#networking | Linus Tech Tips | Page 354

zenith inlet Jun 19, 2021, 5:41 PM

#

naw he is fine

#

we tried hamachi

low pond Jun 19, 2021, 5:41 PM

#

what.

#

Oh dear my messages got deleted

#

Yeaa exactly

#

true

#

i'd think or taught 60ghz is point to point

#

so it is point to point

#

heh 5G Mmwave also died that fast

#

thru a glass door? dead

#

needs clear sight

tender hazel Jun 19, 2021, 5:45 PM

#

60ghz is being done PtMP with beamforming

low pond Jun 19, 2021, 5:46 PM

#

BeamForming™️

tender hazel Jun 19, 2021, 5:48 PM

#

we are shipping 60ghz PtMP to a rural school for this purpose

#

they have 8 housing units for the teachers, all in a row a short distance from the school

#

60ghz AP on the school and CPEs on each housing unit

#

gives them internet through the school's connection

zenith inlet Jun 19, 2021, 5:58 PM

#

ok so

#

zerotier isnt working

#

I found a few tutorials

#

tutorial shows two ip things and one is the main host thing

#

But I only have one

#

fixed!

#

never mind

#

broken

#

I can connect but friend cant

tepid trail Jun 19, 2021, 6:35 PM

#

My internal Realtek gigabit NIC or Intel gigabit PCIEx1 card. What will get most performance and taking least resources from CPU and such?

#

any ways to run tests and compare?

cosmic hinge Jun 19, 2021, 7:09 PM

#

I am getting this error in filezilla:

Status: Connecting to X.X.X.X:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Status: Server sent passive reply with unroutable address. Using server address instead.
Command: LIST
Error: Connection timed out after 20 seconds of inactivity
Error: Failed to retrieve directory listing

rocky badge Jun 19, 2021, 8:23 PM

#

@clear igloo on demand VPN is a success

clear igloo Jun 19, 2021, 8:23 PM

#

Nice!

rocky badge Jun 19, 2021, 8:24 PM

#

#

30ms pinging back home 😄

clear igloo Jun 19, 2021, 8:24 PM

#

very nice

#

different providers along the way I assume too?

rocky badge Jun 19, 2021, 8:25 PM

#

This is the first stop :P lol

#

So this is Spectrum Business

clear igloo Jun 19, 2021, 8:25 PM

#

Yah, and your local ISP back home right?

rocky badge Jun 19, 2021, 8:25 PM

#

yeah

clear igloo Jun 19, 2021, 8:25 PM

#

Cool, so that's pretty good latency then 🙂

rocky badge Jun 19, 2021, 8:25 PM

#

#

I wonder if I can play MC local player across devices 😄

clear igloo Jun 19, 2021, 8:26 PM

#

Should be able to 😄

rocky badge Jun 19, 2021, 8:26 PM

#

The VPN isn't slow.....the rate limit is harsh 😦

#

5Mbps both ways

#

the internet is pretty ok latency wise but throughput is in the shitter 📉 📉

peak cloak Jun 19, 2021, 11:42 PM

#

Anyone have any clue on how to get vyos to generate a link-local v6 address on wireguard interfaces

#

or do I need to set those up manually

hollow marlin Jun 20, 2021, 12:14 AM

#

@peak cloak does it have a similar command set family inet6

peak cloak Jun 20, 2021, 12:16 AM

#

hollow marlin <@222482269829332992> does it have a similar command `set family inet6`

no, I looked it up and apparently it looks for a mac address before setting up a link-local address which makes sense, but I can't find a way to set a mac address on a wg interface

#

so I set it manually

#

but now I can't ping the other side of the tunnel, since it gives me no route however show ipv6 fe80::ade0 shows routes

#

I even set a static route

#

but it shows lo as best route what

hollow marlin Jun 20, 2021, 12:32 AM

#

peak cloak but now I can't ping the other side of the tunnel, since it gives me `no route` ...

When you ping you must specify the outgoing interface

#

That applies to all OSes as with link local, all interfaces share the same route so it needs to know which interface

peak cloak Jun 20, 2021, 12:34 AM

#

hollow marlin When you ping you must specify the outgoing interface

yes I did that and still no

#

although I figured it out

#

in the wireguard interface config I did not add ::/0 to allowed-ips

hollow marlin Jun 20, 2021, 12:38 AM

#

That's right, VyOS is more FW style config

peak cloak Jun 20, 2021, 12:39 AM

#

hollow marlin That's right, VyOS is more FW style config

that's just a standard wireguard setting anywhere

plain siren Jun 20, 2021, 12:52 AM

#

hollow marlin That's right, VyOS is more FW style config

Eh, I find it has elements of some routers/switches to its config too

#

Especially the "configure" to enter config mode out of operational

#

Then the whole set service/device/tool specific-target config-for-target-to-change value format

peak cloak Jun 20, 2021, 12:55 AM

#

anything special I need to setup on vyos for ipv6 configuration

#

BGP router identifier 172.23.84.33, local AS number 4242422810 vrf-id 0
BGP table version 1
RIB entries 1, using 184 bytes of memory
Peers 1, using 20 KiB of memory

Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
fe80::ade0      4 4242423914       0       0        0    0    0    never       Active

Total number of neighbors 1

#

I can ping fe80::ade0

#

what confuses me is no messages sent

#

which I suspect I messed up somewhere

#

     address-family {
         ipv6-unicast {
             route-map {
                 export DN42-ROA
                 import DN42-ROA
             }
         }
     }
     ebgp-multihop 20
     remote-as 4242423914
 }

waxen scroll Jun 20, 2021, 1:08 AM

#

@hollow marlin ebgp 20. Yikes

peak cloak Jun 20, 2021, 1:08 AM

#

waxen scroll <@462711605063450628> ebgp 20. Yikes

¯_(ツ)_/¯

#

that's what the tutorial said

#

I have like very little clue what I'm doing

waxen scroll Jun 20, 2021, 1:10 AM

#

You shouldn't need that command at all. But it's not going to hurt anything

#

How come you didn't configure the other neighbor

peak cloak Jun 20, 2021, 1:13 AM

#

waxen scroll How come you didn't configure the other neighbor

wdym

waxen scroll Jun 20, 2021, 1:14 AM

#

Go to fe80::ade0 and configure that side

peak cloak Jun 20, 2021, 1:14 AM

#

waxen scroll Go to fe80::ade0 and configure that side

oh, that's the peers side

#

I have no control over that

#

this is on a network called dn42

#

https://dn42.g-load.eu/

#

this is the peer

#

almost everything is over some sort of vpn protocol

#

I got ipv4 to work just fine

#

now I'm doing v6

waxen scroll Jun 20, 2021, 1:17 AM

#

I'm on mobile. Paste the ASN so I can copy it and look at that website

peak cloak Jun 20, 2021, 1:17 AM

#

waxen scroll I'm on mobile. Paste the ASN so I can copy it and look at that website

my asn?

waxen scroll Jun 20, 2021, 1:17 AM

#

Yes

peak cloak Jun 20, 2021, 1:17 AM

#

4242422810

waxen scroll Jun 20, 2021, 1:17 AM

#

Ty

peak cloak Jun 20, 2021, 1:18 AM

#

https://explorer.burble.com/#/

waxen scroll Jun 20, 2021, 1:18 AM

#

Nm it wants me to login as you

peak cloak Jun 20, 2021, 1:18 AM

#

waxen scroll Nm it wants me to login as you

yeah that's for setting up the peering

hollow marlin Jun 20, 2021, 1:20 AM

#

plain siren Then the whole `set service/device/tool specific-target config-for-target-to-cha...

Yeah, it appears to be a weird mix of Junos/IOS XR

plain siren Jun 20, 2021, 1:20 AM

#

hollow marlin Yeah, it appears to be a weird mix of Junos/IOS XR

This is exactly my thoughts.

#

Honestly, I love it. VyOS has always been a special piece of my attention since it was called "Vyatta"

#

I would love to make a setup out of my own hardware from Gateway, to Router, to Switch one day

hollow marlin Jun 20, 2021, 1:21 AM

#

peak cloak ```neighbor fe80::ade0 { address-family { ipv6-unicast { ...

Under the neighbor, is there a local-interface command?

waxen scroll Jun 20, 2021, 1:22 AM

#

@hollow marlin I only use globals for peerings usually

peak cloak Jun 20, 2021, 1:22 AM

#

hollow marlin Under the neighbor, is there a `local-interface` command?

yep, it's interface and I think I found the problem

#

🤦

hollow marlin Jun 20, 2021, 1:23 AM

#

waxen scroll <@462711605063450628> I only use globals for peerings usually

I don't ever think ive seen LL peerings in the real world

waxen scroll Jun 20, 2021, 1:23 AM

#

There's no point to that

#

Now what I do hate is when ATT needs a /64 to peer

peak cloak Jun 20, 2021, 1:24 AM

#

idk, that's the preferred method apparently on the network

waxen scroll Jun 20, 2021, 1:25 AM

#

I forget if that was an L3VPN or internet policy

hollow marlin Jun 20, 2021, 1:25 AM

#

Even through my studies its really only shown during introducing v6 into the network or 6PE

hollow marlin Jun 20, 2021, 1:26 AM

#

peak cloak yep, it's `interface` and I think I found the problem

What was the issue?

peak cloak Jun 20, 2021, 1:27 AM

#

hollow marlin What was the issue?

well it's not resolved yet, but there is an option interface was v6only Enable BGP with v6 link-local only

#

now instead of ACTIVE it's showing IDLE

#

still no message sent

hollow marlin Jun 20, 2021, 1:30 AM

#

You'll probably be seeing it cycle between idle/active. If not then config is not setup correctly.

#

Whats the show ipv6 bgp neighbor show?

plain siren Jun 20, 2021, 1:32 AM

#

waxen scroll I forget if that was an L3VPN or internet policy

Internet Policy, i recently ran into this

peak cloak Jun 20, 2021, 1:32 AM

#

hollow marlin Whats the `show ipv6 bgp neighbor` show?

there's no such command, but if you want the general overview show ip bgp summary ```IPv4 Unicast Summary:
BGP router identifier 172.23.84.33, local AS number 4242422810 vrf-id 0
BGP table version 105476
RIB entries 1044, using 188 KiB of memory
Peers 5, using 102 KiB of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
fe80::ade0 4 4242423914 0 0 0 0 0 never Idle
172.20.16.139 4 4242421588 61390 42662 0 0 0 1d06h08m 469
172.20.53.98 4 4242423914 119062 68416 0 0 0 1d06h07m 541
172.20.229.123 4 4242421080 0 1212 0 0 0 never Active
fe80::ade0 4 4242423914 0 0 0 0 0 never Active

Total number of neighbors 5

#

wait

#

why are there 2

#

hmm

hollow marlin Jun 20, 2021, 1:33 AM

#

Thats showing v6 peers advertising v4 routes. Use show ipv6 bgp summary/neighbor instead

peak cloak Jun 20, 2021, 1:33 AM

#

ah

#

BGP router identifier 172.23.84.33, local AS number 4242422810 vrf-id 0
BGP table version 1
RIB entries 1, using 184 bytes of memory
Peers 1, using 20 KiB of memory

Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
fe80::ade0      4 4242423914       0       0        0    0    0    never       Active

Total number of neighbors 1

#

could it be the router id?

