Ency's questions

Would be possible to do the following as it is at image?
I would like to send all traffic coming from internet to Router with FW first and then to the LAN.

I thought this could be achieved by using VLAN tagging, is this the way how to do that?
The reason I want to do that in this way:

• There is a data switchboard which is not really suitable for wifi router, so I decided to put there switch with 802.1q support
• There is a start topology from switch board to other rooms at apartment
• Router would be placed on better place right between two floors to effectively cover both of them with WiFi signal

So, my questions:

• Is this correct approach?
• Is this safe approach? I mean will under all circumstances all traffic be routed to the router at the first place? Or will I have to use router instead of switch?

I have a problem I cant figure out, I am trying to access webserver on [RPI], but packets never reach iptables FILTER chain

I will try to explain it a bit:
GW1 has public address and doing DNAT from port 8080 to 192.168.69.14:80
S1 is a openVPN server eth0 for LAN and tap0 for VPN are bridged
[RPI] has running webserver on port 80
GW2 is default gateway for [RPI] and has no public address

     GW1 <-----------------> S1 <-----Open VPN tunnel------> [RPI] <--Default route--> GW2
(192.168.69.1)        (192.168.69.22)                 (192.168.69.14 - tap0)       (192.168.30.1)
                                                      (192.168.30.2 - wlan0)

Now, everything works fine If I reach [RPI]'s webserver from S1, GW2 or do a ping from GW1
But if I try to access webserver via GW1's public IP on port 8080, packets do reach [RPI], but disappear in iptables., as you can see here, also iptables rules are printed below:

Apr 27 18:13:51 WeatherStorm kernel: [11383.698445] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307)
Apr 27 18:13:51 WeatherStorm kernel: [11383.874415] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307)
Apr 27 18:13:51 WeatherStorm kernel: [11384.051167] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307)
Apr 27 18:13:51 WeatherStorm kernel: [11384.227423] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307)
Apr 27 18:13:52 WeatherStorm kernel: [11384.459821] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307)
Apr 27 18:13:52 WeatherStorm kernel: [11384.635037] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307)
Apr 27 18:13:52 WeatherStorm kernel: [11384.811610] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307)
Apr 27 18:13:52 WeatherStorm kernel: [11384.988901] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307)
Apr 27 18:13:54 WeatherStorm kernel: [11386.698855] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307)
Apr 27 18:13:54 WeatherStorm kernel: [11386.874488] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307)
Apr 27 18:13:54 WeatherStorm kernel: [11387.050505] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307)
Apr 27 18:13:54 WeatherStorm kernel: [11387.228835] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307)

Raw:

[root@WeatherStorm tmp]# iptables -L -nv -t raw
Chain PREROUTING (policy ACCEPT 5750 packets, 748K bytes)
 pkts bytes target     prot opt in     out     source               destination         
   27  1620 TRACE      tcp  --  *      *       37.188.XXX.XXX       0.0.0.0/0           
  270 15120 TRACE      icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
   51  3958 TRACE      tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80

    Chain OUTPUT (policy ACCEPT 4768 packets, 911K bytes)
     pkts bytes target     prot opt in     out     source               destination         
        8   448 TRACE      icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
        0     0 TRACE      tcp  --  *      *       0.0.0.0/0            37.188.XXX.XXX      

Mangle:

[root@WeatherStorm tmp]# iptables -L -nv -t mangle
Chain PREROUTING (policy ACCEPT 4177 packets, 544K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 3661 packets, 374K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3498 packets, 674K bytes)
 pkts bytes target     prot opt in     out     source               destination  

Chain POSTROUTING (policy ACCEPT 3498 packets, 674K bytes)
 pkts bytes target     prot opt in     out     source               destination        

NAT:

[root@WeatherStorm tmp]# iptables -L -nv -t nat
Chain PREROUTING (policy ACCEPT 596 packets, 180K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 80 packets, 9600 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 59 packets, 4443 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 59 packets, 4443 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Filter:

[root@WeatherStorm tmp]# iptables -L -nv -t filter
    Chain INPUT (policy ACCEPT 23788 packets, 2365K bytes)
     pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 23777 packets, 5142K bytes)
 pkts bytes target     prot opt in     out     source               destination   

