networking

[snow lance]

like does the bgp impact ping

[tame carbon]

no

[snow lance]

a lot or smth

hmhmhnhm

sounds complex indeed lmao

[peak cloak]

bgp changes the routes of routers

[tame carbon]

@snow lance they have a bunch of contracts with other ISPs and service providers.

The "Edge" router (big ass routers) compute all of these routes, into a routing table

[snow lance]

ahhh

[snow lance]

networking is complex

[tame carbon]

then it loads this routing table into the memory

[low pond]

but damn fucking interesting

[tame carbon]

@snow lance the actual routing of packets has to be really fast

so all those routes are pre-computed

[snow lance]

yeyeye I figured

however I must go now

[tame carbon]

it just looks at the IP, and finds the most specific network it matches for, and sends it out to there

[clear igloo]

you spelled fun wrong 😛

[low pond]

😂

I think we overwhlemed him.

[tame carbon]

@snow lance and BGP is the protocol used by all the different parties on the internet, Border Gateway Protocol. A mechanism for two edge routers to exchange routing information

[peak cloak]

bgp is the duct tape holding the internet together

[tame carbon]

exactly

[peak cloak]

and it relies a lot on trust

although now

[tame carbon]

Before BGP

most of it was OSPF

[peak cloak]

there are some security measures being put in place

[low pond]

RPKI validation mainly

[tame carbon]

I was taught OSPF in school

and then had to even implement my own, for a mesh network

self healing mesh network, with routing

using arduinos and nRF24L's

[peak cloak]

this is a pretty alright vid

https://youtu.be/K9gnRs33NOk

@snow lance

[thick minnow]

YES!, HALF AS INTERESTING

[tame carbon]

who let the pakistanis on BGP

[hollow marlin]

BGP predates OSPF by almost a decade if I remember. Before BGP it was basically RIP and static routes

[hollow marlin]

BGP is simple yet solid. The problem is not the protocol but the people handling them. No protocol has scaled to the level BGP has

[hollow marlin]

RPKI is the newest but prior and still the biggest route verification is RadB. A database that contains ASes and their advertised routes. Basically if we have a customer that wants to advertise their own space, for us to advertise it we have to register the subnets in RadB. This updates the database which updates the filters/ACLs on our peer routers and allows the advertised routes to be accepted.

Its basic but pretty effective. But if engineers are sloppy it leads to route leaks we have seen over the past few years

[low pond]

they did a mistake

[snow lance]

ah

[snow lance]

lmao

[snow lance]

oh ye ik that guy

but like if DNS services redirect you to the websites how do you make sure they're all the same

[peak cloak]

they don't "redirect"

wdym

[snow lance]

if I asked a DNS service hey can I have this URL how is it going to be uniform for all DNS services

[snow lance]

idk when they send you to website

[peak cloak]

also it's domain, not url

they are different

domain is part of a url

[snow lance]

huh

[peak cloak]

google.com is a domain

same with www.google.com

but https://www.google.com is a url

[snow lance]

ohhh but the thingi

yeyeye

ok well if I say I want this domain and they go ok

how will other DNS services know

[peak cloak]

ah

well for each domain name you have a nameserver

that's usually the domain registar

but you can change it

that server holds the records

[snow lance]

I am confusion

so the server has a name and you set that name to your domain?

[peak cloak]

kinda hard to explain

let me find something that will explain it better

[low pond]

How DNS works articles will work

[peak cloak]

https://www.youtube.com/watch?v=XeLnBkjdiGo

@snow lance this seems good

[snow lance]

thank will watch when home

[snow lance]

oh boi lmao

[snow lance]

@peak cloak wait if root and authorative servers are a thing, does that mean changing to a dns like those 1.1.1.1 ones do very little at protecting your website history?

[peak cloak]

those top level servers don't log much

changing dns is really to stop your ISP

[snow lance]

ah

cuz then it aint my isp who manages the dns querries?

[peak cloak]

yeah, then it bypasses your ISPs dns server

[snow lance]

ahhh ye

smart smart

but what about root servers, do they log your stuff?

the guy said they get like toooons of data

[peak cloak]

prob not

because of the VAST amount of data

[snow lance]

ah ye cuz it aint only users connecting right?

[peak cloak]

but idk

[snow lance]

hmmm

[peak cloak]

yeah even 1.1.1.1 (cloudflare) sends requests to the root servers

[snow lance]

yee that the one i use

is it good?

[peak cloak]

it's fast

they have a big anycast network

[snow lance]

ah nice

[peak cloak]

but problem is

when they go down

half the internet does lol

[snow lance]

lmfao yeah i saw them a lot of places

ohhh wait

[peak cloak]

at home what I have is my router has multiple upstream dns servers

and the router is acting as a server

[snow lance]

so thats why i saw IPs and when i looked them up it said it was cloudflarenet

wow

[peak cloak]

well cloudflare proxy is a different thing

[snow lance]

much advanced i see

[peak cloak]

not really

[snow lance]

to me it seems

[peak cloak]

most home routers run their own dns server

[snow lance]

[peak cloak]

not public facing of course

[snow lance]

wait so are they like

the root server for discord?

does discord have their own servers?

[peak cloak]

no, they are a proxy for discord

prevent ddos and such

[snow lance]

ahhh ye i have seen the ddos protection then when you go onto website

[peak cloak]

discord is actually ran in google cloud

[snow lance]

ahhh

wait does google log data from google cloud?

[peak cloak]

idk

[snow lance]

[snow lance]

but how come the dns always find the authorative dns server, will it sometimes just not work?

[peak cloak]

because of root servers

the root servers will tell the ips for the TLD servers

iirc

[rocky badge]

https://www.iana.org/domains/root/servers

Root hints

[snow lance]

ahh

[peak cloak]

then TLD (.com, .net, etc.) will have the nameserver for that specific domain

[snow lance]

ye i saw tghat iana thing in the video he sent me

[snow lance]

ye wasnt it verisign

for those 2

[peak cloak]

then the nameserver (whatever you have it set as) will be used for queries

[peak cloak]

maybe

but each TLD may be different

but that's the purpose of the root servers

[snow lance]

ahh ye

smart

is this networking stuff

[peak cloak]

communications, so yeah

[snow lance]

is it c the same?

ohh wait the c stand for communication right

oh wait nvm

thats just the level lmao

well pogness i guess ill have networking when i start in college after summer lmao

[peak cloak]

you can always learn now

[snow lance]

myes get that A+

[peak cloak]

from what I heard

lots of university classes are pretty outdated

[snow lance]

oh 😂

oof

cuz the teachers dont learn the newest shits?

[peak cloak]

I guess, idk

still network classes

classless is the standard now

[snow lance]

welp ill only have it for 1 year and i aint gonna do networking stuff i think lmao

thats stupid doe

[peak cloak]

what degree?

