Home / user-80050

void.pointer's questions

Martin Hope
void.pointer
Asked: 2021-10-18 18:19:41 +0800 CST
  • 0

I'm using a Unifi UDM Pro as a gateway for 2 VLANs:

  • Main LAN (interface: br0, subnet: 192.168.1.1/24)
  • IoT Devices VLAN (interface: br3, subnet: 192.168.3.1/24)

Each has its own local DNS (Adguard Home) server (192.168.1.52 and 192.168.3.52 respectively). For each subnet, I want to prevent clients from bypassing the local DNS server assigned via DHCP. In order to do this, I SSH into the UDM Pro and execute these commands:


iptables -t nat -A PREROUTING -i br0 ! -s 192.168.1.52 ! -d 192.168.1.52 -p tcp --dport 53 -j DNAT --to 192.168.1.52
iptables -t nat -A PREROUTING -i br0 ! -s 192.168.1.52 ! -d 192.168.1.52 -p udp --dport 53 -j DNAT --to 192.168.1.52

iptables -t nat -A PREROUTING -i br3 ! -s 192.168.3.52 ! -d 192.168.3.52 -p tcp --dport 53 -j DNAT --to 192.168.3.52
iptables -t nat -A PREROUTING -i br3 ! -s 192.168.3.52 ! -d 192.168.3.52 -p udp --dport 53 -j DNAT --to 192.168.3.52

iptables -t nat -A POSTROUTING -p tcp --dport 53 -j MASQUERADE
iptables -t nat -A POSTROUTING -p udp --dport 53 -j MASQUERADE

I test these using two main methods: dig and via WLAN devices (e.g. iPad):

Using the dig method, I test first a direct DNS query and then one to a Google DNS server. I run both commands on the physical host for my DNS server (which is a member of every VLAN via the Debian vlan package):

  1. dig linux.org '@192.168.3.52' -b '192.168.3.52'
  2. dig linux.org '@8.8.8.8' -b '192.168.3.52'

The first command above works fine. The second one gives me a time out. I expect the second one to still work, except to be routed through 192.168.3.52.

If I run the same dig commands above but on the main LAN, both work fine and I can see both queries on my local DNS server.

I'm not sure why VLAN 3 doesn't work in the redirect case, but my main LAN does. Can someone help me understand why this isn't working and show me a working solution?

linux routing iptables unifi
Martin Hope
void.pointer
Asked: 2018-09-16 18:12:45 +0800 CST
  • 0

I am using nginx on Ubuntu 18 for a reverse proxy and HTTPS tunnel to those localhost services. Here's my site config:

server {
    listen 80;
    server_name my.domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    server_name my.domain.com;

    # add Strict-Transport-Security to prevent man in the middle attacks
    add_header Strict-Transport-Security "max-age=31536000" always;

    location /service1 {
        proxy_pass http://localhost:8989;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    access_log /var/log/nginx/my.domain.com;

    listen 443 ssl; # managed by Certbot
    # Other certbot stuff for signed HTTPS certificate
}

Basically when I go to https://my.domain.com, I don't want anything to show. I want it to be an error, as if the page doesn't exist. Right now it shows me "Welcome to nginx!". I have Googled ways of getting rid of it but I have had no luck. I completely disabled default under /etc/nginx/sites-enabled.

I only want nginx to serve https://my.domain.com/service1 and redirect HTTP to HTTPS, but I do not want any welcome pages to be served.

ubuntu
Martin Hope
void.pointer
Asked: 2011-10-21 07:27:32 +0800 CST
  • 27

I'm running Windows Server 2008 R2 in a workgroup, not a domain, and I want to create a local account that is only used for allowing other computers in the same workgroup to access file shares on that server.

When clients connect they will be prompted for a username/password (hopefully) and this account would serve as a way to allow them access.

I do not want this account to have a profile, or be used to actually log into the server itself. I only need it as a way to authenticate users for shared folders.