Any idea what/where could be a problem? If I tried access from GW2 it looks like

Apr 27 18:22:02 WeatherStorm kernel: [11873.756818] TRACE: raw:PREROUTING:policy:4 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11873.850894] TRACE: mangle:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11873.945646] TRACE: nat:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.039622] TRACE: mangle:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.133002] TRACE: filter:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.226404] TRACE: nat:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.319744] TRACE: raw:PREROUTING:policy:4 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.413794] TRACE: mangle:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.508565] TRACE: nat:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
Apr 27 18:22:02 WeatherStorm kernel: [11874.602511] TRACE: mangle:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
Apr 27 18:22:04 WeatherStorm kernel: [11874.695929] TRACE: filter:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
Apr 27 18:22:04 WeatherStorm kernel: [11874.789331] TRACE: nat:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)

.

Solution:

Solved with following iptables rules on S1

iptables -A PREROUTING -t mangle -i br0 -p tcp --dport 80 -d 192.168.69.14 -j MARK --set-mark 1
iptables -A POSTROUTING -t nat --match mark --mark 1 -j SNAT --to-source 192.168.69.1

In my virtual host I have something like that:

    SSLEngine on
    SSLCertificateKeyFile /etc/apache2/ssl/svn.XXXXX.me.key
    SSLCertificateFile /etc/apache2/ssl/svn.XXXXX.me.crt
    SSLProtocol all
    SSLCipherSuite HIGH:MEDIUM
    SSLVerifyClient require
    SSLCACertificateFile /etc/ssl/certs/ICA-Standart.0

So far, I can use any certificate issued by CA "ICA-Standart.0" to log in, but I would like to specify kind of white list and only some certificates will be allowed to log in, is that possible?
If so, which directive should I look?

Also please note the CA is a public certification authority.

I am trying to make screen work on HP-UX B.11.23 U ia64 0308561483 unlimited-user license. Please notice I do not have root access.

I have already compiled screen successfully, configured with LIBS=-lcurses.

When I try to start screen it wrotes
Cannot find terminfo entry for 'xterm'.

But there ARE terminfos for the terminal type in

screen-4.0.3> ls -a /usr/share/lib/terminfo/x/
.         ..        x-hpterm  x1700     x1720     x1750     xitex     xl83      xterm     xterms

I thing the problem may be there are in non-standard path, because according to man page standard path is /usr/lib/terminfo/?/*

What I tried:

But as I said I do not have root access so cant make symlink, anyway I tried run screen with filled TERMINFO_DIRS (TERMINFO_DIRS=/usr/share/lib/terminfo/x/ ./screen and TERMINFO_DIRS=/usr/share/lib/terminfo/ ./screen) but none of them work - same error.

Change TERM to different values - same error Cannot find terminfo entry for <WHATEVER WHAT WAS IN TERM VAR>.

Put something into screenrc and run ./screen -c screenrc

screen-4.0.3> cat screenrc
attrcolor b ".I"
term xterm
termcap xterm*  LP:hs@
termcapinfo xterm 'Co#256:AB=\E[48;5;%dm:AF=\E[38;5;%dm'
defbce "on"

I also tried to compile it against termcap from http://hpux.connect.org.uk/hppd/hpux/Development/Libraries/termcap-1.3.1/, but it also did not work, same symptoms.

Is there anyone who has working screen on this platform and could post output of ldd or binary itself?

But no luck so far, have you got any suggestions? Need some additional information, let me know. Also please see strace attached in comments.

I have got working VPN connection through openvpn, but I would like to use also my DHCP server and not openvpn's push feature. Currently everything works fine, but I have to manually start dhcp client, eg. dhclient tap0 and I get IP and other important stuff from my DHCP, is there any directive which start DHCP Client when connection is established?

There is my client's config:

remote there.is.server.com
float
dev tap
tls-client
#pull
port 1194
proto tcp-client
persist-tun
dev tap0

#ifconfig 192.168.69.201 255.255.255.0
#route-up "dhclient tap0"
#dhcp-renew

ifconfig 0.0.0.0 255.255.255.0
ifconfig-noexec
ifconfig-nowarn

ca /etc/openvpn/ca.crt
cert /etc/openvpn/encyNtb_openvpn_client.crt
key /etc/openvpn/encyNtb_openvpn_client.key
dh /etc/openvpn/dh-openvpn.dh

ping 10
ping-restart 120

comp-lzo
verb 5

log-append /var/log/openvpn.log

Here comes server's config:

mode server
tls-server
dev tap0
local servers.ip.here  
port 1194
proto tcp-server
server-bridge