#

idk

hollow marlin Jun 20, 2021, 1:34 AM

#

do show ipv6 bgp neighbor fe80::ade0

peak cloak Jun 20, 2021, 1:35 AM

#

  BGP version 4, remote router ID 0.0.0.0, local router ID 172.23.84.33
  BGP state = Active
  Last read 00:53:03, Last write never
  Hold time is 180, keepalive interval is 60 seconds
  Message statistics:
    Inq depth is 0
    Outq depth is 0
                         Sent       Rcvd
    Opens:                  0          0
    Notifications:          0          0
    Updates:                0          0
    Keepalives:             0          0
    Route Refresh:          0          0
    Capability:             0          0
    Total:                  0          0
  Minimum time between advertisement runs is 0 seconds

 For address family: IPv4 Unicast
  Not part of any update group
  Community attribute sent to this neighbor(all)
  0 accepted prefixes

 For address family: IPv6 Unicast
  Not part of any update group
  Community attribute sent to this neighbor(all)
  Inbound path policy configured
  Outbound path policy configured
  Route map for incoming advertisements is *DN42-ROA
  Route map for outgoing advertisements is *DN42-ROA
  0 accepted prefixes

  Connections established 0; dropped 0
  Last reset 00:53:03,  Waiting for peer OPEN
  External BGP neighbor may be up to 20 hops away.
BGP Connect Retry Timer in Seconds: 120
Next connect timer due in 88 seconds
Read thread: off  Write thread: off  FD used: -1

hollow marlin Jun 20, 2021, 1:40 AM

#

Whats the entire BGP config?

peak cloak Jun 20, 2021, 1:41 AM

#

     address-family {
         ipv4-unicast {
             network 172.23.84.32/27 {
             }
         }
         ipv6-unicast {
             network fdc1:e70f:34b0::/48 {
             }
         }
     }
     neighbor 172.20.16.139 {
         address-family {
             ipv4-unicast {
                 route-map {
                     export DN42-ROA
                     import DN42-ROA
                 }
                 soft-reconfiguration {
                     inbound
                 }
             }
         }
         ebgp-multihop 20
         remote-as 4242421588
     }
     neighbor 172.20.53.98 {
         address-family {
             ipv4-unicast {
                 route-map {
                     export DN42-ROA
                     import DN42-ROA
                 }
                 soft-reconfiguration {
                     inbound
                 }
             }
         }
         ebgp-multihop 20
         remote-as 4242423914
     }
     neighbor 172.20.229.123 {
         address-family {
             ipv4-unicast {
                 route-map {
                     export DN42-ROA
                     import DN42-ROA
                 }
             }
         }
         ebgp-multihop 20
         remote-as 4242421080
     }
     neighbor fe80::ade0 {
         address-family {
             ipv6-unicast {
                 route-map {
                     export DN42-ROA
                     import DN42-ROA
                 }
             }
         }
         ebgp-multihop 20
         interface {
             remote-as 4242423914
             v6only {
                 remote-as 4242423914
             }
         }
         remote-as 4242423914
     }
     parameters {
         router-id 172.23.84.33
     }
 }

waxen scroll Jun 20, 2021, 1:42 AM

#

Interface is not setting an interface

peak cloak Jun 20, 2021, 1:42 AM

#

waxen scroll Interface is not setting an interface

that's what I thought was well

#

but I can't. unless I'm doing it wrong

#

set protocols bgp 4242422810 neighbor fe80::ade0 interface wg92

#

that fails

#

says not valid

hollow marlin Jun 20, 2021, 1:44 AM

#

Yeah that is not the same, thats just interface level configs

peak cloak Jun 20, 2021, 1:45 AM

#

there's this thread I found

#

https://phabricator.vyos.net/T941

hollow marlin Jun 20, 2021, 1:45 AM

#

Ether it has a source-address or local-interface config. what options are there after set protocols bgp 4242422810 neighbor fe80::ade0

peak cloak Jun 20, 2021, 1:45 AM

#

 > address-family
                Parameters relating to IPv4 or IPv6 routes
   advertisement-interval
                Minimum interval for sending routing updates
 > bfd          Enable Bidirectional Forwarding Detection (BFD) support
 > capability   Advertise capabilities to this neighbor
   description  Description for this neighbor
   disable-capability-negotiation
                Disable capability negotiation with this neighbor
   disable-connected-check
                Disable check to see if EBGP peer's address is a connected route
 > disable-send-community
                Disable sending community attributes to this neighbor (IPv4)
   ebgp-multihop
                Allow this EBGP neighbor to not be on a directly connected network
 > interface    interface parameters
+> local-as     Local AS number
   override-capability
                Ignore capability negotiation with specified neighbor
   passive      Do not initiate a session with this neighbor
   password     BGP MD5 password
   peer-group   IPv4 peer group for this peer
   port         Neighbor's BGP port
   remote-as    Neighbor BGP AS number [REQUIRED]
   shutdown     Administratively shut down neighbor
   strict-capability-match
                Enable strict capability negotiation
 > timers       Neighbor timers
 > ttl-security Ttl security mechanism for this BGP peer
   update-source
                Source IP of routing updates

hollow marlin Jun 20, 2021, 1:46 AM

#

what options are after update-source

peak cloak Jun 20, 2021, 1:47 AM

#

   <x.x.x.x>    IP address of route source
   <interface>  Interface as route source

hollow marlin Jun 20, 2021, 1:47 AM

#

use the WG interface there

#

So set protocols bgp 4242422810 neighbor fe80::ade0 update-source wg92

peak cloak Jun 20, 2021, 1:48 AM

#

yep

#

did that

#

nothing different

#

I"ll try resetting bgp like last time

#

still nothing

hollow marlin Jun 20, 2021, 1:51 AM

#

Remove the interface and multihop commsnds

peak cloak Jun 20, 2021, 1:53 AM

#

when I remove ebgp-multihop, I get Error configuring routing subsystem.

hollow marlin Jun 20, 2021, 1:55 AM

#

Delete the neighbor and re add it without those. Multihop and link local conflict

waxen scroll Jun 20, 2021, 2:00 AM

#

This is so much hell when you could have had a Cisco

#

😇

peak cloak Jun 20, 2021, 2:01 AM

#

hollow marlin Delete the neighbor and re add it without those. Multihop and link local conflic...

nothing

#

I'll try updating

#

I feel like this may be a bug

hollow marlin Jun 20, 2021, 2:21 AM

#

Let me toss it in my lab and see if I get the same thing

peak cloak Jun 20, 2021, 2:22 AM

#

great and now I can't ssh into it

#

from my pc

#

weird

#

but I can from router

#

ok, after reboot some stuff got messed up

#

fun

#

I'll have a go at it tommorow

#

either I messed something up the way I updated, or this is why vyos isn't used much at ISPs

azure lion Jun 20, 2021, 2:46 AM

#

I have a ISP Modem+Router 2-in-1 (which I consider trash). It used to frequently drop my devices even when working right next to it. All the devices used to get disconnected at the same time for about a min. There was a big issue with the 2.4GHz connection. I have a plan of 200mbps but on 2.4G band, I only used to get about 20-30 at the most 50mbps. The 5GHz band worked flawlessly other than the obvious shorter range. This was really for WorkFromHome. So I disabled both the wireless bands on the ISP Modem+Router and attached my ASUS router as an access point as it was just lying around. The range and strength improved slightly but the same issues still prevailed. I used to get disconnected on devices and 2.4G band was still weird and sus.
Now I have an option of making selective LAN ports on the ISP device run in "bridge" mode rather than "route" mode. From what I know, I will have to put my ASUS router back into Router mode and connect the LAN to the WAN (rather than LAN to LAN) for this, and this may probably solve any issues arising from a double NAT situation.
What is wrong with my WiFi?

primal ice Jun 20, 2021, 2:53 AM

#

could be your microwave, - anything that causes or amplifies radio waves can cause interference for wi-fi. that is why ethernet is much better.

#

could also be your neighbor turning on an ancient TV.

tender hazel Jun 20, 2021, 2:54 AM

#

make sure you are only using a 20mhz channel size on your 2.4ghz and not 40mhz

plain siren Jun 20, 2021, 2:57 AM

#

azure lion I have a ISP Modem+Router 2-in-1 (which I consider trash). It used to frequently...

I call these "AIOs"

#

All in ones

plain siren Jun 20, 2021, 2:58 AM

#

azure lion I have a ISP Modem+Router 2-in-1 (which I consider trash). It used to frequently...

yeah, you really wanna use Bridge mode on your ISPs AIO, and then have Router + WiFi AP Function handled elsewhere tho

azure lion Jun 20, 2021, 3:08 AM

#

primal ice could also be your neighbor turning on an ancient TV.

could be

azure lion Jun 20, 2021, 3:08 AM

#

tender hazel make sure you are only using a 20mhz channel size on your 2.4ghz and not 40mhz

idk i gotta check which one i am using

tender hazel Jun 20, 2021, 3:08 AM

#

default is probably 40MHz

azure lion Jun 20, 2021, 3:08 AM

#

oh

azure lion Jun 20, 2021, 3:09 AM

#

plain siren yeah, you really wanna use Bridge mode on your ISPs AIO, and then have Router + ...

Alr ill try that

tender hazel Jun 20, 2021, 3:09 AM

#

it is a stupid default that only makes sense if you live in the middle of nowhere not near any other 2.4ghz sources

azure lion Jun 20, 2021, 3:09 AM

#

😂

azure lion Jun 20, 2021, 3:10 AM

#

tender hazel it is a stupid default that only makes sense if you live in the middle of nowher...

that assumption is also true for wireless range described on wifi router boxes

chrome hinge Jun 20, 2021, 6:49 AM

#

any guys here with some best practices with pfsense and unifi integrations (on home lvl)

plain siren Jun 20, 2021, 7:26 AM

#

chrome hinge any guys here with some best practices with pfsense and unifi integrations (on h...

Well, you would configure the PfSense Router/FW as you normally would tbh

#

There isnt much different that needs to happen.

chrome hinge Jun 20, 2021, 7:36 AM

#

Was just looking out for some stuff that I might've overlooked. Pfsense isn't the real issue here, it's moe or less the clients not picking the correct ap

plain siren Jun 20, 2021, 7:37 AM

#

chrome hinge Was just looking out for some stuff that I might've overlooked. Pfsense isn't th...

Define picking the the correct AP.
You mean picking the closest one?

chrome hinge Jun 20, 2021, 7:49 AM

#

Basically yeah. Because when, testing with different SSID's and e.g. only placing ssid 1 on AP on first floor and connecting to that gives way better performance when providing SSID on both floors it still picked the one on the ground floor, thus weaker performance

chrome hinge Jun 20, 2021, 8:22 AM

#

Probably need more dbm tweaking

cedar igloo Jun 20, 2021, 9:29 AM

#

I have a homelab network inside my main home network and I am wanting to be able to communicate with devices on the homelab network. Is there a way to say 10.3.0.0/16 should be routed through 192.168.0.100 router (in Ubuntu), and how do I configure my VyOS router to allow this?

#

Or what is this called so I know what to google?

cedar igloo Jun 20, 2021, 9:53 AM

#

so, the static route is created on my ubuntu pc. Now I need to configure VyOS

thick minnow Jun 20, 2021, 11:19 AM

#

hey boys, my messed up country is blocking social medias to prevent cheating in national exams (yeah thats not a joke) and I need to access my instagram since thats what I work with, theyre also blocking VPN entries I cant seem to connect to any of them, does anyone know any sort of free remote thing to access that or any other solution pls? 🙏

cedar igloo Jun 20, 2021, 11:20 AM

#

Have you tried NordVPN obfuscated mode?

thick minnow Jun 20, 2021, 11:21 AM

#

Can't even get to login screen with NordVPN either, cant connect to any VPN actualy

cedar igloo Jun 20, 2021, 11:23 AM

#

cedar igloo I have a homelab network inside my main home network and I am wanting to be able...

I think this isn't possible since I am using NAT

ebon wasp Jun 20, 2021, 11:25 AM

#

cedar igloo I have a homelab network inside my main home network and I am wanting to be able...

You basically described what a pure router does

cedar igloo Jun 20, 2021, 11:25 AM

#

I just don't know how to configure it

#

I get how to get traffic from inside the homelab to external. It's just the opposite I need to work on

ebon wasp Jun 20, 2021, 11:27 AM

#

hmmm, I wanted to advice to use PFsense, but I just googled what VyOS was.