[snow lance]

wdym degree

oh which kind of thingie thing im choosing on the college?

[peak cloak]

when you go to uni, don't you have a major/degree

ye

[snow lance]

huh this is not uni

its the 10-13th year

[peak cloak]

oh

[snow lance]

lmao

well i chose the computer science one

if thats what you thinking about

[rocky badge]

if you're not paying for it

why not take it

[snow lance]

indeed i am not

[rocky badge]

its free, you'll gain something if its good and if its shit, you didn't pay for it

[snow lance]

the college or networking learning stuff?

[rocky badge]

whatever you posted above, if that's not in the college but whatever school you are in right now

[snow lance]

rn i am in high school mine doesnt have any networking or tech classes

[rocky badge]

oh, nvm then lol

[snow lance]

ye lmao but i am going to HTX college which is technical college so more tech goodness

[peak cloak]

wait then what's 10-13

[snow lance]

college

[peak cloak]

that's uni/college then

[snow lance]

yes

we have like the normal school which is a requirement its 10 years from 0th to 9th class

[peak cloak]

huh

HS is 9-12

then college is 12+

[snow lance]

0-3 is "inschool", 4-6 is "middle step", 7-9 is "outschool" then different building (gymnasium) is 1-3g, and then uni

[snow lance]

oh well if you count kindergarten too ig college is 12+

oh new logo just changed lmao

[peak cloak]

huh

kindergarden here is technically grade 0

[snow lance]

the huh

[peak cloak]

then 1st - 5 is elementry

[snow lance]

whats before kindergarten?

[peak cloak]

6-8 is middle school

[peak cloak]

nothing mandatory

there's preschool

if you want

[peak cloak]

this varies between school district

for example elementry for me was 1-6 and middle school was only 7-8

but HS is always 9-12

[snow lance]

oh yeah i dont think preschool is mandatory here

[snow lance]

hmm

im guessing im going to high school then? 😂

shits confusing

we call it gymnasium here

[peak cloak]

poland?

[snow lance]

denmark

[peak cloak]

ah

same name in poland for HS

[snow lance]

ye lmao

ahh

welp high school here is 11-14 actually

lmao

[thick minnow]

Hey , if anyone uses apache2 webserver , can you please dm me I need some help

[peak cloak]

don't ask to ask

just ask

[thick minnow]

Basically my website has 2 pages, home and contact , they are in 2 separate html files , how do I host them , and how do I set up a domain

I'm sorry I'm pretty much a noob to hosting

[plain siren]

First you need a Domain.

[peak cloak]

if it's just a simple home.html, contact.html that's ez

[plain siren]

Then you need somewhere to host said files + webserver

[peak cloak]

I reccomend nginx tho

not apache

[thick minnow]

I would first like to try it just on my local network

[peak cloak]

you don't need

[peak cloak]

yeah that's fine

[plain siren]

You can use IP's instead of a Domain to do some testing

[peak cloak]

you can even use local domains

[thick minnow]

I have apache set up on my raspberry pi 3b+ , and yeah I can use nginx , apache is the first thing I got

[peak cloak]

sudo apt install nginx

[thick minnow]

Yeye I've worked with Linux

[peak cloak]

I'm going to assume nginx for the rest, make a folder in /var/www called your website name for example /var/www/mysite

[thick minnow]

Oke , then?

[plain siren]

server {
    root /www/data;

    location / {
        index index.html index.php;
        try_files $uri $uri/ $uri.html =404;
    }  
}

[peak cloak]

put your files there

change home.html to index.html

index will be the main page

[plain siren]

Well i mean you could uh

[thick minnow]

That makes sense

[plain siren]

index home.html index.html index.php;

[peak cloak]

technicaally

yes

[thick minnow]

Will it automatically redirect to contact from the button on home?

[peak cloak]

after your done with that, go to /etc/nginx/sites-enabled

[peak cloak]

depends on the href

what does the button link to

/contact?

[thick minnow]

Umm

Idk rn , I'm in bed , I can try tomorrow morning

I just turned off my setup and pi

[peak cloak]

ah

[thick minnow]

I can't inspect it on phone for some reason

[peak cloak]

so link needs to be href=/contact iirc

you made this in some website maker software I assume

[thick minnow]

Yeah

[peak cloak]

it shows

[thick minnow]

I do know html

I was lazy

[peak cloak]

I mean, basically all big websites are not written in pure html anymore

[thick minnow]

This one is just for testing final would be a lot better

[thick minnow]

True

[peak cloak]

it's all frameworks and stuff

[thick minnow]

Hmm

Ig I'll try stuff tomorrow morning

[peak cloak]

linux?

java -version

I think

use linux if it's a old pc

not windows 10 of all things

clearly it's not the latest java version

what specs, just curious?

[clear igloo]

You need to download java 16 not 8

https://www.oracle.com/java/technologies/javase-jdk16-downloads.html

[peak cloak]

he said it was latest

that's 8

[clear igloo]

16 and 8 are different builds

[peak cloak]

not if you really want to

your choice

[clear igloo]

Just download java 16 from the link, it's right there =/

[peak cloak]

^

https://www.oracle.com/java/technologies/javase-jdk16-downloads.html

[waxen scroll]

@hollow marlin @clear igloo i cant believe i just watched a 20min sponsored video on LTT

lol

i also got triggered cause work management software

thx JIRA

[thorny vector]

There are few things as satisfying as homelab web pages having that little lock icon

https://giphy.com/gifs/gutearbeitoriginals-perfect-top-l3q2LH45XElELRzRm

[mellow fox]

Hi Y’all I’m looking for a Unifi Dream Machine but I’m on a really tight budget. I’ve been trying to get a couple from eBay (used or new) but I usually end up in a bidding war for a used item for the same retail price. I was wondering if anyone knew where I could buy one for a bit cheaper? Thx in advance

[thick minnow]

I installed nginx but i need to stop apache for it to work , How do I do that? @peak cloak @plain siren

[lean pebble]

systemctl stop httpd && systemctl disable httpd

Do you want nginx to work as the main web server or as proxy ?

[thick minnow]

main

[lean pebble]

so the 2 commands I already sent

[tame carbon]

Another reason why Teams is so garbage

it automatically pauses any music playing, when a call starts

and then resumes the music when call ends

there's no way to disable this stupid behavior

[thick minnow]

Funny, that hasn't happened to me

Perhaps because it won't update for me

[snow lance]

waht are all the malicious things someone can do with your ip and is it a big deal

[thick minnow]

'cause I had to self-sign the package to allow for vcam support. WHEN WILL YOU GIVE ME VCAM SUPPORT microsoft team.

[peak cloak]

DOS, or ddos I guess. Also if you haven't secured it, just scanning and seeing for vulnerabilities

People overreact

It's not too big of a deal

If you are hosting a service then ddos is more likely to happen

Like

[snow lance]

so ddos is the most malicious thing?

