0e25c141a603114ce2214c9d208@[::1]
CSeq: 180 REGISTER
Contact: <sip:[email protected]:5061>;expires=30
Expires: 30
User-Agent: FPBX-AsteriskNOW-12.0.33(13.0.1)
Content-Length: 0
<------------->
--- (10 headers 0 lines) ---
[2015-02-19 15:48:50] NOTICE[2015]: chan_sip.c:23725 handle_response_register: Outbound Registration: Expiry for 201.217.31.10 is 30 sec (Scheduling reregistration in 24 s)
Really destroying SIP dialog '59fbc0e25c141a603114ce2214c9d208@[::1]' Method: REGISTER
[2015-02-19 15:48:52] WARNING[1833]: func_cdr.c:349 cdr_write_callback: CDR requires a value (CDR(variable)=value)
Audio is at 16688
Adding codec ulaw to SDP
Adding codec alaw to SDP
Adding codec gsm to SDP
Adding non-codec 0x1 (telephone-event) to SDP
Reliably Transmitting (NAT) to 201.217.31.10:5060:
INVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 192.168.16.50:5061;branch=z9hG4bK61ad8aec;rport
Max-Forwards: 70
From: <sip:[email protected]:5061>;tag=as23ae8214
To: <sip:[email protected]>
Contact: <sip:[email protected]:5061>
Call-ID: [email protected]
CSeq: 102 INVITE
User-Agent: FPBX-AsteriskNOW-12.0.33(13.0.1)
Date: Thu, 19 Feb 2015 18:48:52 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Type: application/sdp
Content-Length: 300
v=0
o=root 1709304421 1709304421 IN IP4 192.168.16.50
s=Asterisk PBX 13.0.1
c=IN IP4 192.168.16.50
t=0 0
m=audio 16688 RTP/AVP 0 8 3 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:3 GSM/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv
---
<--- SIP read from UDP:201.217.31.10:5060 --->
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.16.50:5061;received=190.128.230.22;branch=z9hG4bK61ad8aec;rport=5061
From: <sip:[email protected]:5061>;tag=as23ae8214
To: <sip:[email protected]>
Call-ID: [email protected]
CSeq: 102 INVITE
<------------->
--- (6 headers 0 lines) ---
<--- SIP read from UDP:201.217.31.10:5060 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 192.168.16.50:5061;received=190.128.230.22;branch=z9hG4bK61ad8aec;rport=5061
From: <sip:[email protected]:5061>;tag=as23ae8214
To: <sip:[email protected]>;tag=b72e12N2654e5f93c-504b
Call-ID: [email protected]
CSeq: 102 INVITE
Reason: Q.850 ;cause=38 ;text="11017 - Invalid alias"
Content-Length: 0
<------------->
--- (8 headers 0 lines) ---
Transmitting (NAT) to 201.217.31.10:5060:
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 192.168.16.50:5061;branch=z9hG4bK61ad8aec;rport
Max-Forwards: 70
From: <sip:[email protected]:5061>;tag=as23ae8214
To: <sip:[email protected]>;tag=b72e12N2654e5f93c-504b
Contact: <sip:[email protected]:5061>
Call-ID: [email protected]
CSeq: 102 ACK
User-Agent: FPBX-AsteriskNOW-12.0.33(13.0.1)
Content-Length: 0
Any ideas of what might be wrong on my side of things?
If I connect a simple softphone to my VOIP provider, it works flawlessly (incoming and outgoing calls).
Here's my scenario.
I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade.
I have a weird problem though.
I have a FIREWALL which have our public IP ADDRESS that does a PORT REDIRECTION with IPTABLES like this:
IPT=iptables
LUISANA=192.168.0.1
LOCAL_IF=eth0
INET_IF=eth1
$IPT -t nat -A PREROUTING -i $LOCAL_IF -p tcp --dport 5000 -j DNAT --to $LUISANA:5000
$IPT -t nat -A PREROUTING -i $INET_IF -p tcp --dport 5000 -j DNAT --to $LUISANA:5000
Here, LOCAL_IF and INET_IF are my two NICs with local and public ip addresses respectively and LUISANA is the IP address of the machine that is on the local network running my daemon on port 5000.