#

It should be possible with VyOS, but I have zero knowledge over it's possibilities

peak cloak Jun 20, 2021, 11:28 AM

#

cedar igloo so, the static route is created on my ubuntu pc. Now I need to configure VyOS

Yes, I did that with my kuberetes network. What role is vyos playing in your setup

cedar igloo Jun 20, 2021, 11:29 AM

#

VyOS is the gateway between my home and homelab network

ebon wasp Jun 20, 2021, 11:29 AM

#

https://docs.vyos.io/en/latest/configuration/protocols/rip.html
This could be a first step

peak cloak Jun 20, 2021, 11:29 AM

#

cedar igloo VyOS is the gateway between my home and homelab network

It's NATing?

cedar igloo Jun 20, 2021, 11:29 AM

#

Yes. Internal Homelab is using NAT

peak cloak Jun 20, 2021, 11:30 AM

#

Ah, you don't need to do nat

ebon wasp Jun 20, 2021, 11:30 AM

#

Hold on, where do you have NAT?

peak cloak Jun 20, 2021, 11:30 AM

#

I didn't

#

So basically have vyos get an IP on wan normally

cedar igloo Jun 20, 2021, 11:30 AM

#

peak cloak So basically have vyos get an IP on wan normally

It's currently getting an IP from my home network router using DHCP

peak cloak Jun 20, 2021, 11:31 AM

#

Then assign 192.168.0.100/24 to your lan interface

peak cloak Jun 20, 2021, 11:31 AM

#

cedar igloo It's currently getting an IP from my home network router using DHCP

Ah ok

#

So what you need to do, is just get rid of the masquerade rule

cedar igloo Jun 20, 2021, 11:32 AM

#

Will I still be able to use 10.3.0.0/16 for the homelab clients?

peak cloak Jun 20, 2021, 11:32 AM

#

Ok wait what

plain siren Jun 20, 2021, 11:32 AM

#

peak cloak So what you need to do, is just get rid of the masquerade rule

Wouldnt that mean you have the IP assignment controlled by the Root router?

#

He has a cascaded LAN solution

#

So hes using an isolated LAN behind his root

peak cloak Jun 20, 2021, 11:32 AM

#

plain siren Wouldnt that mean you have the IP assignment controlled by the Root router?

No? I mean dhcp is still handed out by vyos

#

Just you gotta tell the main home router where the homelab network is

#

@cedar igloo what's the homelab network ip range?

#

I'm a bit confused

plain siren Jun 20, 2021, 11:33 AM

#

Praise be to IPv6.

#

WAN <> LAN (home) <> LAN (Homelab)

cedar igloo Jun 20, 2021, 11:34 AM

#

peak cloak <@266245479501791234> what's the homelab network ip range?

192.168.0.0/24

ebon wasp Jun 20, 2021, 11:34 AM

#

plain siren Praise be to IPv6.

And fuck NAT

plain siren Jun 20, 2021, 11:34 AM

#

ebon wasp And fuck NAT

Yes FUCK NAT

cedar igloo Jun 20, 2021, 11:34 AM

#

plain siren WAN <> LAN (home) <> LAN (Homelab)

That seems correct

plain siren Jun 20, 2021, 11:34 AM

#

blobhighfive

peak cloak Jun 20, 2021, 11:34 AM

#

cedar igloo 192.168.0.0/24

And the "wan" ip of vyos?

cedar igloo Jun 20, 2021, 11:35 AM

#

192.168.0.100 at present (although it uses DHCP)

peak cloak Jun 20, 2021, 11:35 AM

#

Wait

#

192.168.0.0/24 is also your home network?

plain siren Jun 20, 2021, 11:35 AM

#

Yeahhh you cant really be using the same IP Range as your Home LAN if you have it cascaded

peak cloak Jun 20, 2021, 11:35 AM

#

You gotta have a different ip range for homelab

cedar igloo Jun 20, 2021, 11:35 AM

#

I am getting myself confused. Sorry

peak cloak Jun 20, 2021, 11:36 AM

#

Use something like 10.0.0.0/24

plain siren Jun 20, 2021, 11:36 AM

#

It would be something like 192.168.1.0/24 or 10.0.somehting.blah/24

cedar igloo Jun 20, 2021, 11:37 AM

#

Home Network: 192.168.0.0/24
HomeLab Network: 10.3.0.0/16
HomeLab WAN: 192.168.0.100 (handed by root router DHCP)

peak cloak Jun 20, 2021, 11:37 AM

#

Ah

#

So in your main home router add a static route for 10.3.0.0/16, next-hop 192.168.0.100

#

And that's it

#

Get rid of the nat rule as well

cedar igloo Jun 20, 2021, 11:38 AM

#

Ok. I'll give it a go. Thank you all 😀

low pond Jun 20, 2021, 11:39 AM

#

Did someone say fuck NAT? NAT is the best.

plain siren Jun 20, 2021, 11:41 AM

#

Pumps shotgun

Get em bois.

low pond Jun 20, 2021, 11:42 AM

#

🤣🤣🤣

#

Nat OF nat natter nat cgnatted nat nat nat is prem.

cedar igloo Jun 20, 2021, 11:50 AM

#

peak cloak So in your main home router add a static route for 10.3.0.0/16, next-hop 192.168...

Ok... So that kinda worked, except now I've lost homelab to external access (both internet and home network). However home to homelab is working

peak cloak Jun 20, 2021, 11:51 AM

#

Hmm, dhcp should give the vyos router already a next-hop

#

show ip route 192.168.0.0/24

peak cloak Jun 20, 2021, 11:52 AM

#

cedar igloo Ok... So that kinda worked, except now I've lost homelab to external access (bo...

Nat rule is deleted right?

cedar igloo Jun 20, 2021, 11:52 AM

#

Yes

cedar igloo Jun 20, 2021, 11:53 AM

#

peak cloak `show ip route 192.168.0.0/24`

Just loading discord on my computer rather than phone. 1 sec

#

Known via "connected", distance 0, metric 0, best
Last update 00:06:14 ago

directly connected, eth0

peak cloak Jun 20, 2021, 11:56 AM

#

Hmm

#

Can you ping your router

#

The main one, from vyos

cedar igloo Jun 20, 2021, 11:56 AM

#

From VyOS, yes. From homelab client no

peak cloak Jun 20, 2021, 11:57 AM

#

Hmm, on a homelab client do a traceroute to your main router

cedar igloo Jun 20, 2021, 11:58 AM

#

why does traceroute need installing on ubuntu... its difficult to do that as i have no internet access

peak cloak Jun 20, 2021, 11:59 AM

#

Oh it does, weird

peak cloak Jun 20, 2021, 11:59 AM

#

cedar igloo why does traceroute need installing on ubuntu... its difficult to do that as i ...

What about pinging 1.1.1.1 from vyos

#

To check if it can ping the internet

#

It prob can

cedar igloo Jun 20, 2021, 11:59 AM

#

vyos to 1.1.1.1 works

peak cloak Jun 20, 2021, 12:00 PM

#

If that's confirmed I bet it's something between the clients and vyos

#

Yep

cedar igloo Jun 20, 2021, 12:00 PM

#

I think thats what NAT was doing before

peak cloak Jun 20, 2021, 12:01 PM

#

I think it's something in the config I forgot

#

Would it be possible for you to export the config

#

There's this export support option so it hides anything sensitive

#

You can press ? To see all available commands

cedar igloo Jun 20, 2021, 12:03 PM

#

ill just do this

#

https://pastebin.com/B8FAyZTc

Pastebin

interfaces { ethernet eth0 { address 192.168.0.12/24 ...

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

#

you may notice the interface has changed to 0.12. I set it to static (and also changed the static route)

peak cloak Jun 20, 2021, 12:04 PM

#

Ah

#

Don't see anything out of the ordinary

#

On a client can it ping the vyos router

cedar igloo Jun 20, 2021, 12:06 PM

#

yes

peak cloak Jun 20, 2021, 12:13 PM

#

gonna check my config

cedar igloo Jun 20, 2021, 12:13 PM

#

Thank you. That would be great

peak cloak Jun 20, 2021, 12:23 PM

#

hmm, I think I never saved that config

#

But your thing should work

#

Unless I'm missing something

cedar igloo Jun 20, 2021, 12:39 PM

#

all I can think of is how does VyOS know which IP to use for external traffic. NAT took care of this before

peak cloak Jun 20, 2021, 12:41 PM

#

cedar igloo all I can think of is how does VyOS know which IP to use for external traffic. ...

Wdym

#

The source ip stays the same as the clinet device

#

With nat it changes

cedar igloo Jun 20, 2021, 12:41 PM

#

like what would my root router see as the source ip if it comes from the homelab

peak cloak Jun 20, 2021, 12:42 PM

#

What's the default gateway for the client device

cedar igloo Jun 20, 2021, 12:42 PM

#

vyos

peak cloak Jun 20, 2021, 12:42 PM

#

I think that command is ip route

cedar igloo Jun 20, 2021, 12:43 PM

#

#

sorry I cant copy and paste it

peak cloak Jun 20, 2021, 12:44 PM

#

Looks fine

cedar igloo Jun 20, 2021, 1:17 PM

#

thank you for your help. It's working now. all I needed to do was enable nat after adding the static routes as you said

#

although I am pretty sure what I have now is the same as when it wasnt working...

hollow marlin Jun 20, 2021, 1:22 PM

#

@peak cloak Also I tried VyOS in my lab last night and BGP link-local is bugged out, even on latest release. Also I had it in my lab but that was the first time I was really using it and host shit its buggy. I don't know how rolling releases are in production networks

#

Logs kept showing a bind socket error, it was trying to bind to just the LL, not LL%eth0. Looks like when they changes the config hierarchy they forgot legacy config that allowed it to work.

peak cloak Jun 20, 2021, 1:33 PM

#

hollow marlin <@!222482269829332992> Also I tried VyOS in my lab last night and BGP link-local...

ah, thanks

#

from what I seen a bit recommend bird

#

or Quagga

#

kinda sucks you gotta pay a subscription for vyos stable

cedar igloo Jun 20, 2021, 1:37 PM

#

you can build stable from source

peak cloak Jun 20, 2021, 1:37 PM

#

yeah I guess

#

this guy uses BIRD 2

#

https://github.com/jlu5/ansible-dn42

GitHub

jlu5/ansible-dn42

Ansible code to configure dn42. Contribute to jlu5/ansible-dn42 development by creating an account on GitHub.

#

I guess I'll learn BIRD 2 then

#

seems better for bgp than vyos

#

Unless anyone has any other suggestions

dark elbow Jun 20, 2021, 2:59 PM

#

will i stop getting ping spike if i get better wifi

hidden socket Jun 20, 2021, 3:00 PM

#

it could but it could also be the game servers being terrible

#

are you the only 1 in the game with ping spikes and whats your current wifi?

low pond Jun 20, 2021, 3:01 PM

#

describe "better wifi", better hardware? better package from ISP? or different ISP?

#

Either ways it's not going to be huge. You wouldn't see a 120ms ping, go down to 60 or something by doing any of the above ^

dark elbow Jun 20, 2021, 3:02 PM

#

i have 10 mbps rn but ill upgrade to 500 mbps nrxt week

low pond Jun 20, 2021, 3:02 PM

#

Even the cheapest crap hardware usually, you still get like at lease 5ms to the router or so.

yea speeds don't affect ping.

clear igloo Jun 20, 2021, 3:02 PM

#

low pond Even the cheapest crap hardware usually, you still get like at lease 5ms to the ...

Speed can impact ping indirectly though by providing more throughput you have less chance for congestion with packet drops

hidden socket Jun 20, 2021, 3:03 PM

#

I sometimes have games taking 20-30mbps

#

10 wont wouldnt do it

clear igloo Jun 20, 2021, 3:03 PM

#

If you're downloading while playing that's going to impact ping and latency

hidden socket Jun 20, 2021, 3:03 PM

#

especially if you have things open in the background that 10 can drop alot

clear igloo Jun 20, 2021, 3:03 PM

#

but online play by itself needs less than 1mbps in most cases

low pond Jun 20, 2021, 3:04 PM

#

clear igloo but online play by itself needs less than 1mbps in most cases

Yea sending just packets of say where a player is standing or so, same with shooter based and Minecraft etc...

frigid pine Jun 20, 2021, 3:25 PM

#

If you have 10Mbps connection and you are utilizing whole of it the ping will get affected since ping is also a data packet.