[peak cloak]

Wow I have your ip, now what. I can scan it, if there is nothing open, eh whatever

[thick minnow]

I mean you could also threaten non-techie people

[peak cloak]

If have thinga open in the firewall that your shouldn't are are insecure, then that I would say would be the most malicious

Someone could get access

[snow lance]

lmao aight

ye

i have port 25565 open am i vulnerable

[peak cloak]

To ddos, yes

[snow lance]

why so

[peak cloak]

Also I have everything that is hosting something on a seperate isolated network

[peak cloak]

It's an open port

Someone could DOS or ddos you

[snow lance]

yeah but what can they do

[peak cloak]

Take your service down

[snow lance]

what difference does it make from ddosing the router to ddosing my pc

[peak cloak]

DOS is kinda ez to mitigate

[snow lance]

whats dos?

is it just ddos in a different way?

[peak cloak]

Denial of service

[thick minnow]

Disc OS.....
/s

[peak cloak]

Ddos is distributed denial of service

DOS comes from one other device

[snow lance]

ah okay

but theyd need my local ip too right?

[peak cloak]

https://wiki.mikrotik.com/wiki/DoS_attack_protection

[peak cloak]

No

[crisp bay]

hey, so I have set my local server static IP address using netplan and when I try to change it, it doesn't apply a new one (sudo netplan apply), even after reboot...any help would be appreciated

[snow lance]

why?

[peak cloak]

since you port forwarded

[snow lance]

but then they only ddos the router right

[peak cloak]

no

[snow lance]

when i port forward do they get my local ip?

[peak cloak]

port 25565 is forwarded to your pc

[peak cloak]

no

[snow lance]

ahhh ye

[peak cloak]

this is all assuming ipv4

[snow lance]

so whats the difference between ddosing my router and ddosing me

[peak cloak]

ipv6 is different

[snow lance]

its ipv4

[peak cloak]

the router would need to be hosting a service

[snow lance]

wdym

[peak cloak]

need to have an open port to ddos

you need to understand how a ddos/dos works

it works by sending many requests to a device

[snow lance]

yes ik

its send lotta bullshit

[peak cloak]

but it needs something to send them to

[polar trellis]

do you still use ipv4?

[snow lance]

oh no jelle here

lmao

[peak cloak]

lots of people still do

[snow lance]

yes

[thick minnow]

I'd say most of the world still do

[peak cloak]

dual-stack is the standard now

verizon fios still has no native v6

@snow lance https://help.mikrotik.com/docs/pages/viewpage.action?pageId=28606504

[polar trellis]

yes -_-

[snow lance]

ah but if you ever get ddosed you just call isp and get new ip and its all good right lmao

[polar trellis]

ik

[peak cloak]

kinda

isp usually has ddos measures as well

[polar trellis]

but if there is a security problem, the network could be accessed,

[peak cloak]

not with a ddos

[polar trellis]

no but because he has my ip he could scan

[peak cloak]

yes ofc

but you should everything secure

not security by obscurity

[peak cloak]

#networking message

[polar trellis]

access the nas, when a error in the security is found etc

remote into my computer

[peak cloak]

I mean

depends

it's not that simple

is your NAS port forwarded?

are you exposing rdp directly?

[snow lance]

[peak cloak]

if you are, that's your problem

[polar trellis]

idk, my dad has the most important nas, and my own one isn't

but no, traffic coming from outside is blocked

and everything is getting logged

[peak cloak]

I'm often suprised by how much is open

[peak cloak]

everything?

doubt it

[snow lance]

oh yeah i noticed this in my router settings is it any good against blocking ddos?

[polar trellis]

my father works in the ICT fixing ddos attacks, phising, etc. he teaches me te be carefull af with IP's etc, and is now teaching me how to do networking

he knows how to keep stuff save

[polar trellis]

yes

[low pond]

that's isnt much actually, it doesnt do much

[snow lance]

i figured

[peak cloak]

must a bit of storage

and then it rotates

[polar trellis]

well, it get's deleted after a something like a month

[peak cloak]

that itself won't do much probobly

[snow lance]

yeah its not a mikrotik or smth omegalul

[low pond]

That's not the only reason, DDoS protecc is complicated than that

[snow lance]

yes ik its a joke

plz dont kill me

[low pond]

A good router is not all you need to protect from any ddos xD

[peak cloak]

an actual ddos needs a bit of bandwidth for mitigation

doesn't cf now have free argo tunnels

[low pond]

Id expect it to be superUnrealible™️ because its CloudFlare™️

[peak cloak]

https://blog.cloudflare.com/tunnel-for-everyone/

[polar trellis]

but I'm gonna inform me father that me ip got leaked, and we'll see what to do then... (I don't know whit about networking btw, only basic stuff)

[low pond]

Unless you dont get hit nothing will happen 🤷‍♂️

and even if you do get hit, then you can take actions, is it a dynamic ip or something

[polar trellis]

I believe it isn't, but the router ofc does support it, and the internet provider also could change it

[low pond]

Like a simple reboot won't change the IP's?

[polar trellis]

no

that's turned off

[peak cloak]

if you have business internet

most have ddos protection

[peak cloak]

doesn't for me

that's on the ISPs end

not on router

how long the lease is basicaly

[polar trellis]

I don't really care about DDOS, it's just a home network, it would just be switching everything off and on again. we don't have servers running...

I care more about the possibility that someone would remote into my computer once they are in the network

[low pond]

I mean who di'ja get it leaked too, man there's a lot of skids out there really who just threathen but do nothing

[low pond]

that'd require a serious vnurl on windows or something

[polar trellis]

because that would be easy, a simple ssh would do it

[peak cloak]

you can't really get access into the network if you have everything from WAN blocked

[low pond]

yeah this too pretty much, they can only hit your router, you need to forward the damn ports for it to actully interface to the devices in it

[polar trellis]

yes, but nothing is water tight

[peak cloak]

unless you click on something and then some reverse tunnel is made to the attacker

but that's on a user level

not really network

[snow lance]

you have ssh open?

[polar trellis]

perhaps

[snow lance]

lmao i see now

[slow pivot]

A DDOS attack sucks but it is only "temporary". For defense against remote attacks it is far more likely to come from a virus or some other malicious site/software than an IP-based external attack

[polar trellis]

do you get why I'm freaked out?

[snow lance]

yes lmao

[low pond]

well, is the ssh secured enough? you dont use root and root as the user and password like i do to my machine right?

[snow lance]

let me just sudo rm -rf /

[peak cloak]

do you have key auth?

or password auth

[thick minnow]

It would only work should they havve his password, right?

[polar trellis]

such funny

[snow lance]

idk i dont have ssh open

[oblique linden]

Which. y'know, isn't unheard of: https://en.wikipedia.org/wiki/EternalBlue

[peak cloak]

well yeah, but you shouldn't use password auth

use key auth

[snow lance]

how to send ssh?