Can this be done? If not, what is the recommended approach for this?

windows file-sharing user-management windows-server-2008-r2
Martin Hope
void.pointer
Asked: 2011-08-12 04:55:45 +0800 CST
  • 3

I have a D-Link DGL-4500 and I've been using that for a long time as my DHCP server. I now have a Windows Server 2008 R2 machine plugged into it and I have set it up as a DHCP server.

I don't have 2 NICs on my server machine, so I still wanted to use my router as the main hub where all of my machines connect. The only thing I don't want the router to be anymore is the DHCP server, but I still enjoy it as a firewall.

Is there a way I can use plain old port forwarding or something similar in my router to forward DHCP requests from computers connected to it to my Windows server? My router doesn't have a "DHCP Relay" feature that I can see, I only have the ability to turn the DHCP server on my router on or off.

Help is greatly appreciated!

d-link windows-server-2008-r2 dhcp-server
Martin Hope
void.pointer
Asked: 2011-07-15 13:50:44 +0800 CST
  • 0

I have setup a RRAS server on my AD machine running WS2008R2. When I set the RRAS to use a static IP pool, I can connect from my VPN just fine (I'm connecting from the built-in VPN client in Windows 7). However, when I change my RRAS to use DHCP and configure DHCP Relay Agent to forward to my D-Link router (10.3.1.1), I get the following error in Windows 7 when I try to connect:

Error 720: A connection to the remote computer could not be established. You might need to change the network settings for this connection.

My goal was to delegate DHCP responsibilities to my router, since I don't want to install a DHCP server on this machine. Anyone have any idea what I can do to remedy this issue? Here is the corresponding error I get in my RRAS event log:

CoId={E0A1A0A2-6B0A-4B9B-B0ED-F0BE44166166}: The user DAILEY\robert connected to port VPN3-19 has been disconnected because no network protocols were successfully negotiated.

Help is greatly appreciated. If you need more information let me know and I will follow up with edits.

vpn rras windows-server-2008-r2
Martin Hope
void.pointer
Asked: 2011-07-14 13:56:54 +0800 CST
  • 0

I currently have Routing & Remote Access enabled, and in the properties dialog, under the IPv4 tab, I am able to select DHCP or Static address pool.

I currently do not have DHCP role installed on my server, so I don't know how it is sending out IP addresses to VPN connections that come in. I wanted to configure DNS suffix search list for VPN clients. Can I do this without installing the DHCP role?

Thanks.

EDIT

Here is my ipconfig /all command while my VPN is connected. Notice how the VPN connection doesn't have a "Connection specific DNS suffix". I don't know why this is.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : DTDEV7269w7
   Primary Dns Suffix  . . . . . . . : PACS.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : PACS.local

PPP adapter Home:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Home
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.3.1.21(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 10.3.1.120
                                       8.8.8.8
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : PACS.local
   Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit Network Connec
tion
   Physical Address. . . . . . . . . : 00-22-19-18-0A-C1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::4c61:160d:87c7:5bb5%10(Preferred)
   IPv4 Address. . . . . . . . . . . : 172.16.3.80(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, July 13, 2011 3:20:27 AM
   Lease Expires . . . . . . . . . . : Thursday, July 21, 2011 3:20:40 AM
   Default Gateway . . . . . . . . . : 172.16.3.254
   DHCP Server . . . . . . . . . . . : 172.16.0.42
   DHCPv6 IAID . . . . . . . . . . . : 234889753
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-15-37-9B-F0-00-22-19-18-0A-C1

   DNS Servers . . . . . . . . . . . : 172.16.0.56
                                       172.16.0.42
   NetBIOS over Tcpip. . . . . . . . : Enabled
vpn routing remote-access windows-server-2008-r2
Martin Hope
void.pointer
Asked: 2011-07-08 09:51:24 +0800 CST
  • 1

I run a small server on my home network that has Windows Server 2008 R2 installed. If I wanted to move this windows installation to a completely new PC with better specs, what's the easiest way to do this? Can I simply swap the primary drive to the new machine? I'd hope that Windows would boot up and recognize the new hardware and install new drivers for everything.