#

traceroute is the best tool to figure out where the issue resides. either at your end or at the server end.

cedar igloo Jun 20, 2021, 3:49 PM

#

is it always best practice to use fqdn/hostname over ip when joining servers to any sort of cluster?

ebon wasp Jun 20, 2021, 4:21 PM

#

Yes, as the FQDN will mostly point to a 'distributor' (wrong term)

#

So that no server get overwhelmed

cosmic hinge Jun 20, 2021, 4:22 PM

#

How do others connect to my filezilla server? Is it a port?

ebon wasp Jun 20, 2021, 4:22 PM

#

cosmic hinge How do others connect to my filezilla server? Is it a port?

Port+IP and some NAT settings

cosmic hinge Jun 20, 2021, 4:37 PM

#

Just the Ftp port 21? And internal ip from server device right?

#

#

Should i just make an URL and paste it into here?

clear igloo Jun 20, 2021, 4:43 PM

#

I really hope you're not planning to host an FTP server on the internet

cosmic hinge Jun 20, 2021, 4:49 PM

#

What else should i do in peder to make my friends connect the the device files through the internet?

#

Order*

peak cloak Jun 20, 2021, 4:49 PM

#

cosmic hinge What else should i do in peder to make my friends connect the the device files t...

Why do they need them to access them

#

Aren't you hosting a Arma server

cosmic hinge Jun 20, 2021, 4:51 PM

#

Yea but my mates should be able to transfer mods and such from their pc’s to the nerver

#

Server

peak cloak Jun 20, 2021, 4:52 PM

#

But why

#

You are the admin

#

Pretty bad idea

cosmic hinge Jun 20, 2021, 4:53 PM

#

We are all admins:)

#

Hmu with better solutions tho

peak cloak Jun 20, 2021, 4:54 PM

#

You install everything

cedar igloo Jun 20, 2021, 6:04 PM

#

if you trust your friends, give them VPN access?

hollow marlin Jun 20, 2021, 8:08 PM

#

peak cloak Unless anyone has any other suggestions

Honestly Id stick with VyOS, the extra BGP features are of little use in your case. Even with how f'ing buggy it was just testing it

#

Also when this comes out I am going to be testing it more

peak cloak Jun 20, 2021, 8:14 PM

#

hollow marlin Honestly Id stick with VyOS, the extra BGP features are of little use in your ca...

Hmm ok, how would I get around this issue then. I'm going to submit a bug report though

hollow marlin Jun 20, 2021, 8:15 PM

#

Sounds good, I didn't see any bug reports, just the query

#

But in reality, you shouldn't be peering via link-local unless the peer allows it. There are a ton of policies required to make that work as expected within their network, not worth the effort

peak cloak Jun 20, 2021, 8:30 PM

#

hollow marlin But in reality, you shouldn't be peering via link-local unless the peer allows i...

The thing is most people prefer link-local for peering

#

I'll try setting up v6 with another peer that doesn't use link-local

hollow marlin Jun 20, 2021, 8:35 PM

#

Most do not prefer it, especially in the SP space. It might be with tunnel brokers

#

The most scalable design is IGP advertising loopbacks and iBGP peering to loopbacks. iBGP does not change the next-hop like eBGP does which breaks routing. Usually link-local peering for 6PE (routing v6 over IPv4)

tender hazel Jun 20, 2021, 9:38 PM

#

btw, I think routeros 7 actually supports 6PE

#

they haven't announced it, but a bunch of UI things lead me to believe that

#

the advertise filters now allow you to enter v6 prefixes instead of only v4 prefixes

#

the IPv6 routing table has an "MPLS" tab, just like the v4 one

#

and MPLS-TE has a "Local address Ip6" field in addition to the "Local address Ip" field

plain siren Jun 21, 2021, 12:15 AM

#

I am going to hide in here for a while

peak cloak Jun 21, 2021, 12:18 AM

#

plain siren I am going to hide in here for a while

Looking in general, why do people not google first

#

Like

#

Asking here is last resort

#

For me

plain siren Jun 21, 2021, 12:18 AM

#

peak cloak Looking in general, why do people not google first

Because word has gotten around, I am better than google since I can read.

#

Pure, unadultered, laziness.

peak cloak Jun 21, 2021, 12:21 AM

#

plain siren Because word has gotten around, I am better than google since I can read.

Just get off discord

#

Like I realize how much time I waste

#

It's too much

plain siren Jun 21, 2021, 12:21 AM

#

The second Windows "11" drops and I have my chance to laugh, I will

hollow marlin Jun 21, 2021, 12:23 AM

#

the entry for IT jobs is literally being able to google better than others....or at all for that matter

plain siren Jun 21, 2021, 12:23 AM

#

My entire career has been that

dusk saddle Jun 21, 2021, 12:52 AM

#

That's alot of different careers

#

Programming requires tons of Google, it's impossible to memorize every library

#

Networking I'm not sure of yet. Going through college again for it and only in second semester. So far it seems like once you know how everything works you should be good, aside from IOS commands.

plain siren Jun 21, 2021, 12:55 AM

#

I can say with straight confidence, you know the basics in networking, but after that, you still use google almost as much

dusk saddle Jun 21, 2021, 12:55 AM

#

For what though?

tender hazel Jun 21, 2021, 12:55 AM

#

for everything

waxen scroll Jun 21, 2021, 12:55 AM

#

hollow marlin the entry for IT jobs is literally being able to google better than others....or...

wrong. need to be senior now

tender hazel Jun 21, 2021, 12:55 AM

#

there is so much to know you can't know everything

plain siren Jun 21, 2021, 12:56 AM

#

tender hazel for everything

Honestly I was gonna try to give a good answer but yeah... thats right.

waxen scroll Jun 21, 2021, 12:56 AM

#

want a new networking career? better be senior already or located in Mumbai.

plain siren Jun 21, 2021, 12:56 AM

#

Subnet Calculators to how to configure docker with IPv6

tender hazel Jun 21, 2021, 12:56 AM

#

you're going to run into weird problems where things that you would expect to work don't

dusk saddle Jun 21, 2021, 12:56 AM

#

That's true

tender hazel Jun 21, 2021, 12:56 AM

#

people who don't know how to google waste a ton of time banging their heads against the wall trying random things

#

if you know how to look things up, you may find the answer on stackoverflow in 45 seconds or some other random site

dusk saddle Jun 21, 2021, 12:57 AM

#

If you want to learn how to use Google effectively just switch to Linux for a few months. You'll be using it all the time.

#

Linux has improved my google skills so much

tender hazel Jun 21, 2021, 12:57 AM

#

the number of times that i have helped someone with an issue that they spent hours at and I found the answer in < 60 seconds is astonishing

dusk saddle Jun 21, 2021, 12:57 AM

#

Lmao

plain siren Jun 21, 2021, 12:58 AM

#

tender hazel the number of times that i have helped someone with an issue that they spent hou...

Change 60 to literally 3-8s

#

and hours to sometimes weeks

tender hazel Jun 21, 2021, 12:58 AM

#

yeah, very often it is the first thing that comes up if you google it

dusk saddle Jun 21, 2021, 12:58 AM

#

I have people in my program now asking for help with things they supposedly spend 2 days on that I found answers for in 2 minutes. Then they think I'm some sort of magician.

plain siren Jun 21, 2021, 12:58 AM

#

dusk saddle I have people in my program now asking for help with things they supposedly spen...

Are you me?

waxen scroll Jun 21, 2021, 12:59 AM

#

@little schooner how many acrobat readers have you reinstalled

dusk saddle Jun 21, 2021, 12:59 AM

#

You're the go to guy too?

#

I made a whatapp group since my college is online due to covid and I kind of regret it

plain siren Jun 21, 2021, 12:59 AM

#

dusk saddle You're the go to guy too?

From literally how to replace a wall outlet and build a damn chair to omg my drivers are not working!

dusk saddle Jun 21, 2021, 1:00 AM

#

Man... That gets old

#

I like being helpful but there's a point where it's just too much.

#

It does help you learn too though since you're constantly recalling information

plain siren Jun 21, 2021, 1:00 AM

#

dusk saddle It does help you learn too though since you're constantly recalling information

This is the only reason I do it constantly

#

It keeps me well informed of the issues that currently are relevant

dusk saddle Jun 21, 2021, 1:01 AM

#

Build those neural pathways

#

Strengthen them

plain siren Jun 21, 2021, 1:02 AM

#

Its actually only thanks to this discord I was able to do the 2+2 on the whole PCIe Boot Device not working (NVMe Drives) suddenly a few months ago for many people

#

After fixing a few, what was seemingly random instances, It became obvious what had happened

#

Microsoft pushed a Firmware capsule that required Secure Boot and UEFI for PCIe Boot Drives due to the fact they are direct links to the CPU and thanks to the Whole TB3 Security Fail with Intel, they realized they needed to secure the path

#

Unlike SATA Drives which are PCIe <> SATA Controller <> Drive, there is no "Firewall" like the SATA Controller

#

So if you changed the firmware on a PCIe Drive to have malicious code, you could have a perm ring 1 bot

dusk saddle Jun 21, 2021, 1:04 AM

#

I never heard about that at all but I don't use Windows. Interesting though nonetheless.

plain siren Jun 21, 2021, 1:05 AM

#

Windows has gotten.. man fuck me for saying this...

#

Almost there in terms of decent.

#

Their massive push to overhaul the entire framework and security along with featuresets and standards has made huge huge huge strides for the damn thing

dusk saddle Jun 21, 2021, 1:06 AM

#

Haha, I don't mind it to be honest, it's a fast, user friendly OS.

#

For the most part. I used it for years.

#

Linux on the other hand is a giant pain in the ass sometimes

tender hazel Jun 21, 2021, 1:06 AM

#

speaking of windows, our sysadmin is probably going to be upset tomorrow that the tech bench linux system was replaced with windows yesterday

#

I really hope he doesn't complain to me about that all day, it is a huge waste of time for me

dusk saddle Jun 21, 2021, 1:07 AM

#

It was a whole ordeal to get PCIe passthrough working in KVM but now I have a windows VM with near native performance.

#

@tender hazel Why would he be mad?

tender hazel Jun 21, 2021, 1:09 AM

#

we get our first level service desk (normally people who are pretty green and just do by the book troubleshooting) to configure customer CPE devices to go out in the field

dusk saddle Jun 21, 2021, 1:09 AM

#

I guess it's more work for him

tender hazel Jun 21, 2021, 1:09 AM

#

he set up a linux desktop for that a few years ago

#

but the level 1's who are pretty green and not used to linux often say that it doesn't work and so they can't configure stuff

#

it's because other people are changing the VLAN configurations on it and other stuff like that

dusk saddle Jun 21, 2021, 1:09 AM

#

Oh it works, they don't work

tender hazel Jun 21, 2021, 1:10 AM

#

and when you have someone who is totally green who walks up to it and someone else has changed the VLAN settings on it, they don't know how to get it back to normal

dusk saddle Jun 21, 2021, 1:10 AM

#

Netplan?