[peak cloak]

and secure the key

[thick minnow]

That reminds me, I should probably turn off ssh on my VPN server

[peak cloak]

by setting a passphrase on the key

[low pond]

If it's pretty much key'd auth and your root is also disabled then its pretty secure. so many cloud VPS's have their SSH open on normal ports and dont get hacked, only if ya stop root fully and use keys

[thick minnow]

So, it goes ssh with key, use password to use key

[polar trellis]

yes, but I can be pwned without knowing, and brute forcing could also be done, even though it's a bit extreme

[peak cloak]

thing is

you don't use password auth

[polar trellis]

wdym

[slow pivot]

Yeah, can't brute force a key

[thick minnow]

Probably should be using a key

[slow pivot]

Or at least, mere mortals can't

[peak cloak]

ssh with key, then the key is encrypted with with a password you need to enter to decrypt it

[peak cloak]

you use key auth

key auth can't be brute forced

[polar trellis]

ok I'll do that

[peak cloak]

https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server

well yeah

[thick minnow]

Not unless you decide to dump that private key onto the interwebs

[peak cloak]

secure your priv key

thats why you use a passphrase on it too

[polar trellis]

I'll save it in a txt on my computer 😂

[snow lance]

jelle whats your username on your pc

[polar trellis]

it's not funny stfu

[snow lance]

yes it is

[polar trellis]

fuck you

[low pond]

he doesnt even have your public ip. why scared.

[polar trellis]

he does

[snow lance]

i used to

[thick minnow]

wow

[oblique linden]

If you're worried about having ssh open on your LAN, you might also consider only starting it up when you actually need it, shut it down when you don't, and use a non-standard port for it.

[polar trellis]

well, yeah, I'll do that

[oblique linden]

That's what I do for quick config changes on my tablet for example.

[polar trellis]

I see, I'm feeling stupid I didn't think of that myself

[oblique linden]

Bah - few how-to's contain advice like that beyond "this is how to get it running".

[thick minnow]

Hmmm, I feel like I've seen you before, AngryAnt. . . . . .. .. .
Eh, must be a coincidence

[peak cloak]

on lan, I have ssh open

no worries about that

[snow lance]

if i have ssh open and whitelist my phone thatll be safe right

[polar trellis]

I never looked into it much

[snow lance]

how to

die

[oblique linden]

I wouldn't be too worried about it either, but it seemed to be the core concern in play here.

[polar trellis]

like I said, if someone tries to enter from outside the network, it'll be blocked

[peak cloak]

no, it was opening to WAN

[oblique linden]

Ooof

[snow lance]

id close port 22 before i sudo rm -rf /

lmao

[polar trellis]

how many times have you made that joke?

[snow lance]

twice

[polar trellis]

-_-

[snow lance]

-_________________________-

[oblique linden]

SSH for anything on WAN is a really bad idea. I would definitely try to solve whatever use case is covered by that via some other service.

VPN'ed or not.

[low pond]

my SSH is always open technically 🤷‍♂️ I get v6 so it's open

[peak cloak]

no

ipv6 != open

[snow lance]

so if i do this but for ssh then id be lan right

[peak cloak]

you still have a firewall

you should at least

[low pond]

It's opened all thru 😛

[peak cloak]

bad

[snow lance]

how to

die

[peak cloak]

why, vpn and then ssh. Pretty secure

[low pond]

I did no config at all, I by mistaking had my IP on my clipboard and was on a VPS, I pinged it thru and was like "wait, wut?!" and realized even ssh works :P

[peak cloak]

router had no firewall?

fin was talking about this before

[low pond]

Nope, I'm pretty sure I did no config whatsoever. It just works

[peak cloak]

isps rolling out v6 with no firewall on default routers

[polar trellis]

that something works doesn't mean it works well

[low pond]

and my distro right now also has no firewall tool too, firewalld or other thing

[oblique linden]

Because you're risking the whole castle on the strength of the walls - leaving complete access for anyone who finds a way over the wall. Obviously it depends what your threat model looks like, but if the option is there to minimize the maximum possible damage on the inside, why not take it?

[peak cloak]

well yeah, but everything is a risk if you look at it that way. I have wireguard as my vpn, you need a key for that, not even password auth. Then you need a key for ssh

[oblique linden]

SSH is just such a massive sledgehammer fix for use cases.

[peak cloak]

ssh is pretty secure

right?

[low pond]

It is pretty much, its already encrypted

[oblique linden]

It is pretty secure, yes.

That doesn't make it invulnerable though or, more likely, at risk of mis-configuration. All I'm saying is that if some service with less all-reaching access could solve the concrete use case you're looking to have solved, I would definitely go for that.

It sort of falls in the same category of IOT devices on separate networks vs. on the same network as your valuables. Splitting them up is a pretty good idea, but not doing so is probably fine too.

[tame carbon]

The problem with IoT devices is that they are:

1. Poorly secured from a webservice standpoint (exploitable APIs or front-ends with poor security)
2. Phoning home to cloudprovider X

[magic python]

is OpenVPN a protocol as well as a software?

[tame carbon]

OpenVPN is trash

[magic python]

this is more for a documentation rather than exploitation

[peak cloak]

yes

[magic python]

yes it's a protocol?

[peak cloak]

but wireguard is better imo

[tame carbon]

OpenVPN is its own protocol, with associated software

Its a client-server protocol

[magic python]

aaah i see

[tame carbon]

The implementation of this protocol is the OpenVPN software

same with wireguard

[magic python]

so it doesn't use pptp l2tp or any of the sort?

[tame carbon]

no, OpenVPN is entirely done in software

[magic python]

i see

[peak cloak]

same with wg

[tame carbon]

yep, they are on the IP layer

@magic python there's a difference between say: wireguard, openvpn and the classic tunnel protocols like L2TP, PPP, PPTP

the latter protocols, create a layer 2 tunnel

wireguard and openvpn are layer 3 tunnels

l2tp can be used with ipsec, to provide encryption

[magic python]

hmmm

not quite sure i understand it all

[tame carbon]

@magic python do you know what Layer 2 and layer 3 means?

Or what data encapsulation is

[keen urchin]

hahahahahahahahahaha

[magic python]

the iso layers sure

encapsulation no lol

[tame carbon]

OSI

[keen urchin]

openvpn is openvpn

lets be honest, everything is encapsulated to hell these days

HTTP is treated as a transport layer.