When I have the network under this configuration, iptables some incoming packets get corrupted on the transformation and the protocol fails. However, if I take down these two iptables and use a ssh tunnel to do the port forwarding, the protocol works flawlessly.
So my question is: what can be causing this packet corruption? May be it has something to do with endianness? (both machines, FIREWALL and LUISANA run the same LINUX version on the same x86 hardware).
I have a Dell Poweredge R410 with two CPUs installed.
I tried everything but the second CPU does not get recognized by the BIOS or the Linux Operating System it has.
Both CPUs are Intel Xeon E5602 with these RAM configurations:
- CPU1 - 16GB ram (2 8GB DIMMs in slots 1 and 2)
- CPU2 - 4GB ram (2 2GB DIMMs in slots 1 and 2)
Couple of extra info:
Is there anything else I need to setup? Manual doesn't say anything about a JUMPER and/or BIOS configuration needed in order to make both CPUs work.
One more thing: firmware, BIOS and everything are fully updated to their latest official versions.
I have setup a tunnel between a UBUNTU SERVER linux box and a CISCO ROUTER.
This is what's the topology looks like:
host 1 ------ UBUNTU SERVER IPSEC <---> CISCO ROUTER ------ host 2
| | | |
| | | |
192.168.64.0/24 1.2.3.4 4.3.2.1 10.10.20.0/24
Here's my problem: the tunnel is setup and running correctly. I can definitely ping from the CISCO ROUTER to any host on the 192.168.64.0/24 network. But I can not ping from the 192.168.64.0/24 network to any host on the 10.10.20.0/24 network.
Here's some info:
ipsec.conf:
conn my_vpn
auto=start
authby=secret
ike=aes256-md5
phase2=esp
phase2alg=aes256-md5
type=tunnel
left=1.2.3.4
leftsubnet=192.168.64.0/24
leftnexthop=%defaultroute
leftupdown="ipsec _updown --route yes"
keyingtries=3
keyexchange=ike
pfs=no
right=4.3.2.1
rightsubnet=10.10.20.0/24
ipsec look command output:
XFRM state:
src 4.3.2.1 dst 1.2.3.4
proto esp spi 0x0f9898dd reqid 16385 mode tunnel
replay-window 32 flag af-unspec
auth-trunc hmac(md5) 0xSOMEVALUE
enc cbc(aes) 0xSOMEOHTERVALUE
src 1.2.3.4 dst 4.3.2.1
proto esp spi 0x667b62d8 reqid 16385 mode tunnel
replay-window 32 flag af-unspec
auth-trunc hmac(md5) 0xSOMEVALUE
enc cbc(aes) 0xSOMEOHTERVALUE
XFRM policy:
src 192.168.64.0/24 dst 10.10.20.0/24
dir out priority 2344
tmpl src 1.2.3.4 dst 4.3.2.1
proto esp reqid 16385 mode tunnel
src 10.10.20.0/24 dst 192.168.64.0/24
dir fwd priority 2344
tmpl src 4.3.2.1 dst 1.2.3.4
proto esp reqid 16385 mode tunnel
src 10.10.20.0/24 dst 192.168.64.0/24
dir in priority 2344
tmpl src 4.3.2.1 dst 1.2.3.4
proto esp reqid 16385 mode tunnel
src ::/0 dst ::/0
socket out priority 0
src ::/0 dst ::/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0
XFRM done
IPSEC mangle TABLES
iptables: No chain/target/match by that name.
ip6tables: No chain/target/match by that name.
NEW_IPSEC_CONN mangle TABLES
iptables: No chain/target/match by that name.
ip6tables: No chain/target/match by that name.
