nixnotwin's questions

I use Ubntu 12.04 Server as a gateway/router. The server has two NetXtreme BCM5721 Gigabit Ethernet PCI Express cards for LAN and WAN interfaces. Opennms monitoring software shows incoming packet discards on the WAN (ISP) interface. The ISP provides direct Ethernet connectivity via SDH/SONET ring. However I don't see any packet discard on the LAN interface. Here is the WAN interface graph:

Are there any tools/commands to discover what is responsible for such packet discards. Is it possible to know if some misconfiguration at ISP's side is causing such an issue.

Ifconfig Output:

eth1      Link encap:Ethernet  HWaddr **:**:**:**:63:5d  
          inet addr:***.***.4.130  Bcast:***.***.4.131  Mask:255.255.255.252
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:865089489 errors:0 dropped:596 overruns:0 frame:3
          TX packets:498072410 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1092458492329 (1.0 TB)  TX bytes:48179244881 (48.1 GB)
          Interrupt:17 

The following are my firewall rules. eth1 is the WAN interface and all other are LAN interfaces. I want to filter INPUT and FORWARD chains only on eth1 (WAN interface). All other interfces need not be firewalled. My code sample below works fine. But I feel I need not have so many rules just to have filtering enabled on eth1. So how can I have filtering enabled only on eth1 with just a few number of iptables rules?

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i eth5 -j ACCEPT
iptables -A INPUT -i eth5.20 -j ACCEPT
iptables -A INPUT -i eth5.21 -j ACCEPT
iptables -A INPUT -i eth5.22 -j ACCEPT
iptables -A INPUT -i eth5.23 -j ACCEPT
iptables -A INPUT -i eth5.24 -j ACCEPT
iptables -A INPUT -i eth5.25 -j ACCEPT

iptables -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
iptables -A IFORWARD -i tap0 -j ACCEPT
iptables -A FORWARD -i eth5 -j ACCEPT
iptables -A FORWARD -i eth5.20 -j ACCEPT
iptables -A FORWARD -i eth5.21 -j ACCEPT
iptables -A FORWARD -i eth5.22 -j ACCEPT
iptables -A FORWARD -i eth5.23 -j ACCEPT
iptables -A FORWARD -i eth5.24 -j ACCEPT
iptables -A FORWARD -i eth5.25 -j ACCEPT

iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Webserver Ports
iptables -A INPUT -i eth1 -p tcp --match multiport --dports 80,443 -j ACCEPT

# NAT for my local network
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source my.pub.ip.add

# ICMP Protection
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

iptables -A INPUT -i eth1 -j DROP
iptables -A FORWARD -i eth1 -j DROP

I have a Linux box running Ubuntu 10.04 with three interfaces: eth0, eth1 and eth2. I am planning to use it as a WAN router for 4 public subnets assigned by two different ISP's. Here are the subnets (I have converted the ISP assigned subnets to class C private subnets):

ISP 1   
WAN 192.168.0.176/30 gateway 192.168.0.177   
LAN 192.168.3.192/29

ISP 2   
WAN 192.168.6.208/30 gateway 192.168.6.209  
LAN 192.168.9.216/29

/30 subnets face respectives ISPs and /29 subnets face my LAN switch.

This is how IPs are assigned to the interfaces:

LAN interface 
eth0 192.168.3.193/29
eth0:0 192.168.9.217/29

ISP 1 interface
eth1 192.168.0.178/30

ISP 2 interface
eth2 192.168.6.210/30

I want to route traffic between respective ISP assigned /30 and /29 subnets separetly. If traffic comes from one ISP's /30 network, it should be routed to that ISPs /29 network and visa versa. I don't mind if traffic originated in one ISP's /29 network destined to the other ISP's /29 network gets routed in my router (without getting it sent to one ISP and comes back other ISP's link).

My aim is to not to buy two routers for two ISP's. How can I achieve this by using iproute2 tables and policy routing?

I want to setup squid proxy server to be used without manually configuring the browser to use a proxy. For example I should be able to do this in the browser address bar: htttp://squidserverip:3128/www.serverfault.com. It did not work for me with my basic squid configuration.

What I want is a basic http proxy server with some authentication feature. When the users put the url of the proxy server in the browser address bar (e.g. www.proxyserver.net), on getting authenticated, it will display a list of urls that can be accessed through the proxy. Clicking on those urls will fetch those sites through the proxy.