[tame carbon]

Its a TCP protocol yeah

stuff beyond layer 4 is kinda irrelevant from a networking perspective

@magic python layer 2 describes ethernet, a way to exchange ethernet frames between connected computers

[keen urchin]

except when it isn't

[tame carbon]

@magic python you can put an IP packet inside an ethernet frame, and send it forward

There are more protocols besides IP, that can be used with ethernet

L2TP creates an ethernet tunnel, allowing you to use features, you wouldn't otherwise be able to use, on an IP-only tunnel

[keen urchin]

openvpn over ssh port forwarding over openvpn for greatest encapsulation

[tame carbon]

@keen urchin openvpn has higher latency, as well as more CPU load

[keen urchin]

obviously

[tame carbon]

same with ssh

thats why: wireguard

optimized encryption routine, get much higher throughput

I still use l2tp/ipsec over here, just cus my router has hw acceleration for it

[keen urchin]

that's cool. I mean, openssh is pretty clunky

[tame carbon]

openssh is amazing for the features that it gives you

its the swiss army knife when it comes to fixing things over the network

[keen urchin]

looks like wireguard is basically a modern implementation of the same core concept

[tame carbon]

set up tunnels on the fly, transfer files, run programs, :)

[keen urchin]

run rsync

[tame carbon]

rsync is ssh

[keen urchin]

no, rsync is rsync

[tame carbon]

or rather, it can use ssh as one of the source/drains

[keen urchin]

no it uses ssh as a transport

[peak cloak]

rsync runs over ssh

same as scp

[keen urchin]

rsync CAN run over ssh

it also has its own protocol

[tame carbon]

it can also do ftp

rsync like many things in linux, is pluggable

you can attach any sort of filesystem or directory you want

sshfs ❤️

[keen urchin]

for our offsite backups, I rsync them to an EC2 instance, which copies them to s3, because there's not enough bandwidth/time to get them all to s3 otherwise

The worst was when the new version of sftp assumed quiet in batch mode, and my automation layer that used sftp failed silently, which was fantastic. Fortunately I was able to patch it, and the maintainer also modified it, so newer versions are now fixed.

[tame carbon]

@keen urchin I don't use sftp for automated things. scp's interface is better suited for scripting

[keen urchin]

yes and no - for b2b integration, you need sftp

(which is what this is for)

[tame carbon]

sftp is for interactive use, or at least, that's what Ive always used it for

[keen urchin]

I've used sftp to integrate file transfers with... many businesses

[tame carbon]

'ye 'ol scraper

[keen urchin]

well that was what I started with

but then I changed to batch mode, and grab the output

[tame carbon]

I've made lots of money from small scraping scripts lol

4 hours work, 800 bucks

[keen urchin]

so there's no integration as such - it runs, and it either succeeds or fails

haha, my best was $3k for 4-5 hours work. had to flash a whole bunch of physical devices, and it was a huge pita and took ages. Automated it with AHK and was done quickly

[tame carbon]

oh I do that on the side !

laptop SSD upgrades

those are ez money

with 0 effort

clonezilla and then just wait

swap out the drive, and give them the old one, as backup, should the ssd upgrade cause unexpected problems

[keen urchin]

ah yeah I don't do anyones personal stuff except myself and immediate family 🙂

[tame carbon]

yeah

I need a tshirt that says: Yes I am a programmer, No I will not fix your computer

programmer, noun.
see: genious, magician

[keen urchin]

I literally have a mug that says "no I will not fix your computer"

[tame carbon]

nice

@keen urchin do you have a network whip?

[keen urchin]

haha, I'm not into that

[tame carbon]

https://www.getdigital.eu/lart-network-whip-cat5-o-nine-tails.html

[keen urchin]

yeah I know it

I prefer the classic etherkiller

[tame carbon]

lol the one with mains voltage?

[keen urchin]

I decided I wanted to be a sysadmin after reading BOFH

way back in the 90s

[tame carbon]

I drifted into that seat lol

someone has to maintain servers, and if nobody can do it.. I'll do it ¯_(ツ)_/¯

[keen urchin]

late last year I made our website 10x faster over a weekend

it was pretty intense, but I got there

[shadow garden]

i need some guidance, is 8 gigs for a 30 person vanilla (no bukkit or any of that) minecraft server (me and a few friends, and some friends of friends) running ubuntu good?

[thick minnow]

if theres 30 people id say at least enough ram for 1 gig each

but im not sure

[peak cloak]

just plain vanilla jar?

you should use something optimized like papermc

[shadow garden]

yeah just the vanilla jar

[peak cloak]

vanilla jar may have trouble

[peak cloak]

use papermc

it's better

[shadow garden]

what’s bad about the vanilla jar?

is it horribly broken?

[peak cloak]

unoptimized

not multithreaded

papermc atleast does some multithreading

[shadow garden]

Oof

[low pond]

MCMT does a bit better multithreading

You can get normal forge and install MCMT

https://github.com/jediminer543/JMT-MCMT

[peak cloak]

forge is a pita

[low pond]

Well it's only a single mod here, and it's worth it because it kind of does actually does decent multi threading

[shadow garden]

also on a more real world application, is MoCa any good for getting an ethernet connection to other rooms if the only line is coming from outside?

like, would I be able to take advantage of the gigabit internet I’m paying for if I used moca?

[peak cloak]

yeah moca 2.0 can do 1 gig (idk if duplex) but moca 2.5 can do 2.5 gig

I myself have no experience with it

[shadow garden]

aight thanks, i’m just tryna figure out the networking situation at the place i’m moving into, while keeping any modifications to a minimum beyond the ISP running the fiber to the unit and an ethernet line into the place.

[peak cloak]

moca is expensive tho

50 bucks or more for each end

[shadow garden]

ik

[peak cloak]

just run ethernet if you can

[shadow garden]

i cant tho

[peak cloak]

rip

[shadow garden]

well i COULD, if the landlord approves of me destroying the wall to run one cable to a switch in my bedroom or wherever. But I’d rather not.

powerline seems good if it weren’t for the bulky adapters and high latency (house is around 100 years old)

so i’m probably just gonna stick to moca and pay the price for (from what others say, anyways) close to Ethernet performance. Besides, even if it doesn’t work I could always use the ax wifi card I installed into my desktop, but again I’d rather not unless moca proves to not work or to be too cumbersome.

[topaz mirage]

What does this mean?

Is my NFS share only open to 192.168.0.101 or more than that?

I would want my NFS and SMB share from my NAS to be avaliable to only 2-3 clients I have...
(101, 108 and 145)

Manual page didn't clarify much...even after translating it's a mess for me 😄

[lean pebble]

/24 is for all the network from 101 to 254

[topaz mirage]

Oh, okay. THats bad.

Thanks

[peak cloak]

no

[lean pebble]

192.168.0.101 - 254.
For all the network...

[peak cloak]

no

depends on the context

[lean pebble]

I would open each IP address to the nfs with /32 at the end of it.
192.168.0.101/32
192.168.0.108/32
192.168.0.145/32

[peak cloak]

do you even need the CIDR

[lean pebble]

Actually no

[peak cloak]

exactly

[lean pebble]

I used to work with nfs at my work for backup servers never used cidr

[clear igloo]

/24 for that network is 192.168.0.1 through .254

Specifying an IP like OP did just saves you having to put in the subnet mask 255.255.255.0 elsewhere

[peak cloak]

I mean if it's just something like an IP whitelist it doesn't need the subnet right?