# Allow comunication between clients
client-to-client

# Allowing duplicate users per one certificate
duplicate-cn

# CA Certificate, VPN Server Certificate, key, DH and Revocation list
ca /etc/ssl/CA/certs/ca.crt
cert /etc/ssl/CA/certs/openvpn_server.crt
key /etc/ssl/CA/private/openvpn_server.key
dh /etc/ssl/CA/dh/dh-openvpn.dh
crl-verify /etc/ssl/CA/crl.pem

# When no response is recieved within 120seconds, client is disconected
keepalive 10 60

persist-tun
persist-key

user openvpn
group openvpn

# Log and Connected clients file
log-append /var/log/openvpn
verb 3
status /var/run/openvpn/vpn.status 10

# Compression
comp-lzo

#Push data to client
push "route-gateway 192.168.69.1"
push "redirect-gateway def1"

I am trying to test if site/server/whatever has ability to pipeline HTTP request.

So far, I think it is possible to send several request through one curl session, like:
curl http://www.example.com/1.html http://www.example.com/main.css http://www.example.com/2.html

Is possible to use below mentioned to simulate pipelining and how can I actually verify than pipelining was used?

I'm laso thinking about using netcat, send few requests and verify if it'll came back in correct order (as requested by RFC)

Could you give me some hints about how to verify a content was pipelined? (At the best on linux, but is not necessary.)

Currently I am connected to Internet over IPv4, I am using tunnel from sixxs.net and I have got subnet and one of IPv6 assigned to my eth0 interface.

So, eth0 has IPv4 and IPv6:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 00:02:XX:XX:61:36 brd ff:ff:ff:ff:ff:ff
    inet XXX.XXX.0.22/24 brd XXX.XXX.0.255 scope global eth0
    inet6 2a01:XXXX:XXXX::1/64 scope global 
       valid_lft forever preferred_lft forever

When I am trying to connect to some eg. website which is IPv6 ready, it is fine, IPv6 is preferred, but If something happen and it's IPv6 is not available I would like to have fall-back to IPv4. Is that possible?

Or is possible to temporary force user IPv4 instead of IPv6 even if program does not support (eg. by -4 option)?

Shall I flush iptables rules for specific interface if this interface went down?
Does it offer any advantages?

Currently I'm using iptables-restore and I am not deleting rules, even if I sent interface down, rules are just loaded upon boot-up and that's all.

What do you recommended?

Well, I would like to point to my own DNS, as long as my domain registrar (123-reg.co.uk) does not have support for AAAA records.
But if I request to point to my own DNS, they ask me for two NS, that's ok so far, and then for IPv4 addresses and nothing more, is there any workaround for IPv6 or I have to change my domain registrar?

I've got Ubuntu 10.04 and Grub 0.97, I've created /etc/default/grub (according to example in menu.lst):

defoptions=
howmany=all

But every-time when update-grub is executed quite splash is appended as kernel parameter. I cannot find out why this happens even if created default file and the file is

title           Ubuntu 10.04.1 LTS, kernel 2.6.32-28-generic-pae
uuid            c90f570d-b8a0-4c2e-a285-47905d46d3ce
kernel          /vmlinuz-2.6.32-28-generic-pae root=/dev/mapper/vg0-lvRoot ro quiet splash
initrd          /initrd.img-2.6.32-28-generic-pae

located during `update-grub`, as you can see:
Searching for GRUB installation directory ... found: /boot/grub
Searching for default file ... found: /boot/grub/default
Testing for an existing GRUB menu.lst file ... found: /boot/grub/menu.lst
Searching for splash image ... none found, skipping ...
Found kernel: /vmlinuz-2.6.32-28-generic-pae
Found kernel: /vmlinuz-2.6.32-28-generic

I also tried edit menu.lst "defaults", but update-grub doesn't take care about them.
What am I doing wrong? Am I missing something?

I am wondering if it is possible to redirect requests through Apache to eg. OpenVPN.
As long as I need to bypass firewall, I need to use port 80/443 for openVPN, but there is Apache server which has both port for itself.