I run a domain controller, DNS server, and I setup VPN on my server. I want all of these settings to be retained.

migration windows-server-2008-r2
Martin Hope
void.pointer
Asked: 2011-06-30 12:02:27 +0800 CST
  • 1

So I'm connected to a Windows VPN and I want the following conditions to be met:

  1. I want my internet connection to tunnel through to the VPN's internet connection (i.e. I don't want to use the machine's local network internet connection)
  2. I want the DNS servers on my local network to take priority over the DNS servers from my VPN network

How can I set this up on Windows 7?

vpn domain-name-system windows-7
Martin Hope
void.pointer
Asked: 2011-05-02 09:23:58 +0800 CST
  • 5

So on my home network I run my own domain controller & DNS server. On my client machine (which is a member of this home domain), I connect to my work VPN and from that point my DNS messes up.

My internet works because I unchecked "Use default gateway on remote network", so that's not a problem. I also have explicitly set the primary DNS suffix of my NIC (Local Area Connection 2) to dailey.home.com, since that is the domain of my internal network. Ideally I don't want to manually set it, but I did it anyway because I thought it might help.

Before I connect to my VPN, my ipconfig /all for "Windows IP Configuration" looks like this:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Bob
   Primary Dns Suffix  . . . . . . . : dailey.home.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : dailey.home.com

When I connect to my VPN, then it changes to this:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Bob
   Primary Dns Suffix  . . . . . . . : dailey.home.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : dailey.home.com
                                       pacs.local

My router, which is my default gateway on my home network, has the domain name "router", which points to 10.3.1.1. When I type "router" into my browser (BEFORE connecting to my VPN), I correctly reach my router's HTTP firmware page.

After I connect to the VPN, I do NOT reach the firmware page. When I run a PING on "router", it no longer says 10.3.1.1, but instead has an IP address of 66.114.124.140, which I don't recognize.

In fact, when I try to use ANY local DNS name I have setup, such as computer names or the name of my printer, NONE of them work while the VPN is connected. The IP address is the same for all of them: 66.114.124.140. In fact, if I try a domain name that doesn't even exist, I still get a response from the same IP address.

While connected to the VPN, nslookup for my 'router' returns this (even for a fake domain name!):

C:\Users\robert>nslookup router
Server:  svitdc03.pacs.local
Address:  172.16.0.56

Non-authoritative answer:
Name:    router.dailey.home.com
Address:  66.114.124.140

With the VPN disconnected, nslookup for 'router' returns the expected results:

C:\Users\robert>nslookup router
Server:  server.dailey.home.com
Address:  10.3.1.120

Name:    router.dailey.home.com
Address:  10.3.1.1

Why is this happening? I don't quite understand. Below is the rest of my IPCONFIG results, with the VPN included.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Bob
   Primary Dns Suffix  . . . . . . . : dailey.home.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : dailey.home.com
                                       pacs.local

PPP adapter True Automation:

   Connection-specific DNS Suffix  . : pacs.local
   Description . . . . . . . . . . . : True Automation
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 172.16.0.196(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 172.16.0.56
                                       172.16.0.42
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . : dailey.home.com
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller #2
   Physical Address. . . . . . . . . : 00-1F-BC-01-55-34
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.3.1.31(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.128
   Lease Obtained. . . . . . . . . . : Sunday, May 01, 2011 11:25:58 AM
   Lease Expires . . . . . . . . . . : Monday, May 02, 2011 11:25:59 AM
   Default Gateway . . . . . . . . . : 10.3.1.1
   DHCP Server . . . . . . . . . . . : 10.3.1.1
   DNS Servers . . . . . . . . . . . : 10.3.1.120
                                       208.67.222.222
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Physical Address. . . . . . . . . : 00-1F-BC-01-55-35
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.dailey.home.com:

   Connection-specific DNS Suffix  . : dailey.home.com
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::5efe:10.3.1.31%12(Preferred)
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 10.3.1.120
                                       208.67.222.222
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{4827DF55-4B5E-405B-BE43-9B40BB4D7804}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.pacs.local:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : pacs.local
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
vpn domain-name-system