[clear igloo]

depends on how the whitelist is setup, most of the time an ACL will want a subnet or inverse mask unless you specify it's a host. With single hosts you shouldn't need it but it might, all depends on the app

I know on cisco CLI for example an ACL with the host keyword is just shorthand for using 255.255.255.255 or /32 (ipv4 of course)

but other applications and whatnot I've used (such as DNS addresses) you just do a CSV input of values for those hosts

[topaz mirage]

So /24 or /32 or nothing?

[peak cloak]

in what context

[clear igloo]

Depends on how you want to subnet and the host range

[peak cloak]

it's an NFS share

[clear igloo]

Yah but you could do /28 depending on the host range and bit boundary is what I was getting at

At Tomini

[topaz mirage]

I have no idea what you are talking about

[clear igloo]

You asked /24 or /32 or nothing with no context, there are other subnet masks larger or smaller you can use

[topaz mirage]

I want my three clients to be able to access NFS (and SMB) shares

Nothing less and nothing more.

[clear igloo]

well then you'll need to do /32 for hosts

[peak cloak]

or just no CIDR, how I understand it

[clear igloo]

Haven't done host limits on smb before so I can't say for sure

[topaz mirage]

Could you explain why /32?
r/ExplainItLikeImFive

[peak cloak]

@topaz mirage what software is that

[topaz mirage]

Forget SMB, not NFS only.
As SMB needs login credentials and NFS doesn't and is open.

[topaz mirage]

OpenMediaVault

Running in Linux.

[peak cloak]

there

we needed documentation

https://openmediavault.readthedocs.io/en/5.x/administration/services/nfs.html

[topaz mirage]

So I will need to do multiple shares?

...per client

[peak cloak]

imo if I were you, I would use the linux firewall instead

[topaz mirage]

Oh, okay...

I will take a look

Any guide I should check out first?

[topaz mirage]

Yeah and for now until I set the firewall... with or without /xx

[peak cloak]

the CIDR aka the / is used to set a range of ips to be allowed. For example you have a whole 10.0.0.0/8 network but you only want 10.1.1.0 - 10.1.1.225 to be able to access it, then you would put 10.1.1.0/24

I don't think there is a way to do it they way you want to, since it says once entry is allowed

so you can't input multiple ips

but if you could you would just list the whitelisted ips without the /

[topaz mirage]

I can make multiple identical shares with different IPs

[peak cloak]

seems like a hacky workaround, but go ahead

[topaz mirage]

For NFS...I will only need once client. I can use SMB on the rest two.

So single IP without CIDR

[topaz mirage]

Yeah. More like ghetto/whacky

[peak cloak]

yeah

[topaz mirage]

Still can access the share without /24 on wanted device. Good.

Now I"trying without insecure

Interesting. Can't access the share without insecure option

[thorny vector]

Sounds like a tls issue

[lean pebble]

You can use nfs for windows to, nowadays windows finally support nfs share

I know that windows 10 pro have this option. (From what I saw on my windows 10 pro vm)

[topaz mirage]

Yes, it has. But I have Home Edition 😄

...and I think I cant upgrade without reinstall

[lean pebble]

I think home edition have it to

[topaz mirage]

It does not

But I don§t need NFS on PC. I use NFS mainly for Kodi as it has bad overhead and bad performance with SMB

[thorny vector]

Just gotta tune the samba stuff

[lean pebble]

Yeah only works on pro and up

I use smb on Linux because my storagebox in cloud only supports this , webdav, ssh, sftp , ftp and ftps.
SMB is annoying sometimes when it gets disconnected without alerting me with the system mail I setuped

[topaz mirage]

Doubt. I read so many forum posts with people trying...I don't see a point in it anyway for SMB. SMB is Windows protocol anyway...

[topaz mirage]

That's understandable. FTP is kinda cr*p.

[lean pebble]

Yeah

[thorny vector]

It's all in the tuning, and its not necessary for most. I have my tuning doc with my setting lying around somewhere

[topaz mirage]

I dug through Kodi forum and found no solution. It works on NFS...dont have any feature that SMB can offer.

The access time and even bandwidth is really bad.

[thorny vector]

You wouldn't find it there. More likely to find it on redhat forums, stuff like that

network arch places

and I get full gigabit to my samba share from my windows. It's really just fine

No offense to kodi users, but for more technical configurations, that's not where I would look

[lean pebble]

SMB is fine on windows not on Linux

[topaz mirage]

That is disrespecting...

What makes you think that there aren't technical people?

SMB is horrible on Linux

Changing to Shield running on Android didn't help one bit.

[thorny vector]

I'm not saying there aren't any. But if you want nitty-gritty config changes, you go to the source. Redhat, centos, samba's own forums

Kodi caters to more consumers that want to just set stuff up and have it work, so the user base reflects that

[topaz mirage]

Source of the problem is from Kodi...so that's where should I look.
Asking on forums made for networking in general will result only in troubleshooting and I don§t wanna bother people with this.

[topaz mirage]

Have you ever used Kodi? You are talking more about Plex...

[lean pebble]

Plex is easier to configure and use

[topaz mirage]

For dummies? It's a good start, but for advanced stuff...you are on your own.

[thorny vector]

Yes, I am talking about kodi. Their users are on par with jellyfin users, and less technical than plex users

https://www.samba.org/samba/docs/old/Samba3-HOWTO/speed.html stuff like this is that good stuff

[topaz mirage]

Exactly. And closed as fck.
Only "advanced" thing in Plex is remote access. Even that can be easily done

[thorny vector]

Plex is fine. Only thing I don't like about it is it talking upstream

[topaz mirage]

Lol. Okay 😄
I'm not going to argue with randoms about stuff like this...

[peak cloak]

I use jellyfin

Pretty good

Does what I need it to

Simply stream from server to tv

[topaz mirage]

Cool...but...why? Samba is for Windows. NFS is simpler and not bloated with garbage stuff that makes it slower. NFS works for me and nothing worked with SMB.

[thorny vector]

Do what works then. But SMB is not samba

[topaz mirage]

Well, you are on-par with Kodi people. You seen it here first, mister.
But don't worry...that is compliment. As Kodi users are more active with making addons and caring for this project as a whole.
Plex is great if you want remote access and transcoding to devices straight. Less customization, none control over the system as a whole

[topaz mirage]

I know.

SMB is a protocol and Samba is implementation. But both have roots with Windows.

[thorny vector]

windows adopted SMB, but it was originally made as a standard by ibm

[peak cloak]

I just don't tinker with it, I could but it already does what I need it to.