Client ---> Firewall (allows 80/443 only) --->| ---> Apache (80/443) ---> OpenVPN (1194) |
                                              --------------------------------------------
                                                           My Server

I was thinking about mod_proxy, but I am not sure if it is good idea, have you got any ideas?
I hope possible solution will be applicable on virtual host as well.

How can I protect serial console which if forwarded over RS232-Ethernet to WAN?
Is it possible? I was thinking about it, but I can't figure it out.
Is it possible to allow login through serial console only for specific user?

I am looking for strong cipher for LUKS, currently I am thinking about SHA512, but encryption is not my cup of tea, so could you give me your hints, what are you using for encryption?

I'm trying to set up default page for my apache2, for following cases:

1. User is accessing http://IP_Address instead of hostname
2. Requested protocol (HTTP/HTTPS) is not available (eg. only https://domain.com exists)

Currently I've got something like that

<VirtualHost eserver:80>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/local/
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
</VirtualHost>

I think, it works well, i'm trying to do similar thing for HTTPS, but it does not work.

<VirtualHost eserver:443>

       SSLCertificateKeyFile /etc/apache2/ssl/dummy.key
       SSLCertificateFile /etc/apache2/ssl/dummy.crt
       SSLProtocol all
       SSLCipherSuite HIGH:MEDIUM

       ErrorLog /var/log/apache2/error.log
       DocumentRoot /var/www/local/

       # Possible values include: debug, info, notice, warn, error, crit,
       # alert, emerg.
       LogLevel warn

       ServerSignature Off

</VirtualHost>

My default is places in sites-enabled as a first one 000-default
I do not care about not certificate validity during accessing default page, my goal is not show different HTTPS page if user one of points is applied

I'd like to use vi (set -o vi can do the trick) as default in my shell instead of emacs, but I do not want to put it into bash startup scripts.

Why? Because I work as verification engineer and I am using several user accounts, which are also quite often reinstalled. Changing of default profile is not answer too, because some of software creates its own home directory (independent on default profile).

EDIT: I know you gave me several ways how to do it at startup or anytime, but I do want to change it somewhere in system and have it as default, is this possible?

I'm curious if it is possible to mount a partition encrypted by cryptsetup with LUKS securely and automatically on Ubuntu 10.0.4 LTS.

For example, if I use the key for the encrypted partition, than that key has to be presented on a device that is not encrypted and if someone steals my disk they'll be able to find the key and decrypt the partition.

Is there any safe way to mount an encrypted partition? If not, does anything exist to do what I want?

I currently have LVM on software RAID, but I'd like to ask you what you think it is better solution, maybe some pros and cons?

Edit: It is about software raid on lvm or lvm on software raid. I know than hardware raid is better if we are thinking about performance.

just a quick question, I'm kind of confused.
I've had set-up my own certification authority and I can create requests and signed them. But, I'm not sure, what I need to give to Apache, currently I've got:

CA Private key
CA Certificate
Website Private key
Website Certificate
Website Certificate Request (I think I do not need it, but just to be clear)

Until today I was using snakeoil certificate, but I've decided to have more SSL services, than CA looks as good solution, so my Apache was configured well, but now I am not sure what I shall provide to apache in following rules:

SSLCertificateKeyFile /path/to/Website Private Key
SSLCertificateFile /path/to/CA Certificate

But than I got

[Mon Dec 27 12:09:33 2010] [warn] RSA server certificate CommonName (CN) `EServer' does NOT match server name!?
[Mon Dec 27 12:09:33 2010] [error] Unable to configure RSA server private key
[Mon Dec 27 12:09:33 2010] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

Something tells me than the warning is quite weird, because "EServer" is a common name of CA, so I think I shall not use CA Certificate in SSLCertificateFile, shall I?

Do I need to create Certificate from Website private key or something else?

Possible Duplicate:
What tool do you use to monitor your servers?

Can you tell which monitoring software runs on your linux boxes?
I know about Zabbix in my opinion looks quite well, but I'm opened to hear your hints.

Well, my idea is I would like to have access to grub over Ethernet/Internet, I've found two possible solutions:

1. Converter RS232 to Ethernet (1) which looks like to have its own live, I mean it is independent on computer, than I should be able to connect to serial console and do what i want to do
2. Use classic dial-up modem, than somehow convert it to Ethernet and than use it

Have you got any experiences with stuff like that? Any others suggestions? Or am I wrong? I've eliminated iLO because of price.