ROUTING TABLES
default dev ppp0 scope link
10.10.20.0/24 via 1.2.3.GW dev ppp0
1.2.3.GW dev ppp0 proto kernel scope link src 1.2.3.4
Where 1.2.3.GW is 1.2.3.4's gateway.
ipsec verify command output:
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Linux Openswan U2.6.37/K3.2.0-38-generic-pae (netkey)
Checking for IPsec support in kernel [OK]
SAref kernel support [N/A]
NETKEY: Testing XFRM related proc values [OK]
[OK]
[OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for NAT-T on udp 4500 [FAILED]
Two or more interfaces found, checking IP forwarding [FAILED]
Checking NAT and MASQUERADEing [OK]
Checking for 'ip' command [OK]
Checking /bin/sh is not /bin/dash [WARNING]
Checking for 'iptables' command [OK]
Opportunistic Encryption Support [DISABLED]
I must add: UBUNTU has a ppp0 connection which has its public IP address: 1.2.3.4.
Static route information:
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ppp0
10.10.20.0 1.2.3.GW 255.255.255.0 UG 0 0 0 ppp0
Any ideas?
I need to setup a Checkpoint VPN client with a customer who gave me these settings:
They tell me the VPN server is:
I have nothing more. I can connect with Checkpoint's Windows Client without issues.
What options do I have?
I read other related questions on this and other sites, but there is no definitive answer.
I have a firewall with these simple rules:
iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp --dport 6000 -j REJECT
Now, suppose I am using TCPDUMP like this:
tcpdump port 6000
And I have host 192.168.16.21 trying to connect to port 6000.
Will/should tcpdump output some packets coming from 192.168.16.21?
I have an XEON based server which is perfectly capable of paravirtualization.
The thing is, with Ubuntu Server 8.04 and KVM I can't get the option to check "Paravirtualized server". It's grayed out and the only option available to me is "Full Virtualization".
I am using basic Ubuntu Server distribution (no kernel recompile or anything) with server-kernel installed and running: 2.6.24-24
Is there something I am missing? How can I get to use paravirtualization under Ubuntu Server with KVM?
Thanks.
I would like to know what 64-bit Linux distribution can I use with an Intel ICH10R RAID. I have tried CentOS 5.2 and Ubuntu Server 8.04. Neither support that raid controller.
Also, I would like to know where do I setup the RAID-5 I want to use. I am using a TYAN S7002 motherboard and the BIOS software does not include an option to configure the RAID as I am used to do with Dell servers...
Thanks a lot in advance.
How can I get ACL for file permission to work in Linux?
I don't care kernel version or distribution. I will do a clean install anyway. Is there a KERNEL/FS supported ACL? If I choose Linux, am I stuck with UGO approach to file permissions?
Thanks.
I administer one mail server that hosts several domains in it. I.E.
Hosting mail for domains:
I have my user database with OpenLDAP. The server works just fine. There is only one thing I would like to tweak which is the following:
Right now, if I add a user "username" to OpenLDAP and the CyrusMail backend, then "username" gets mail through the following addresses:
The tweak I would like to make is to allow "username" to get emails only from selected domains. What's the best (and easiest) way to do this?
Thanks a lot in advance.
What would be your suggestion if installing a FreeBSD 7 (7.2, actually) email server?
I am interested in:
Thanks a lot in advance.
I am having a very weird problem when browsing a HTTPS site we host with Firefox.
I have no problem with most of the pages (we are using PHP/FreeBSD), but a few of them, when accessed with latest versions of Firefox (3.0.x), are randomly (not always) throwing this SSL error:
An error occurred during a connection to myserver.mydomain.com. SSL received a record with an incorrect Message Authentication Code. (Error code: ssl_error_bad_mac_read)
I don't know if it has something to do with the problem but my server has two NICs:
And I am seeing the error when accessing the page through the INTERNAL NIC.
I don't see the error with latest IE, Safari or Chrome.
My SSL certificate was issued by GoDaddy.
The strangest part of all is that whenever the error occurr, I can see the right page for a fraction of a second before Firefox shows me the error on a complete new page.
Thanks a lot.
I would like to know what are the options for using Apache's HTTP server as a reverse proxy for IIS7 (serving ASP.NET content under 3.5 .NET Framework).
For JBoss/Tomcat or any other Java Application Server, I will use MOD_JK, but I would like to know what are your experiences with IIS7. What connectors are there available (if any) and what are the pros and cons of each one.
Thanks a lot. Great site!