[thorny vector]

Samba never has been associated with windows

[topaz mirage]

I was sarcastic. I never used it.

[severe venture]

https://www.monoprice.com/product?p_id=11207

are these cables good quality?

[clear igloo]

monoprice and cable matters are my go to personally

the plastic tabs covering the rj45 clip are hit or miss though

[severe venture]

yeah i hate when they break off

i received a defective ethernet cable from an ebay seller

https://www.ebay.com/itm/182640699043

dont buy these from sjbcable

[edgy burrow]

that picture looks like the "Graphic design is my passion" memes

[broken mist]

i gott an old windows pc with a netwrk switch ;-;
it was kinda broken from the beginning but it lasted for around 15 years and today it just gave up :(
so just before i try and add a new one is there a way to enable the netwrk via a software

[muted needle]

the network switch itself is broken?

[broken mist]

mhm

like atm only the spring exists ;-;

and then the metal body

[muted needle]

hmm, can you send a picture or something?

[broken mist]

hmm i dont think i can... its a laptop and its kinda hard to disassemble

lemme check if i can find a pic

[broken mist]

nope couldnt find any photos

its an
Acer 5571 celeronf tht helps

||idk how||

[muted needle]

I'll search it up

[broken mist]

imma too

[muted needle]

wait so you mean a network jack which is spring loaded to take less space?

[broken mist]

its called a wirless switch

[muted needle]

I'm very confused lol

[broken mist]

this is a similar issue

[tame carbon]

wat

[broken mist]

o its fine
old laptops had this thing called a netwrk switch

to save internet payments ig idk

[tame carbon]

wat

[broken mist]

lmao wat

[muted needle]

so you mean a toggle button for wireless radio?

[broken mist]

mhm

[peak cloak]

Wut lol

[tame carbon]

dont use the word switch

switches mean something else in #networking

[peak cloak]

Wtf

[broken mist]

oh y?

[broken mist]

oo sry

[peak cloak]

Oh

[muted needle]

now I'm back on track, yeah always be careful when you use the word switch here

[broken mist]

this is a normal two way swith if tht makes sense

[peak cloak]

An actual physical switch lol

Not a networking switch

[broken mist]

yeh lol

[tame carbon]

;-;

[peak cloak]

An electrical switch

[broken mist]

OOOOO LMAO NO

SRYYYY

[tame carbon]

[muted needle]

we're way too network savvy here

[broken mist]

im like is my q tht dum ;-;

[broken mist]

yeh makes sense

[muted needle]

yeah I think they too confused it for a network switching device

this is more of a #tech-support (or maybe somewhat related to #peripherals)

(this question I mean)

[tame carbon]

can just disable the device in software

thats what that button does

[broken mist]

i did try it

doesnt wrk

[tame carbon]

https://i.imgur.com/yGcq3rb.png

[broken mist]

mhm i did do tht

this manually breaks the connection to the reciever ig

is addin a jumper fine

..

[tame carbon]

doubt it

[broken mist]

coz im pretty sure i dont have the switch

[muted needle]

@tame carbon on older devices the wireless radio can't be toggled in software

[broken mist]

ikr

[broken mist]

its not tht old

[tame carbon]

most of the user functions like additional buttons, are done via i2c busses on the motherboard chipset

[broken mist]

tht option does exist

but even adter its enabled

theres this brek to the recieveer

[tame carbon]

and those are handled by the operating system

[broken mist]

ok.....

[tame carbon]

your wireless card could also just be broken :P

[broken mist]

oo and another thing
i feel like this button doesnt rlly break the connection

[broken mist]

nah

this has happened alotta time

s

its not the netwrk card for sure

[muted needle]

it could be defective though

[broken mist]

wha?

doin wut could be....

[lean pebble]

I need help with figure out why my vpn stopped working properly after the last mtik upgrade

[muted needle]

the wireless network card could be defective from factory

[lean pebble]

I'm guessing it's some dns related

[broken mist]

no wut happens is it does an auto off thing if the netwrk isnt used for a while

which happened i turned the laptop on after a week

but this time i was a little impatient and broke the entire switch T_T

[muted needle]

wait so what are you trying to achieve in the first place

[broken mist]

turn it on

[muted needle]

in what way is it broken though

[broken mist]

i usually did it with the electric switch but now its borken

[broken mist]

the protrudin portion of the electric switch just snapped off

so i cant turn it on

so i wanna find a way to turn it on usin bios or smthin

if its possible

[muted needle]

screwdriver to the rescue?

you can't turn it on in software

[broken mist]

tht just yonked the entire plastic off ;-;

[broken mist]

yeh tru

[broken mist]

now all i see is a spring stickin out

[muted needle]

you have to get the switch to work well enough to enable wireless, something which I don't have time to help you with

[broken mist]

mhm i get it

wired does wrk so imma stick with dat for a while

thnks for helpin doe :D

[muted needle]

you're welcome

[muted needle]

bumping this to allow someone able to help see it

[peak cloak]

I mean , what's not working

The link itself?

[frank elbow]

Hey does anyone know who I should talk to if I wanted to donate a computer part to the linus team?

[peak cloak]

Sir this is a #networking channel

[muted needle]

post onto reddit in r/pcmasterrace, get 300,000 upvotes and check your inbox

[waxen scroll]

man... r/pcmr

i was OG then unsubbed a long time ago

place is cancer now

r/sysadmin is getting there too

they used to ban low effort posts, now its a bunch of "i got a new job!"

[lean pebble]

Can't surf / use WhatsApp and all this

[peak cloak]

Yeah that's not relavent

Is the link working

Can you ping

By link working I mean link up

[lean pebble]

I can connect to the VPN but no surf or use any internet app

Well no ping to anything

[tender hazel]

no ping for you

[thorny vector]

Depending on the vpn, might not support icmp through it 🤷‍♂️

[tidal frost]

Just found out the timeclock system at work is running some weird portable version of windows 10 and it explains sooooo much. None of the tech decisions around here make any sense bc theyd rather save a dollar now then save thousands later.

[lean pebble]

L2tp VPN

[brave heron]

sry if this is supposed to be in tech support
but i'm the only device lagging in my house, i'm 2mb up 2mb down lol
i tried to see if distance was the issue so i tried it with my phone, but the phone went from 40mb next to my computer to 60mb next to the router
help lol no forums are helping

[wheat solstice]

Hmm, both pihole and adguard seem to default to resolving blocked DNS queries to 0.0.0.0, the pihole docs say that it's "unspecified address" and that "it must never be assigned to any node"

However, on every machine I've tried, opening a connection to 0.0.0.0 is the same as opening a connection to localhost, so all blocked DNS queries open a connection to my webserver running on localhost lol

[vestal surge]

okay - super stupid question incoming - I have an intel dual nic in my server (2nd half optiplex); if I buy a separate router and put that between my lan and the second port on the nic for site-to-site vpn accessing the server... that works right?

