KCLUG August 2005

kclug@kclug.org

48 participants
62 discussions

RE: routing problem - fork on gateways
by Jeremy Fowler 06 Sep '05

06 Sep '05

> > So your router and firewall are two separate machines? > Seems redundant to me, most firewalls do routing as well. > The only reason you would need a router is if the firewall > wasn't on the same subnet. > > No, it's standard practice for the ultraparanoid. > > The idea is, if your outer wall is compromised, hopefully you can > limit the damage > before Kevin Mitnick gets all the way into your shorts. > > You might want to put a honeypot in there too. Not in this scenario. The firewall is on the SAME subnet as the router and hosts. If the firewall was compromised, there would be nothing stopping it from attacking the rest of the hosts. In order to establish a DMZ, he needs to place the firewall on a separate subnet off from the rest of the network for it to be secured like in my second example. He would need to VLAN off that connection as well, or use a separate switch not connected to the LAN.

4 6

Installing FC4 on new HD
by Jon Moss 01 Sep '05

01 Sep '05

I had a hard drive die a couple of weeks ago so I eBayed a new one and it arrived yesterday. I'm installing FC4 now. However, I wasn't paying attention (yes, I didn't RTFS) and went flying by the screen for DHCP or Manual IP. I wanted Manual IP. I also forgot to grab the memory out of the old server and put it in this one. Anyway, I know I can change the DHCP to manual when I'm done. But where/when will it ask me for the name of the server? Did I fly by that screen as well? -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 1

RE: Installing FC4 on new HD
by Daniel Siemens 31 Aug '05

31 Aug '05

In most version of Redat neat will let set everything you need. -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org] On Behalf Of Jon Moss Sent: Wednesday, August 31, 2005 5:46 PM To: kclug(a)kclug.org Subject: Installing FC4 on new HD I had a hard drive die a couple of weeks ago so I eBayed a new one and it arrived yesterday. I'm installing FC4 now. However, I wasn't paying attention (yes, I didn't RTFS) and went flying by the screen for DHCP or Manual IP. I wanted Manual IP. I also forgot to grab the memory out of the old server and put it in this one. Anyway, I know I can change the DHCP to manual when I'm done. But where/when will it ask me for the name of the server? Did I fly by that screen as well? -- Thanks very much, Jon Moss jon.moss(a)cnonline.net _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

1 0

RE: routing problem
by Kelsay, Brian - Kansas City, MO 31 Aug '05

31 Aug '05

The arp cache doesn't stay very long. Maybe a minute at most. IIRC DNS cache maybe, that lasts longer. Is your router doing DNS as well as DHCP? I ask because this is not default. You have to set both up separately or create a hosts file on each box. -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org] On Behalf Of hanasaki Sent: Wednesday, August 31, 2005 1:16 PM To: jason(a)stdbev.com Cc: Jeremy Fowler; kclug(a)kclug.org Subject: Re: routing problem working like a champ now! is it possible that there was something in the ip stack that had to timeout? I did manually arp -d the host3 entries and after a "ping" arp -a showed them with a MAC of "<incomplete>" whatever that means. Jason Munro wrote: > On 11:34:52 am 08/31/05 "Jeremy Fowler" <JFowler(a)westrope.com> wrote: > >>Default gateway for host1 is set to 10.1.1.2, change to 10.1.1.1 > > > Umm.. no. The default gateway is for any request outside the local subnet > and if 10.1.1.2 is the router out then this is correct. The routing table > for host1 shows that no gateway is required for 10.1.1.0/24 and that all > else (0.0.0.0) should be shoved out 10.1.1.2. > > >>host3 = 101.1.1.10 / mask 255.255.255.0 > > > If this is correct then this is the problem since 101.1.1.10 is not on the > same subnet as host1 and therefore requests are being sent out the router. > I wonder if host3 is actually online? If the above is a typo and host3 is > actually 10.1.1.10 then maybe you should try resetting the switch because > your routing tables look ok AFAIKT. > > \__ Jason Munro > \__ jason(a)stdbev.com > \__ http://hastymail.sourceforge.net/ > _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

2 1

RE: routing problem - fork on gateways
by Jeremy Fowler 31 Aug '05

31 Aug '05

> Most people don't have the code necessary to combine a > cablemodem with a > firewall... I don't understand what your saying here...