#

Are you talking about configuring the vlans in a .yaml then applying with netplan?

tender hazel Jun 21, 2021, 1:11 AM

#

anyway we set up windows there instead because the service desk will be more comfortable with it

dusk saddle Jun 21, 2021, 1:11 AM

#

Yeah that's a better option

tender hazel Jun 21, 2021, 1:12 AM

#

he's been trying to get us to move to open source stuff, like we use visio for all of our network drawings but he was trying to get people to try out libreoffice draw for that instead

dusk saddle Jun 21, 2021, 1:12 AM

#

I fucking hate LibreOffice

tender hazel Jun 21, 2021, 1:12 AM

#

and we have so much going on right now, we are doing these fiber projects

dusk saddle Jun 21, 2021, 1:13 AM

#

Sorry for my language

hollow marlin Jun 21, 2021, 1:13 AM

#

Draw.io is where its at

tender hazel Jun 21, 2021, 1:13 AM

#

the cost of visio is not that great

#

I don't want people to be spending a lot of time experimenting with libreoffice or whatever because it takes time away from other critical things that have to get done

peak cloak Jun 21, 2021, 1:13 AM

#

yeah

#

foss is cool and all

#

but work is work

dusk saddle Jun 21, 2021, 1:15 AM

#

I set up WinApps. It runs a VM in the background and leverages RDP so you can launch windows applications that launch as of they were native. Threw office on that

#

Click icon, it'll open the program and you'll never see the VM

tender hazel Jun 21, 2021, 1:16 AM

#

he also wants to use linux for the field laptops but that can also be problematic, because there are certain windows apps that we rely on in the office that aren't necessarily easy to get going in WINE and it's only going to take a couple times where the tech in the field says "oh sorry, I can't run that, I'm on linux" that management is going to get upset

dusk saddle Jun 21, 2021, 1:16 AM

#

Yeah you don't want Linux on a field laptop.

#

The best option would be to dual boot them, then you get everything

tender hazel Jun 21, 2021, 1:17 AM

#

the reason he wants them on the field laptops is because people aren't going to plug them in that often necessarily and so they might be behind on updates

#

his main concerns with windows are when it comes to patch management

dusk saddle Jun 21, 2021, 1:18 AM

#

Isnt there a domain set up?

tender hazel Jun 21, 2021, 1:18 AM

#

yeah there is

#

but if they only use the laptop for field work and they go out into the field once every 3 months

dusk saddle Jun 21, 2021, 1:18 AM

#

Can't you use enforce a GP

tender hazel Jun 21, 2021, 1:18 AM

#

and aside from that it is turned off

dusk saddle Jun 21, 2021, 1:19 AM

#

There should be a group policy for Windows updates

tender hazel Jun 21, 2021, 1:21 AM

#

there is, but it doesn't help you if the system is powered off

#

or rarely plugged into the corporate network

thorn osprey Jun 21, 2021, 2:05 AM

#

Hey. I'm having trouble in my bluetooth audio. I recently got akg k361bt headphones. They work completely fine when on pc(wired and wireless) and also wired on phone but the audio in bluetooth mode on phone is way too low. I saw the option to change my bluetooth codec for that specific device to aac. However, it doesn't toggle on after I press "ok" on the risk warning pop up. I went into developer mode and changed some of the Bluetooth audio settings includig the codec but they defaulted back once I exited the settings. Enabling "disable absolute volume" did nothing

plain siren Jun 21, 2021, 2:35 AM

#

tender hazel or rarely plugged into the corporate network

Direct access

#

Its a feature that does Authentication, GPO updates, and any attempt to access internal URLs to automatically path over the VPN.

tender hazel Jun 21, 2021, 2:36 AM

#

oh

#

never heard of this

plain siren Jun 21, 2021, 2:36 AM

#

It holds the concept of a Machine and User authentication too.

#

So before login even, the machine authenticates for authentication to AD

#

Then the user after login which grants full access

#

It's apart of the windows server Direct Access Role/Feature.

#

It uses the Windows VPN Server

#

So if you got one, it's easy to push the other.

#

It also offers DNS64 and NAT64

#

Just make sure to have your IP scopes defined in the site configurations

#

I'll send the docs later.

#

(I've read wayyyyyy Too much of the MS docs at this point)

tender hazel Jun 21, 2021, 2:39 AM

#

these docs? https://docs.microsoft.com/en-us/windows-server/remote/remote-access/directaccess/directaccess

DirectAccess

You can use this topic for a brief overview of DirectAccess in Windows Server 2016.

#

if those are the docs you were going to send I probably don't need any other info

plain siren Jun 21, 2021, 2:40 AM

#

Yes

tender hazel Jun 21, 2021, 2:42 AM

#

thanks very much

plain siren Jun 21, 2021, 2:48 AM

#

@tender hazel Also you would want to most likely point the GPO at the corporate WSUS server which is the Windows Update Sever you can run. From there you can control releases, approve or deny for whatever case (breaking issues), roll back, etc, and point these updates at groups and even device types.

#

This would also allow you to report on the status of machines.

#

From that point patch management is covered

tender hazel Jun 21, 2021, 2:53 AM

#

right we already have a WSUS server

#

it fixes everything except for these weird laptops that are only rarely connected correctly to the corporate network so they end up months behind on patches

tender hazel Jun 21, 2021, 3:12 AM

#

but direct access takes care of that

#

I used to be quite up to date on windows server admin and used to be an MCSE, until around 2008 or so

#

after that point I started to work more on the ISP side

#

as a network engineer rather than a server admin

little schooner Jun 21, 2021, 3:20 AM

#

waxen scroll <@!366313443810082820> how many acrobat readers have you reinstalled

probably 700+, the patching schedule is set to run every 2 Fridays of the month.

#

I need to make a script that changes the default Adobe app in case the user has acrobat dc pro and reader installed side by side

#

common issue with that is user opens doc in wrong Adobe app that can't edit pdf document without reopening it again

#

at least 3 tickets for that

tender hazel Jun 21, 2021, 3:24 AM

#

btw @plain siren I wound up typing a super long response to that guy who thought that his Unifi firewall was doing something really weird when it comes to routing

#

https://community.ui.com/questions/Ubiquiti-Routing-in-Wonderland/c8507358-c6f3-4fc9-a065-a72fe0dc8bf0?page=1

#

my response is the one at the bottom of page 1 that is as long as his initial question

#

I replied via the ubiquiti forums instead of reddit because I figured it was more likely he would see the response

#

and I was also really irritated that he was suggesting that Ubiquiti was doing something in some weird way that nobody else does, which is not the case

#

I don't really use Unifi myself where I can avoid it

#

but he thought the Ubiquiti behavior was wrong, based only upon the subset of devices that he has tested with, and it really isn't (as was already said before)

#

I responded more so that he wouldn't think that the iptables way of doing things wasn't some backwards way that only Ubiquiti did and nobody else did

plain siren Jun 21, 2021, 3:41 AM

#

Iptables and thing kernel net functions like bridge, vxlan, whatever it may be is literally how... Like everything Linux based works.

#

It's literally like.... The net filter....

#

I...

#

Wuuuuuuuuuuuut

tender hazel Jun 21, 2021, 3:44 AM

#

I know what sort of things he is talking about - our firewall at the office is Check Point

#

we had our FOB door access system set up on a public subnet, on a VLAN routed by the Check Point

#

we had a lot of problems with it where if it lost connection for any reason it would stop working and they would have to go to our office to fix it and charge us for a service call

#

so we added a rule on the check point to allow everything from everywhere to that VLAN

#

a month or two later we got an automated notice that we had BGP open to the internet on the check point IP on that VLAN, and it wasn't only BGP but the web admin interface and everything

#

and it was all because check point doesn't have the equivalent of the INPUT chain like in iptables

#

so that one incident made it really obvious as to the justification for a separate INPUT chain (or LOCAL chain or whatever you want to call it)

plain siren Jun 21, 2021, 3:53 AM

#

I feel like if people would take a pen an paper and kinda draw the map they make with their rules, it would make WAAAAY more sense.

#

Honestly, that guy probably never setup anything but his homelab before.

tender hazel Jun 21, 2021, 4:04 AM

#

yeah I think that guy has set up a limited number of firewalls before

#

and thinks he knows how everything normally works in all cases

#

I think it is more than just a homelab

#

but it is more that he is used to how device X works and here is device Y and it isn't the same and he doesn't like it because it isn't the same

#

but he is even misunderstanding the reasons why it isn't the same

hollow marlin Jun 21, 2021, 4:17 AM

#

plain siren I feel like if people would take a pen an paper and kinda draw the map they make...

Actually many of my policies are diagramed for my own sanity. Especially focusing on specific chains where in some of our configs contain almost 1000 policies

tender hazel Jun 21, 2021, 4:18 AM

#

creating a diagram is really good, but if you misunderstand the way the system works, your diagram is not going to be accurate

hollow marlin Jun 21, 2021, 4:21 AM

#

Well in that situation the best is to hope nothing lines up as they're mapping it out and makes them wonder if they actually understand it

tender hazel Jun 21, 2021, 4:22 AM

#

like for instance that guy assumes that no firewalls have such a thing as an INPUT or LOCAL chain that handles traffic to the firewall device itself, which is not correct.. and he thinks that Ubiquiti is some weird brand for having such a thing, which is also not correct

hollow marlin Jun 21, 2021, 4:31 AM

#

It doesn't help that many vendors don't actually call the chains by name but are just policies referencing zones, interfaces or routing-instances

tender hazel Jun 21, 2021, 4:32 AM

#

yeah - that's something that Ubiquiti does with their Unifi firewall

#

they don't show you the original iptables chains, but instead show you the sub-chains that they jump to from the main chains

#

from the FORWARD chain they jump to IN-LAN or IN-WAN depending on the interface that it comes in

#

from the INPUT chain they jump to LOCAL-LAN or LOCAL-WAN depending on the interface it comes in on

#

it is already a tad confusing since they swapped FORWARD for IN and INPUT for LOCAL

#

and the similarity of IN and INPUT should have given them pause but did not

#

they don't give the ability to add rules to the original INPUT or FORWARD chains

#

only to the sub-chains they jump to from those, like IN-LAN, IN-WAN, LOCAL-LAN and LOCAL-WAN

hollow marlin Jun 21, 2021, 4:39 AM

#

Juniper is even less transparent. All policy based. It's based on BSD but I'm not sure if they are using iptables or their own

thorn osprey Jun 21, 2021, 4:40 AM

#

thorn osprey Hey. I'm having trouble in my bluetooth audio. I recently got akg k361bt headpho...

Anybody?

tender hazel Jun 21, 2021, 4:45 AM

#

@hollow marlin I'm pretty sure all BSD based stuff uses pf by default, which doesn't have the equivalent of an INPUT chain

#

with pf, a single set of firewall rules handles both traffic destined to the firewall and traffic that is forwarded through the firewall

#

@thorn osprey bluetooth stuff isn't normally considered networking

#

even though it is wireless

#

your question would be better suited for one of the tech support chats, or audio-tech

#

a few of us in here are network engineers for ISPs but know basically squat about bluetooth audio

thorn osprey Jun 21, 2021, 4:52 AM

#

tender hazel <@!409356718917681152> bluetooth stuff isn't normally considered networking

Oh ok

gilded kite Jun 21, 2021, 8:25 AM

#

does someone here have experience with swag on unraid? I want to access my nextcloud instance over http/https via dyndns.
I've set everything up so far that I reach the swag page over the domain, but now I struggle to route that to my nextcloud instance.
can someone maybe help me?

low pond Jun 21, 2021, 9:56 AM

#

god these lawsuits against speeds are so weird

peak cloak Jun 21, 2021, 10:56 AM

#

Linus doing cnc machining now...

hollow marlin Jun 21, 2021, 11:43 AM

#

What the hell is with those comments. Some bringing race into to it

low pond Jun 21, 2021, 12:41 PM

#

hollow marlin What the hell is with those comments. Some bringing race into to it

welcome to the modern world

#

only thing left is race to cisco routers.

#

so lets just hide here and pray it doesnt happen

waxen scroll Jun 21, 2021, 12:41 PM

#

low pond welcome to the modern world

this is why I want social media deleted

#

at least give me twitter

low pond Jun 21, 2021, 12:42 PM

#

theres a reason why i use no sosal media at all 🤷‍♂️

#

discord youtube, litteraly.

#

and other "private chatting" apps :P

#

but yes

waxen scroll Jun 21, 2021, 12:42 PM

#

i dislike that the people who represent us are on social media listening to the 0.1% and thinking the 99.9% like the ideas

#

:X

low pond Jun 21, 2021, 12:43 PM

#

:/

swift hornet Jun 21, 2021, 12:49 PM

#

lmao the office im working in at summer is using TKIP instead of AES

#

hahahahaa

waxen scroll Jun 21, 2021, 1:44 PM

#

where should he move instead?

thick minnow Jun 21, 2021, 1:45 PM

#

The moon seems like a nice place

waxen scroll Jun 21, 2021, 1:46 PM

#

Dad - dy Elon, take me to mars!