[oblique linden]

Depends how you use the port on the server, but it certainly is possible.

[vestal surge]

i have a mikrotik chr on a vps so I want to link a hex s to link that second port on the optiplex back to the CHR

that way when I road-warrior vpn back home, I'm not going directly to my house's lan (so no DDNS, or direct exposure of my public ip) i'm going via a CHR?

[oblique linden]

Makes sense. Not sure why the second router though.

[vestal surge]

home network is unifi and has a bunch of things on it i'd rather not expose... i could tunnel direct from the 2nd router to the vps?

[oblique linden]

Why not tunnel from 1st router with all traffic routed to your 2nd server port?

Two-router setup should definitely work. Just seems unnecessary.

[tame carbon]

@vestal surge I got a mikrotik RB4011 here, controlling like 5 different networks

mostly put together with VLANs

you can put the 2nd interface on a different vlan, and use your existing router

that is, if it supports vlans

[vestal surge]

Thanks AngryAnt! Crystal - hmmm I might try that tomorrow before buying anything then. My home router/gateway is a UDM

[lean pebble]

How can I make nfs share folder inside my smb share ?
I have storagebox that only supports smb,webdav,ssh,ftps,ftp,sftp

[tame carbon]

@vestal surge I actually simplified the cabling of my network by moving to 10G.
The server is connected with fiber optics to my switch.

and the 5 virtual machines, each have their own VLAN

[vestal surge]

this is the current topology.

already using vlans via unifi so there isn't any reason I couldn't add another.

[tame carbon]

I got an RB4011 paired with a CRS305

gives you just enough connectivity to set up a fast backbone at home

[vestal surge]

not sure how the site-to-site would work from the unifi to the CHR? I don't want to route all traffic through the site-to-site

[tame carbon]

all your gigabit stuff just branches off that

@vestal surge some PPP-type tunnel and a firewall rule? :D

depending on what routes you set up, and their route metric

packets prefer one route over the other

my networks have mostly been linear, never really done much site2site stuff

[vestal surge]

yeah honestly I'm being a geek and overcomplicating things.

[tame carbon]

@vestal surge not the only one :P https://i.imgur.com/tbeBAym.png

one of 4 mikrotiks

all those vlans you see on the SFP+ interface, those go to my switch

[vestal surge]

its so pretty... one day i'll get something like that

[tame carbon]

@vestal surge https://mikrotik.com/product/rb4011igs_rm

[tame carbon]

list keeps growing https://i.imgur.com/BLMSZfq.png

[limpid lion]

Trying to understand ACL's.

Is there a difference between these ACL's?

a)
access-list 100 permit tcp host 1.1.1.1 host 2.2.2.2 eq 80
access-list 100 deny ip any host 2.2.2.2
access-list 100 permit ip any host 3.3.3.3

b)
access-list 100 permit tcp host 1.1.1.1 host 2.2.2.2 eq 80
access-list 100 deny ip host 1.1.1.1 host 2.2.2.2
access-list 100 permit ip any host 3.3.3.3

In both examples only TCP from 1.1.1.1 can reach 2.2.2.2 and nothing else, correct?

[waxen scroll]

access-list 100 deny ip any host 2.2.2.2
access-list 100 deny ip host 1.1.1.1 host 2.2.2.2

One blocks all communication to destination 2.2.2.2 while the other denies only 1.1.1.1 -> 2.2.2.2

Both examples will have a hidden deny all at the end of the list as well.

[limpid lion]

so in the case of access-list 100 deny ip host 1.1.1.1 host 2.2.2.2
its implied that all other traffic to 2.2.2.2 is allowed? In that case I think I understand

[waxen scroll]

nope. all other traffic to 2.2.2.2 is denied unless you specifically said to permit it

[limpid lion]

But in that case all trafic to 2.2.2.2 is blocked in both cases because its not specified as allow besides allowing tcp on port 80?

[waxen scroll]

right

you'd need access-list 100 permit ip any any or something similar at the end to allow everything else

[limpid lion]

so they essentially do the same thing

[waxen scroll]

correct

[limpid lion]

thanks, I understand now

[waxen scroll]

thats because you dont have a permit any at the end. if you did, both would act differently

[limpid lion]

Yeah

[rocky badge]

@waxen scroll @clear igloo Debating installing wireguard and setting it up on demand on my parents iPads lol

[thick minnow]

Do it

[clear igloo]

dew it!

[lone sun]

🤔 Well I know what ACL's are, but that just looks like a bunch of gibberish to me. 😆 All I know is there are black lists and white lists. Which one you use depends on your needs.

[hollow marlin]

ACLs are used more than just dropping/accepting traffic. ACLs are match conditions and used in many things such as NAT, route-maps, policy-based routing, etc.

[low pond]

Do you know BGP communities? I always fail to understand them

[hollow marlin]

Pretty much a standard in the SP space

They are PA (path attributes) that are attached to routes similar in concept to route tags. They have a ton of uses but primarily used for filtering and taking actions on routes containing the community

[low pond]

Like, "flags" in one sence

[hollow marlin]

I would say similar

[lean pebble]

Hey someone can help me with mtik hex s l2tp VPN?
It stopped work completely 😅

[waxen scroll]

🤩

https://onestep.net/communities/as3356/

CTRL+F: "Communities accepted from customers"

example of some for people like you on AS 3356

theres no standard AFAIK its fully custom and can differ between ISPs

i use communities to make my routes look bad

[lean pebble]

Now I'm back to the beginning.
I can connect to it but can't surf or use discord / download and upload pics in WhatsApp only can get and send regular messages in WhatsApp sometimes

[hollow marlin]

The well-known communities are considered a standard. NO_ADVERTISE, EXPORT, PEER. There is another block that is sort of standard, like 65535:666 for RTBH

[waxen scroll]

They're not programed into routers that way by default so I'm not considering it a standard

[hollow marlin]

We assign multiple communities to each peer for a bunch of reasons

In Cisco, don't type in the 32bit number and type no-export, or something along those lines

Nexus:
set community { none | { aa : nn [... aa:nn ] | additive | local-as | no-advertise | no-export }}

65535:X in RFC, first half is "first come first serve", AKA the wild west which no one really follows, and second half is reserved for standards

[hollow marlin]

Have you since looked at the VPS side? Im pretty sure all of us that help said that is the next place to look

[waxen scroll]

https://www.reddit.com/r/networking/comments/no38lk/former_verizon_engineers_of_rnetworking_is_the/

Lul

[hollow marlin]

Sounds about right. I'd honestly never choose to work for the big SPs from what I hear

[lean pebble]

What vps?

It's mtik l2tp VPN no vps included

[hollow marlin]

I thought this was your VPN you had previously built to a VPS

[lean pebble]

Oh no haha you though it's the gre tunnel I disabled it