1 0

RE: routing problem - fork on gateways
by Jeremy Fowler 31 Aug '05

31 Aug '05

> Internet - cablemodem - 10.1.1.1 firewall > 10.1.1.2 router / squid / dhcp / email > all internal here > > by your convention, maybe .2 should become .254 > > everything is a linux box in the net > So your router and firewall are two separate machines? Seems redundant to me, most firewalls do routing as well. The only reason you would need a router is if the firewall wasn't on the same subnet. 10.1.1.1/24 10.1.1.2/24 (Internet) --- [ firewall ] --- [ router ] | | |---[ host1 ]---| 10.1.1.30/24 You can see here that you can get to the internet by going thru the router, but because the router and the firewall are on the same subnet, you can just go directly to the firewall. You just add an extra hop that is not needed and just eats up network and computer resources. If the firewall was on a different subnet, then you would need a router: 10.1.0.1/24 eth0: 10.1.0.254/24 (Internet) --- [ firewall ]-------------[ router ]-----------[ host1 ] eth1: 10.1.1.254/24 10.1.1.30 Here, host1 needs the router to reach the 10.1.0.0/24 subnet.

3 2

RE: routing problem
by Kelsay, Brian - Kansas City, MO 31 Aug '05

31 Aug '05

If you ever have to do this in Winders 2000 or XP, do "ipconfig /flushdns". It can be helpful. Entia non sunt multiplicanda praeter necessitatem. ---Occam -----Original Message----- From: kclug-bounces(a)kclug.org On Behalf Of Charles Steinkuehler Quite possible...I find: ip neigh flush dev eth0 helps a lot with this, especially when playing with proxy-arp settings! - -- Charles Steinkuehler charles(a)steinkuehler.net

1 0

RE: routing problem
by Jeremy Fowler 31 Aug '05

31 Aug '05

Default gateway for host1 is set to 10.1.1.2, change to 10.1.1.1 -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org]On Behalf Of hanasaki Sent: Wednesday, August 31, 2005 11:04 AM To: List - KCLUG Subject: routing problem host1 host2 and host3 are all connected to the same 10/100 switch. traceroute host3 <= from host1 hits host2, the router The goal is to skip the router and go directly to host3 since they are on the same subnet. thoughts? whats the issue? and fix? Thanks, ============= host1 = addr:10.1.1.30 / mask 255.255.255.0 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 10.1.1.2 0.0.0.0 UG 0 0 0 eth0 =============== host2 = addr:10.1.1.2 <= the router to the outside world Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 10.1.1.1 0.0.0.0 UG 0 0 0 eth0 ================ host3 = 101.1.1.10 / mask 255.255.255.0 _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

4 4

RE: routing problem
by Jeremy Fowler 31 Aug '05

31 Aug '05

> On 11:34:52 am 08/31/05 "Jeremy Fowler" <JFowler(a)westrope.com> wrote: > > Default gateway for host1 is set to 10.1.1.2, change to 10.1.1.1 > > Umm.. no. The default gateway is for any request outside the > local subnet > and if 10.1.1.2 is the router out then this is correct. The > routing table > for host1 shows that no gateway is required for 10.1.1.0/24 > and that all > else (0.0.0.0) should be shoved out 10.1.1.2. Umm.. host1 and host2 are on the same subnet, so why would they have two separate default gateways? The reason its going thru host2 is because 101.1.1.10 isn't on the subnet and so it forwards packets to host2, the default gateway. He doesn't want packets to go thru host2, so you change the default gateway. Standard convention places gateways on either the first or last address on the subnet range, in the case of 10.1.1.0/24 that would be either 10.1.1.1 or 10.1.1.254. So when I saw that a) the default gateway wasn't the same for host1 and host2 it caught my eye. and b) host two had a default gateway address at the beginning of the subnet address range, so I assumed it was correct. Try not to be so condescending with your replies, makes you sound like an ass.

2 1

RE: routing problem
by Jeremy Fowler 31 Aug '05

31 Aug '05

Is this correct? host3 = 101.1.1.10 or should it be: host3 = 10.1.1.10 -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org]On Behalf Of hanasaki Sent: Wednesday, August 31, 2005 11:04 AM To: List - KCLUG Subject: routing problem host1 host2 and host3 are all connected to the same 10/100 switch. traceroute host3 <= from host1 hits host2, the router The goal is to skip the router and go directly to host3 since they are on the same subnet. thoughts? whats the issue? and fix? Thanks, ============= host1 = addr:10.1.1.30 / mask 255.255.255.0 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 10.1.1.2 0.0.0.0 UG 0 0 0 eth0 =============== host2 = addr:10.1.1.2 <= the router to the outside world Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 10.1.1.1 0.0.0.0 UG 0 0 0 eth0 ================ host3 = 101.1.1.10 / mask 255.255.255.0 _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG August 2005