#

also why is that word censored

low pond Jun 21, 2021, 3:11 PM

#

thick minnow *The moon seems like a nice place*

did you call moon a place? how dare you

#

you cant assume the moon

odd osprey Jun 21, 2021, 4:41 PM

#

I'm planning on moving to the UK and getting a UK sim there, but I have all my two-step authentication messages on my current number. If I deactivate my cellular plan, will I still be able to receive these messages?

tender hazel Jun 21, 2021, 5:51 PM

#

You probably won’t be able to, no

odd osprey Jun 21, 2021, 6:29 PM

#

Hmm. I remember back when I was like 8 years old, I didn't have a data plan and my parents brought something in bulk. Then I recall running out and being unable to call or message but I could still recieve messages and calls

hollow marlin Jun 21, 2021, 6:45 PM

#

If you deactivate your plan you are releasing your number. I strongly suggest keeping it until you get a new SIM and account, eat the roaming charges and transfer all the accounts to the new number

odd osprey Jun 21, 2021, 8:49 PM

#

What about those grocery store sim cards that have no plans?

#

Do they get released one you use up the data?

#

Or do they make you pay afterwards?

tender hazel Jun 21, 2021, 9:08 PM

#

I think you are talking about pay as you go plans

#

I've always paid for monthly, not pay as you go, so I have no idea.. but I don't know why you are asking here, that is not really a networking question

waxen scroll Jun 21, 2021, 11:57 PM

#

hollow marlin If you deactivate your plan you are releasing your number. I strongly suggest ke...

muh google fi

peak cloak Jun 22, 2021, 12:54 AM

#

anyone ever used voip.ms?

#

need a voip solution

waxen scroll Jun 22, 2021, 1:56 AM

#

Avaya is pretty good

copper rover Jun 22, 2021, 2:03 AM

#

peak cloak need a voip solution

As in, an actual phone solution?

#

or purely software?

peak cloak Jun 22, 2021, 2:04 AM

#

copper rover As in, an actual phone solution?

need an actual phone

copper rover Jun 22, 2021, 2:04 AM

#

http://www.allworx.com/

All-In-One VoIP Communication Platform | Allworx

Allworx is an all-in-one VoIP communication platform that helps SMBs create a customized business phone system at an affordable price.

#

They're nice. And can forward calls to an app on a cell

peak cloak Jun 22, 2021, 2:04 AM

#

people on reddit I saw reccomended voip.ms

copper rover Jun 22, 2021, 2:05 AM

#

remote office

peak cloak Jun 22, 2021, 2:05 AM

#

the reason is that we got rid of a landline and now we realize it's actually sometimes useful, but not useful enough to pay 20 bucks a month to ISP

#

so basically we want a VOIP landline

copper rover Jun 22, 2021, 2:05 AM

#

We use Allworx. Handsets are robust and good construction. Been using them for years

#

You still need a SIP provider

peak cloak Jun 22, 2021, 2:06 AM

#

yeah that's what we need

#

and actual provider

#

voip.ms looks pretty nice and cheap

#

just need a SIP to phone converter

copper rover Jun 22, 2021, 2:07 AM

#

I'm not familiar with them. Typically go with the ISP for SIP connectivity. You don't have to, but..

#

All on one bill

peak cloak Jun 22, 2021, 2:08 AM

#

copper rover I'm not familiar with them. Typically go with the ISP for SIP connectivity. You ...

verizon is 20 additional dollars per month

#

too expensive

#

for something that we will use very little

#

but it's a good to have

copper rover Jun 22, 2021, 2:10 AM

#

Eh, it might suffice. I work in a physical office and often at home too. So I've got a physical handset in both locations. I do a lot of placing and receiving calls, forwarding, and conference calling. So, it's getting its use 🙂

hollow marlin Jun 22, 2021, 2:45 AM

#

Mitel is solid for a HW for, probably have a handful no longer used. We have 10,000s out there. For a sip gateway just get a Cisco SPA. Cheap and small

coarse storm Jun 22, 2021, 3:30 AM

#

my internet has been super duper slow these past few days. i’ve hard reset the router called my isp more than once they say nothing is wrong but i can’t even load a snap on my phone idk what’s wrong

#

like not even a mbps down slow

coarse storm Jun 22, 2021, 5:03 AM

#

hey is anyone active in here?

frigid pine Jun 22, 2021, 6:08 AM

#

coarse storm my internet has been super duper slow these past few days. i’ve hard reset the r...

Tried speedtest, ping, traceroute tools?

frigid pine Jun 22, 2021, 7:51 AM

#

Have anyone encountered this?

lean pebble Jun 22, 2021, 8:59 AM

#

Hey guys, what do you think about Synology Nas for home and server backups?

frigid pine Jun 22, 2021, 9:16 AM

#

Yeah. seems so. Need to explain this to the stupid vendor who always says "there's no problem on our side".

frigid pine Jun 22, 2021, 9:38 AM

#

check the broadcast vs paused. xD

lean pebble Jun 22, 2021, 9:47 AM

#

🤣

#

Sounds like my ISP.
Finally now I can say ISP they are not separated anymore for ISP and internet infrastructure

frigid pine Jun 22, 2021, 9:59 AM

#

frigid pine Yeah. seems so. Need to explain this to the stupid vendor who always says "there...

Fortunately, the vendor accepted that there is some crunch at his side. I am surprised. xD

humble cloak Jun 22, 2021, 10:11 AM

#

Hey anyone that can help? My dad and I have a 1220E and a 1260E that refuse to request a new IP address from the 7590 (all fritzbox and all in a mesh network). The third 1260E did request a new ip

humble cloak Jun 22, 2021, 10:44 AM

#

Everything is static

#

Because it’s the wrong up

#

Up

#

Ip

#

Stupid autocorrect

#

Like, it’s 151 instead of the 56

#

That it should be

#

“On next request it will change”

#

But we’ve had them out of the plug for over an hour and still no change

ruby knoll Jun 22, 2021, 10:46 AM

#

Hello guys im having a headache with a LHG2 mikrotik antenna. I cant event connect to it using winbox. At this point im not sure if its even working. I tried resetting but the ritual seems weird and doesnt seem to have done anything... the ETH led is pulsating constantly and the Wireless led powers on for a slight on very long intervals. Need some help here cuzz ive never dealt with such networking device

#

a fuck that shit... now what

#

im sure i didnt held too long but...

#

RTFM ?

#

readthefmanual i get it ok

#

yeah i read the manual, and tried to keep it down for 5 seconds untill the USR starts flashing

#

then immediately let go

#

uhhh its been like this for like 15 at least

#

perhaps i should do it gain ?

#

well not fast fast but pulsating

#

nvm it is flashing fast

sour beacon Jun 22, 2021, 10:51 AM

#

Could the FTP protocol be used in place of ethernet if software allowed it? Such as using FTP to connect a modem to a router rather than using a standard ethernet cable?

ruby knoll Jun 22, 2021, 10:52 AM

#

oh so i shouldnt hold the reset when im powering it ? i guess thats where i went wrong

sour beacon Jun 22, 2021, 10:52 AM

#

@tame carbon Could the FTP protocol be used in place of ethernet if software allowed it? Such as using FTP to connect a modem to a router rather than using a standard ethernet cable?

ruby knoll Jun 22, 2021, 10:53 AM

#

i see, ok imma try that again and leave it for some time - wish me luck

sour beacon Jun 22, 2021, 10:53 AM

#

So that uhh, prevents it from doing what exactly?

peak cloak Jun 22, 2021, 10:55 AM

#

sour beacon Could the FTP protocol be used in place of ethernet if software allowed it? Such...

ftp runs on tcp which runs on ip, which runs on ethernet protocol which runs on wifi or wires

sour beacon Jun 22, 2021, 10:55 AM

#

Ohhh ok i gotcha, thank you. I'll look up the OSI Model as well.

lean pebble Jun 22, 2021, 10:56 AM

#

One ISP in my country starting to provide FTTR instead gpon

frigid pine Jun 22, 2021, 10:56 AM

#

sour beacon Ohhh ok i gotcha, thank you. I'll look up the OSI Model as well.

You must understand the OSI before getting technical with the network.

sour beacon Jun 22, 2021, 10:57 AM

#

Omg Crystal you deserve an award linusHEH

frigid pine Jun 22, 2021, 10:57 AM

#

ruby knoll oh so i shouldnt hold the reset when im powering it ? i guess thats where i went...

I usually keep the reset pressed and then power the device on. The usr starts blinking and I let it go. Sometimes you need to do it multiple times.

#

EM Waves* 😛

#

wut!

#

photons are light man

sour beacon Jun 22, 2021, 10:59 AM

#

This is the most responsive channel i swear, thanks fellas

frigid pine Jun 22, 2021, 10:59 AM

#

huh. never heard like that lol. let me search.

#

uh yeah they are basically photons. lel.

sour beacon Jun 22, 2021, 11:00 AM

#

#

Sheesh

frigid pine Jun 22, 2021, 11:01 AM

#

5G caused Corona xD

sour beacon Jun 22, 2021, 11:02 AM

#

So uhh whats a good resource for finding more out about the osi model

peak cloak Jun 22, 2021, 11:02 AM

#

layer 5+ idk about

ruby knoll Jun 22, 2021, 11:02 AM

#

frigid pine I usually keep the reset pressed and then power the device on. The usr starts bl...

ok just got back its still doing the same light blinkling pattern so imma see what i can do to flash it

peak cloak Jun 22, 2021, 11:02 AM

#

sour beacon So uhh whats a good resource for finding more out about the osi model

hands on experience

clear igloo Jun 22, 2021, 11:03 AM

#

Layer 8 is cool 😛

frigid pine Jun 22, 2021, 11:03 AM

#

ruby knoll ok just got back its still doing the same light blinkling pattern so imma see wh...

Try using Netinstall if you are unable to reset the device.

clear igloo Jun 22, 2021, 11:03 AM

#

Layer 0 - Power
Layer 8 - People

#

yah

ruby knoll Jun 22, 2021, 11:04 AM

#

@frigid pine ok imma see what i can find in google about this

frigid pine Jun 22, 2021, 11:04 AM

#

clear igloo Layer 0 - Power Layer 8 - People

TCP model: WHAAAAAT!

sour beacon Jun 22, 2021, 11:05 AM

#

I'm not sure if im quite ready to dive in networking 😂 still don't know much about the basica

peak cloak Jun 22, 2021, 11:05 AM

#

#

@sour beacon

carmine moss Jun 22, 2021, 11:05 AM

#

Yeah or look for a free ccna1 course

clear igloo Jun 22, 2021, 11:05 AM

#

Networking is fun but you have to just dive in sometimes and try to swim

peak cloak Jun 22, 2021, 11:06 AM

#

carmine moss Yeah or look for a free ccna1 course

idk anything about ccna

carmine moss Jun 22, 2021, 11:06 AM

#

There is one from networkchuck on YouTube

peak cloak Jun 22, 2021, 11:06 AM

#

urgh

#

he's

#

...