I'm trying to setup traffic shaping on a Linux gateway as written here. The script needs to be customized because I have multiple LAN interfaces. So to shape the LAN side I am planning to create a ifb pseudo device like so:

     modprobe ifb
     ip link set dev ifb0 up
    /sbin/tc qdisc add dev $WAN_INTERFACE ingress
    /sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb0

The script from the gist repo mentioned above has these lines:

 /sbin/tc qdisc add dev $WAN_INTERFACE handle ffff: ingress
    /sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 1 u32 match ip sport $INTERACTIVE_PORT 0xffff flowid :1
    /sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 1 u32 match ip dport $INTERACTIVE_PORT 0xffff flowid :1
    /sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 5 0 u32 match ip src 0.0.0.0/0 police rate $MAX_DOWNRATE_INGRESS burst 20k drop flowid :2

This code and the ifb interface creation code don't get on well together. The customized script gets executed, but ifb0 device doesn't show any traffic stats. If I comment out ingress gist repo code (quoted above), then ifb0 device shows the number of packets that are transferred. Also these lines cannot be executed together:

/sbin/tc qdisc add dev $WAN_INTERFACE ingress
/sbin/tc qdisc add dev $WAN_INTERFACE handle ffff: ingress

I get file exists error. So, how can I shape ingress on WAN_INTERFACE and at the same time also shape the traffic that goes to LAN via ifb0 device?

My Ubuntu Server has one physical interface eth0. I want to assign 3 ip's (different subnets) to the server. I cannot use the default virtual interface creation tools like ifconfig or ip addr add (e.g. eth0:0) because for each of those 3 ip's I need to specify a default gateway. So, whether it is possible to have a bridge to which I can attach eth0 ( and multiple tap or tun interfaces with ips that I want), but each of the virtual devices can connect to subnets accessbile over eth0.

EDIT1:

Imagine I want 5 ethernet interfaces to connect to 5 different networks. But I can't afford to have 5 interfaces. So I buy an unmanaged switch, and connect cat5 cables from all the 5 networks to that switch and one port of that switch in connected to eth0 of Ubuntu server. In order to deal with all 5 networks on Ubuntu server, I create 5 virtual interfaces that behave like physical interfaces (eth1, eth2, so on ..), that traverse through eth0 and end up at the switch. I don't mind if all those seperate networks traverse through one unmanaged switch. But I want my Ubuntu server to treat those networks as if they are attached to 5 physical interfaces.

I am trying to installing a bsd distro with virt-installer. With a Linux distro I used this:

virt-install -n debian -r 1024 --vcpus=1 --accelerate -v --disk /var/kvm/installation-disks/debian.img,size=6--nographics
--network=bridge:br0,model=ne2k_pci,mac=52:54:00:66:68:09 -l http://ftp.de.debian.org/debian/dists/squeeze/main/installer-amd64/current/images/
-x console=ttyS0,115200

This loads the installer directly from the online mirror. With Fedora I used this mirror: http://www.nic.funet.fi/pub/mirrors/fedora.redhat.com/pub/fedora/linux/releases/16/Fedora/x86_64/os/

Are there such mirrors for freebsd or openbsd?

The reason I want direct installable ftp/http mirrors is because I can access my physical server only via ssh, and it doesn't have a X server or a window manager to give me a VNC GUI.

When I tried installing centos 6 with an online mirror I was able to finish the installation via serial console, but after I rebooted it, the serial console never worked for me. I tried everything possible---editing menu.lst, inttab and securtty files.

Fedora 16 booted fine from serial console, but got stuck when it loaded anaconda installer.

I tried editing freebsd iso installation media by adding serial console option to boot option. And installation was successful. But couldn't boot into it becuase it wasn't giving console acess. I couldn't edit any files as ufs partition cannot be loaded with write access on my Ubuntu server 10.04.

Only debian squeeze worked well, it worked for me even without editing a single configuration file.

I want to have CLI versions of fedora/centos and freebsd/openbsd. But, looks like there isn't any hope for me to have them, as I have to depend on a serial console to do everything.

My Ubuntu servers ethernet interface that connectes to ISP's multiplexer shows errors. Here is the snapshot:

          RX packets:204564288 errors:3193970 dropped:0 overruns:0 frame:3138402
          TX packets:29305799 errors:38752 dropped:0 overruns:0 carrier:38762
          collisions:2205053 txqueuelen:1000

Ubuntu interface is capable of full duplex but it negotiates only half duplex connection. When I connected a different device (a router) to MUX, it also showed such errors. The bandwidth assigned is 50 mbps, but I get only 20 mbps. The ISP is reluctant to change their device (looks like a ethernet switch or hub) in the MUX. The ISP engineers blame that its fault at my side. But I checked with more than 3 devices, all showed errors. So, are there any tools for Linux which I can use to probe deep into the causes of those errors, or is there anything I can do to reconfigure my server's interface so as to get rid of those errors?

I have a 50 Mbps WAN link and I use Asus RT-N16 with tomato firmware for NAT. My users view multiple streaming videos. At any given time there would be about 20 streaming videos which are being watched. But always if the number of videos that are being watched goes above 7 or 8, then there will a lag or delay in the videos even if bandwidth usage has not gone higher that 15 Mbps. After testing almost every possible setup, I have come to the conclusion that the lag or delay is caused because Asus RT-N16 is a home router, and its hardware is not suitable for a heavy bandwidth connection. Now my plan is to use a powerful desktop pc (sandybridge processor and 4+ GB RAM) with multiple NIC's as a router. I will be running Ubuntu server on it and will be using packet forwarding and NAT maquarading options. So is this a good choice? Does Linux provide any good functionality to maximize video streaming routing throughput?