sour beacon Jun 22, 2021, 11:06 AM

#

Im drowning already lol

clear igloo Jun 22, 2021, 11:06 AM

#

he's interesting, lol

#

the what not to do XD

frigid pine Jun 22, 2021, 11:07 AM

#

peak cloak he's

Coffee? xD

carmine moss Jun 22, 2021, 11:07 AM

#

Ccna1 is just is just osi and the other basics

clear igloo Jun 22, 2021, 11:07 AM

#

There is no CCNA1 and 2 anymore, it's just a single exam now

carmine moss Jun 22, 2021, 11:07 AM

#

Yeah annoying it changed

peak cloak Jun 22, 2021, 11:08 AM

#

I only have HE ipv6 and some intro to packet tracer thing

clear igloo Jun 22, 2021, 11:08 AM

#

yah, I was so close to passing my CCIE Data Center a couple years back too, right before they changed it and I couldn't get another attempt in before that date ;-;

carmine moss Jun 22, 2021, 11:08 AM

#

Networkchuck free ccna isn't bad per say but only checked a few minutes as I know the things

clear igloo Jun 22, 2021, 11:08 AM

#

Yup, I would say 90% is just experience alone for me

frigid pine Jun 22, 2021, 11:09 AM

#

Here in India, What's written on your CV doesn't matter unless you have a certificate go with it. So now I am trying to get CCNA finally. :/

thorn stratus Jun 22, 2021, 11:10 AM

#

lol

clear igloo Jun 22, 2021, 11:10 AM

#

Nice!

frigid pine Jun 22, 2021, 11:11 AM

#

BTW whats the difference between Masquerade and NAT?

carmine moss Jun 22, 2021, 11:11 AM

#

I just got the old ccna 1 and 2 certs. And know like half of ccna 3

clear igloo Jun 22, 2021, 11:11 AM

#

oof

#

yah, I know that feeling

#

yah, that stinks

#

yikes, sounds like my first college I went to

#

Except they were the opposite

#

Made you buy books and stuff with 0 lines of code, made you write code for the class

#

My google-fu was strong that year

#

that's really cool

#

yup

#

haha, yes

#

of course, why prompt you 😛

#

I always like to joke "that's a license"

#

oh boy

#

HA!

ruby knoll Jun 22, 2021, 11:20 AM

#

Sooooo this mikrotik antenna won't even show up in the netinstall list of devices. I tried holding the reset button for 15seconds in order to get it to look for netinstall servers but it's still doing the same stuff with the LEDs and windows network connections keeps showing "disconnected" on regular intervals

frigid pine Jun 22, 2021, 11:21 AM

#

ruby knoll Sooooo this mikrotik antenna won't even show up in the netinstall list of device...

prolly the device port is fried if you hv already tried changing the cable/connectors.

ruby knoll Jun 22, 2021, 11:22 AM

#

Tried ...

#

Thanks anyways :/

frigid pine Jun 22, 2021, 11:23 AM

#

Make sure you computer port is working fine

ruby knoll Jun 22, 2021, 11:27 AM

#

It should be I have been using it without issues for a very long time

frigid pine Jun 22, 2021, 11:34 AM

#

Whats the difference between Masquerade and NAT?

peak cloak Jun 22, 2021, 11:45 AM

#

frigid pine Whats the difference between Masquerade and NAT?

Masquerade is a type of Nat

#

specifically

#

it's a type of source nat

frigid pine Jun 22, 2021, 11:47 AM

#

peak cloak Masquerade is a type of Nat

Ok. Any specific application of that?

peak cloak Jun 22, 2021, 11:47 AM

#

https://help.mikrotik.com/docs/display/ROS/NAT

peak cloak Jun 22, 2021, 11:47 AM

#

frigid pine Ok. Any specific application of that?

your internet connection

#

it's most likely Masqueraded

low pond Jun 22, 2021, 11:48 AM

#

huh i've never heard of Masquerade

peak cloak Jun 22, 2021, 11:48 AM

#

default (except the name) config

peak cloak Jun 22, 2021, 11:48 AM

#

peak cloak https://help.mikrotik.com/docs/display/ROS/NAT

was designed for specific use in situations when public IP can randomly change, for example, DHCP server change assigned IP or PPPoE tunnel after disconnect gets different IP, in short - when public IP is dynamic.

frigid pine Jun 22, 2021, 11:49 AM

#

Hmmm so it's just snat when WAN IP is changeable.

peak cloak Jun 22, 2021, 11:50 AM

#

basically

#

Though Source NAT and masquerading perform the same fundamental function: mapping one address space into another one, the details differ slightly. Most noticeably, masquerading chooses the source IP address for the outbound packet from the IP bound to the interface through which the packet will exit.

frigid pine Jun 22, 2021, 11:52 AM

#

Ohkay. I think I got it.

#

👍

peak cloak Jun 22, 2021, 12:06 PM

#

yes, masquerade is when the ip can change

#

but you can manually put in the translation address

frigid pine Jun 22, 2021, 12:09 PM

#

You did not say much about Masquerade.

#

What I understood is, Masquerade hides a local pool behind one IP. So basically it is translating all local IPs to the router IP.

peak cloak Jun 22, 2021, 12:12 PM

#

that's just src nat?

#

no?

#

frigid pine Jun 22, 2021, 12:13 PM

#

peak cloak Jun 22, 2021, 12:14 PM

#

yeah

tender hazel Jun 22, 2021, 1:22 PM

#

masquerade puts a much heavier load on the device in cases where you have a static IP

#

the load on the device increases as you have more interfaces, so the load is particularly bad for PPPoE servers or other types of PPP VPN servers where each remote user creates an interface

humble cloak Jun 22, 2021, 3:26 PM

#

yes

frigid pine Jun 22, 2021, 3:51 PM

#

tender hazel masquerade puts a much heavier load on the device in cases where you have a stat...

But why would we do masquerade instead of snat when we have a static IP?

peak cloak Jun 22, 2021, 3:51 PM

#

frigid pine But why would we do masquerade instead of snat when we have a static IP?

from my understanding, then you don't need to use masquerade

frigid pine Jun 22, 2021, 3:53 PM

#

yes. snat is much faster and lighter on the CPU since it doesn't have to re-calibrate the mappings every-time a link goes down.

hollow marlin Jun 22, 2021, 3:58 PM

#

There isnt really any CPU difference between the two. The biggest impact just revolves around number of routes. Every interface adds a connected route, so as you add dynamic interfaces the route table grows.

frigid pine Jun 22, 2021, 4:00 PM

#

Maybe CPU won't be significant in a small LAN. But it would surely be significant with a considerably bigger LAN env.

hollow marlin Jun 22, 2021, 4:02 PM

#

NAT has an impact on CPU and yes more so on a larger network with more state to parse, but there is no difference in CPU with a static vs dhcp IP.

peak cloak Jun 22, 2021, 4:04 PM

#

hollow marlin NAT has an impact on CPU and yes more so on a larger network with more state to ...

what about plain src-nat vs masquerade?

hollow marlin Jun 22, 2021, 4:04 PM

#

Semantics

frigid pine Jun 22, 2021, 4:06 PM

#

With static the nat mappings are stored in cache and don't need to be remapped. But with dynamic all mappings need to be recreated every time a link goes down which puts load on the CPU.

hollow marlin Jun 22, 2021, 4:06 PM

#

Those are two entirely different points

frigid pine Jun 22, 2021, 4:07 PM

#

This is what I have read up till now that is and logically makes sense. But practically may be insignificant.

frigid pine Jun 22, 2021, 4:07 PM

#

hollow marlin Those are two entirely different points

please elaborate

hollow marlin Jun 22, 2021, 4:15 PM

#

NAT tables and interfaces flapping are two different impact to the CPU.

Interface comes up, route is created, address is added to the route table. Thats just a one time CPU hit. Nothing related to NAT.
Transit traffic gets processed, looks at the routing table, looks at NAT rules, header is swapped and mapped in the NAT table based on outgoing interface. Now every matching packet that is in transit after that point has a mapping and is matched earlier on in the chain and forwarded on (fasttrack).

#

This same process happen whether its static or dynamic addresses

hollow marlin Jun 22, 2021, 5:46 PM

#

Interesting. Id still like to get my hands on one

frigid pine Jun 22, 2021, 6:00 PM

#

Who appreciates their own competition. 😀

#

I thought you were talking about flexoptics

hollow marlin Jun 22, 2021, 6:33 PM

#

Previous work place had 1000s of FS optics. Overall I would say they are a decent alternative

#

Nope, that the first Ive heard of them

#

Interesting. I know FS's just has a web interface or maybe just CLI

#

Sounds like they sell you the programmer and unprogrammed SFPs

#

I signed up for the FS beta when they first released it but never got in. I think it still exist, at least was like $200 at the time

#

https://www.fs.com/products/96657.html Yeah $219

FS

FS Box, Multi-Functional Transceiver Tool Kit, Support FS Transceiv...

FS Box, Multi-Functional Transceiver Tool Kit, Support FS Transceivers & DAC/AOC Cables,Part Number:FS-BOX-V3:Supported Form Factors:SFP, SFP+, XFP, SFP28, QSFP+, QSFP28,Part Number:FS-BOX-V3:Supported Form Factors:SFP, SFP+, XFP, SFP28, QSFP+, QSFP28:Supported Operating Systems:Windows (10 or newer), Mac OS (10.13 or newer):Supported Browsers:C...

#

Same thing for the FS one if you look at the docs

#

Yep, plug it in run the windows/mac app, choose vendor or custom and hit ok

rough estuary Jun 22, 2021, 6:44 PM

#

I need help answering a question, does the Google WiFi access points work with Google Nest WiFi?

#

Yes it does! I should have just googled it

peak cloak Jun 22, 2021, 6:49 PM

#

rough estuary Yes it does! I should have just googled it

tip

#

always google everything

#

before asking

#

it's all IT people do

clear igloo Jun 22, 2021, 6:54 PM

#

peak cloak *it's all IT people do*

Hey! I resemble that remark 😛

low pond Jun 22, 2021, 7:02 PM

#

I've heard that certain routers complain if ya use a tranciever which isnt from them itself

#

like FS's one

clear igloo Jun 22, 2021, 7:06 PM

#

Depends on how its programmed, some will just let you know it's unsupported as a log message only, others might not work unless you tell it to allow "unsupported" stuff

#

If you put a specific transceiver programmed for say Intel NICs in a Juniper router it might not work, all depends though

rough estuary Jun 22, 2021, 7:12 PM

#

peak cloak before asking

I like the human touch also

clear igloo Jun 22, 2021, 7:16 PM

#

Yah

#

yah, or they figure the investment vs time cost to program large amounts isn't worth it

low pond Jun 22, 2021, 7:22 PM

#

a friend is on Gighabyte connection, same with the cloud server, a gigabyte connection. uploading a largeass 1.4+TB file archieve over

#

sadly only peaking 45MB/s

#

;-;

#

over sftp

#

well okay it goes to 55MB/s too

#

whats a reliable way anyway to upload hugeass files like this? sftp or any other thing? i mean i guess we could use torrent as even if the connection dies compeltly u could just restart with current progress, if sftp dies kek you'd do the whole thing again

peak cloak Jun 22, 2021, 7:25 PM

#

low pond a friend is on Gighabyte connection, same with the cloud server, a gigabyte conn...

so transfering local files to a computer in the cloud?

#

also

#

gigabyte?

#

that would be 10 gigabit connection

low pond Jun 22, 2021, 7:26 PM

#

I meant gigabit. opsies :P

peak cloak Jun 22, 2021, 7:26 PM

#

low pond I meant gigabit. opsies :P

just because the speeds are gigabit doesn't mean the link between is gigabit

#

like

#

an ISP link somewhere between them could be congested

low pond Jun 22, 2021, 7:27 PM

#

it only hops one IP transit in between, core-backbone to aorta, and the whole trip is less than 29ms too

#

i'd expect it to actually be pretty good link in between

hollow marlin Jun 22, 2021, 8:19 PM

#

low pond it only hops one IP transit in between, core-backbone to aorta, and the whole tr...

bandwidth delay product even with that latency, a single stream's throughput would be crippled. As Crystal said, when trying to push that type of throughput, multiple streams are really the only option

waxen scroll Jun 22, 2021, 10:57 PM

#

3ms sucks for a database

crisp bay Jun 22, 2021, 10:59 PM

#

does anyone know what "software" or config is good for your own VPS service provider? I have 5 server boxes, 12 VPS's, I want to achieve to host them or sell them..

slow pivot Jun 22, 2021, 11:01 PM

#

crisp bay does anyone know what "software" or config is good for your own VPS service prov...