I have an unmanaged switch which serves traffic belonging to different subnets. Lets say these are the subnets:

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
And few more subnets which I am not aware of.

I have a Linux machine having 192.168.0.1 as IP on 192.168.0.0/24 subnet. Using this machine I want to discover the arp address's of all the machines that are on different subnets. After arp address's are found, I want to discover their IP address's too. Can this be done?

I have a server running ubuntu 10.04 with four interfaces. eth0 and eth1 have static WAN ip's, and eth2 and eth3 are connected to two separate NAT networks 192.168.0.0/24 and 192.168.1.0/24 respectively. eth0 is masqueraded and NAT traffic from eth2 is forwarded to it. In order to forward eth3 traffic to eth1 I have used these rules:

ip route add xxx.xxx.xxx.176/29 dev eth1 src xxx.xxx.xxx.180 table link2
ip route add default via xxx.xxx.xxx.178 dev eth1 table link2

ip route add xxx.xxx.xxx.176/29 dev eth1 src xxx.xxx.xxx.180

ip rule add from xxx.xxx.xxx.180/32 table link2
ip rule add iif eth3 lookup link2

ip route add 192.168.1.0/24 dev eth3 table link2

This setup is working fine. eth1 is masqueraded and NAT traffic from eth3 is forwarded to it. But I feel some rules above are redundant, and there must be a simpler way of achieving it. Are there any better ways of doing it?

I have this in logrotate.d/varnish file:

/var/log/varnish/*log {
                create 640 http log
                compress
                postrotate
                        /bin/kill -USR1 `cat /var/run/varnishncsa.pid 2>/dev/null` 2> /dev/null || true
                endscript
        }

And this in my /etc/rc.local file:

varnishncsa -a -w /var/log/varnish/access.log -D -P /var/run/varnishncsa.pid

But when logrotate creates a new access.log file, it remains blank. I have to do sh /etc/rc.local for logs to be saved in that file. As logrotation happens weekly, I have to execute that rc.local every week to get the logs saved in access.log file. What can be the issue here?

I have a ubuntu router machine with following network settings:

br0 192.168.1.15 netmask 255.255.255.0
br0:1 192.168.2.209 netmask 255.255.255.248

I have a pc attached to the br0:1 network with these settings:

ip 192.168.2.210 netmask 255.255.255.248 gateway 192.168.2.209

This pc should be able to access the host 192.168.1.1 which is on the br0 network of ubuntu router.

192.168.1.1 is the WAN gateway, so how can I make it a gateway for the hosts on 192.168.2.208/29 network.

I have enabled ip4 forwarding on the ubuntu router.

I am using gogoc tunnel broker on my ubuntu pc for enabling ipv6. I want to use my Ubuntu pc as ipv6 router. I have enabled router mode in the gogoc client. I am using radvd for advertizing the router on the local LAN. tun is the tunnel (WAN) interface. br0 is the LAN interface (wan0 and eth0 have been bridged to make the laptop a wireless accesspoint). What firewall rules can I use to enable packet forwarding and to have a fairly good security for the router and the LAN devises.

I use Ubuntu server 10.04 with the stock kernel as a NAT router. I use iptables and tc to do port based traffic prioritization. It is working fine. I have given http higher priority. So my network gets swamped with youtube and bigger http downloads. My question is: Is it possible to make iptables recognize and mark packets that belong to youtube streams or larger files? my goal is to make webpage browsing faster.

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

I want to archive files (with tar) which are below 3 MB in size. But I also want to retain the directories in which those files exist. (so I cannot use find command). I just want to avoid the files which are above 3 MB in size. How can this be done?

I have a separate /home partition with ext4 filesystem. I have about 200 users whose usernames have a common prefix (e.g. 2010...). I have to allot 500 MB space limit (hard limit) for each users home directory. Instead of specifying space one by one I want to set the limit on one go by making use of the username prefix. How can it be done?

I use openvpn to access my workplace network. When I ssh into a server(Ubuntu) over openvpn, as I type into the shell prompt the characters and letters appear slowly. So I should wait a little to see on the screen what I type. If I ssh directly (not via openvpn) then there is no delay at all. All other services also respond slowly: for e.g. accessing intranet web-pages, ftp or router configuration GUI, almost everything shows delay. I use 2 Mbps down and 800 Kbps up ADSL connection at home. And at work place I have 4 Mbps up and down ethernet based internet connection.

I use a linux based router which has dnsmasq and iptables. On a LAN machine I have squid proxy. I want to know if requests for certain urls can be forwarded to the proxy, while other urls are allowed directly to the WAN. For example the request for www.onedomian.com should be forwarded to the proxy by the router.