There is a whole other level you have to think about when you charge for VPS/VMs; QoS between VMs, backups in case something you do nukes a VM host by mistake

peak cloak Jun 22, 2021, 11:12 PM

#

crisp bay does anyone know what "software" or config is good for your own VPS service prov...

to make your own VMs?

crisp bay Jun 22, 2021, 11:27 PM

#

I have VM's ready with Proxmox

crisp bay Jun 22, 2021, 11:28 PM

#

slow pivot There is a whole other level you have to think about when you charge for VPS/VMs...

yeah I know that, but since it's a project and that I have an opportunity to do it, I can do it

peak cloak Jun 22, 2021, 11:28 PM

#

crisp bay I have VM's ready with Proxmox

I don't understand what you want to do then

#

make your own cloud?

#

like

#

make vm setup really ez?

crisp bay Jun 22, 2021, 11:28 PM

#

yeah, I want to host people VPS's

#

like I want to be a VPS provider

peak cloak Jun 22, 2021, 11:29 PM

#

at home?

crisp bay Jun 22, 2021, 11:29 PM

#

at school

#

I have them at school

peak cloak Jun 22, 2021, 11:29 PM

#

where will you get customers?

crisp bay Jun 22, 2021, 11:29 PM

#

I'll get them dw kekw

peak cloak Jun 22, 2021, 11:30 PM

#

you would need to build your own software stack and such

#

unless some already exist

crisp bay Jun 22, 2021, 11:30 PM

#

theres no open-source software to do such thing?

peak cloak Jun 22, 2021, 11:31 PM

#

https://github.com/UCCNetsoc/cloud

GitHub

UCCNetsoc/cloud

Micro cloud VPS & container hosting system (visit https://tutorial.netsoc.co to use) - UCCNetsoc/cloud

crisp bay Jun 22, 2021, 11:31 PM

#

I have googled some but all of them are saying how to resell VPS haha

crisp bay Jun 22, 2021, 11:31 PM

#

peak cloak https://github.com/UCCNetsoc/cloud

ooh I'll look into it

peak cloak Jun 22, 2021, 11:31 PM

#

https://wiki.netsoc.co/en/services/tutorial

Wiki | UCC Netsoc

Tutorial

A guide on how to get started using the UCC Netsoc services

#

this if of course for their service

#

you would need to fork the repo

#

crisp bay Jun 22, 2021, 11:32 PM

#

yeah

peak cloak Jun 22, 2021, 11:32 PM

#

so basically you can't use the same name to promote it

#

shouldn't be a problem

#

also be warry of the legal implications

#

does the school know you are doing this?

#

is this a school project

crisp bay Jun 22, 2021, 11:34 PM

#

peak cloak does the school know you are doing this?

the IT manager knows this

peak cloak Jun 22, 2021, 11:34 PM

#

also this

#

http://www.virtualizor.com/

crisp bay Jun 22, 2021, 11:37 PM

#

oh, this would work with existing Proxmox or do I have to re-setup?

peak cloak Jun 22, 2021, 11:38 PM

#

crisp bay oh, this would work with existing Proxmox or do I have to re-setup?

¯_(ツ)_/¯

crisp bay Jun 22, 2021, 11:38 PM

#

I'll give it a try though

peak cloak Jun 22, 2021, 11:38 PM

#

peak cloak http://www.virtualizor.com/

apparently this is also paid

#

fyi

crisp bay Jun 22, 2021, 11:38 PM

#

yeah I saw pricing

peak cloak Jun 22, 2021, 11:38 PM

#

peak cloak https://github.com/UCCNetsoc/cloud

this looks good tho

#

need to mod it

#

frontend seems to be in vue

crisp bay Jun 22, 2021, 11:39 PM

#

okay but in case it's a school project, it doesn't have to be forked?

peak cloak Jun 22, 2021, 11:39 PM

#

crisp bay okay but in case it's a school project, it doesn't have to be forked?

you need to mod it

#

so that's what forking is

crisp bay Jun 22, 2021, 11:40 PM

#

ah right...

plain siren Jun 23, 2021, 2:12 AM

#

crisp bay yeah, I want to host people VPS's

WHMCS

lean pebble Jun 23, 2021, 2:49 AM

#

Blesta

strong mulch Jun 23, 2021, 3:48 AM

#

I have a weird thing going on with my internet

#

And I'm not sure what the deal is so I'm hoping someone here can help explain to me what's going on

#

So my internet is down right?

#

Cant connect to websites, router shows no internet, my neighbors internet also isn't working entirely

#

However Steams chat thing works, and the telegram desktop app about have connection

#

Now I also even on data cannot connect to my ISPs website

#

So how the fuck does that work? Lol like what fucks up so that I do and don't have internet?

primal ice Jun 23, 2021, 3:59 AM

#

the dns server you are using - probably your isp's died. change your dns to 1.1.1.1 or 8.8.8.8

#

these are the dns servers I use.

strong mulch Jun 23, 2021, 4:04 AM

#

You're not like direct connecting to me to like something that's gonna like fuck my pc up are ya? Lol

#

The fuck lol

#

Thank you glad that fixed it

#

When they fix theirs should I go back to getting automatically from my isp?

primal ice Jun 23, 2021, 4:05 AM

#

up to you you do not have to use the ISP's

strong mulch Jun 23, 2021, 4:07 AM

#

Oh also my router has options for a 2nd and 3rd dns should I fill those in too?

primal ice Jun 23, 2021, 4:08 AM

#

you can 1.1.1.1 1.0.0.1 is cloudflare 8.8.8.8 8.8.4.4 is google 9.9.9.9 149.112.112.112 is quad 9

strong mulch Jun 23, 2021, 4:08 AM

#

Okay cool sorry for all the questions after Networking is something I know very very little about

low pond Jun 23, 2021, 7:17 AM

#

lean pebble Blesta

both whmcs blesta paid 😆

lean pebble Jun 23, 2021, 7:23 AM

#

Yap

#

But WordPress doesn't

low pond Jun 23, 2021, 7:39 AM

#

yea but a panel for billing and shit sadly ya goota use the WHMCS crap

#

how are private/special made panels better than this

#

Like DO or hetzner

#

😆

lean pebble Jun 23, 2021, 8:54 AM

#

Hey guys, how can I connect truenas as client of webdav or smb

zinc crystal Jun 23, 2021, 10:48 AM

#

Please help

opaque stirrup Jun 23, 2021, 12:26 PM

#

anyone tried one of these i would like to get one or does anyone know anything similar around this price range i dont really want a tp link mesh wifi device as my main router

waxen scroll Jun 23, 2021, 12:39 PM

#

@hollow marlin would you use that? its carrier class!

peak cloak Jun 23, 2021, 12:40 PM

#

opaque stirrup anyone tried one of these i would like to get one or does anyone know anything s...

that will not work as your main home router

opaque stirrup Jun 23, 2021, 12:41 PM

#

@peak cloak explain?

peak cloak Jun 23, 2021, 12:41 PM

#

it's literally 1 ethernet port

opaque stirrup Jun 23, 2021, 12:41 PM

#

its 2

peak cloak Jun 23, 2021, 12:41 PM

#

oh, I see now

#

still

#

would not reccomend

opaque stirrup Jun 23, 2021, 12:41 PM

#

how still lmao why?

peak cloak Jun 23, 2021, 12:41 PM

#

could it work, maybe

#

but it will be trash

opaque stirrup Jun 23, 2021, 12:42 PM

#

ok explain again how it will be trash?

#

you havent seen any information on it

peak cloak Jun 23, 2021, 12:42 PM

#

for 50 bucks you could get something better like a HEX or ER-X

peak cloak Jun 23, 2021, 12:42 PM

#

opaque stirrup ok explain again how it will be trash?

cpu perf

#

also forget about wifi

opaque stirrup Jun 23, 2021, 12:43 PM

#

dont need wifi

peak cloak Jun 23, 2021, 12:43 PM

#

then get a HEX

#

it's like 10 bucks more

#

but much better, as it's designed to be an actual router

#

or ER-X works as well

#

https://mikrotik.com/product/RB750Gr3

MikroTik

MikroTik is a Latvian company which was founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for Internet connectivity in most of the countries around the world.

#

https://www.ui.com/edgemax/edgerouter-x/

Ubiquiti - EdgeRouter™ X

The EdgeRouter™X delivers cost-effective routing performance in an ultra‑compact form factor.

opaque stirrup Jun 23, 2021, 12:47 PM

#

hmm

#

so this thing would stand inbetween my modem and my home network?

peak cloak Jun 23, 2021, 12:49 PM

#

well it would route

#

so yes

#

what is "home network"

#

a switch?

opaque stirrup Jun 23, 2021, 12:50 PM

#

how would my guest wifi work with like a mesh wifi system i put all my dodgy hardware on it

peak cloak Jun 23, 2021, 12:50 PM

#

?

#

VLANs

opaque stirrup Jun 23, 2021, 12:51 PM

#

then i need new switches lmao

#

lmao wonder if a triple NAT would work 🤔

peak cloak Jun 23, 2021, 12:51 PM

#

lol wut

#

what are you trying to do

#

NOO

opaque stirrup Jun 23, 2021, 12:51 PM

#

lmao running double nat just now

peak cloak Jun 23, 2021, 12:51 PM

#

why

opaque stirrup Jun 23, 2021, 12:52 PM

#

i have to have double nat just now as my modem runs better in router mode because its extremely flawed

crisp bay Jun 23, 2021, 2:52 PM

#

opaque stirrup anyone tried one of these i would like to get one or does anyone know anything s...

does it have to be RPI only or you're comfortable with Arduino module?

waxen scroll Jun 23, 2021, 2:57 PM

#

@peak cloak why yes, a LAN is a switch

plain siren Jun 23, 2021, 3:17 PM

#

waxen scroll <@!222482269829332992> why yes, a LAN is a switch

Talk about bananas vs car engine.

waxen scroll Jun 23, 2021, 3:20 PM

#

one sounds kinky the other painful

crisp bay Jun 23, 2021, 3:36 PM

#

@plain siren would you help me with this please? I have set up wireguard VPN ("tunnel" between VPS and home server on port 25565), on Cloudflare I changed the DNS IP to my VPS one, replacing my home public IP. The moment I changed the DNS IP, I haven't lost communication between the node and the panel, but I can't connect to a Minecraft server using the domain. I think I need to change something but I don't know what. It's all for Pterodacyl..

worthy tusk Jun 23, 2021, 3:40 PM

#

anyone here good with proxmox? Im having issues with accessing the web interface

#

if you could help, please send me a friend req

plain siren Jun 23, 2021, 3:47 PM

#

crisp bay <@!589542595341058048> would you help me with this please? I have set up wiregua...

Ok ok lets back up

#

Are you trying to use the VPS as a way to expose your MC Server runing on your Home Server?

#

Ideally you should have 2 DNS Entries, one for something like "home.domain.tld" which points to your home IP and one like "vps.domain.tld" which points to VPS.

crisp bay Jun 23, 2021, 3:50 PM

#

yes, I have domain.tld which points to a home server and mcmgr.domain.tld that points to a VPS (panel), that works, but exposes my public IP

plain siren Jun 23, 2021, 3:51 PM

#

Now, wireguard would use these as a way to find the endpoints, but internally, a Wireguard VPN has its own "LAN" IP's which you use to communicate between the 2 endpoints inside the VPN.

crisp bay Jun 23, 2021, 3:51 PM

#

yeah tried pinging 192.168.6.2 that I set up, it works

#

the communication between VPS and home server trough VPS works, but since I changed domain IP in CF, I can no longer access the domain in Minecraft, so that's why I was wondering what I missed

plain siren Jun 23, 2021, 3:53 PM

#

Ok, so you would need to tell the VPS to take all traffic on 25565 on its Public IP and route it (NAT Basically) through the Wireguard VPN to your MC Server.

crisp bay Jun 23, 2021, 3:53 PM

#

yeah I don't know how to do it..or what to modify

plain siren Jun 23, 2021, 3:54 PM

#

IP Tables is the play here

crisp bay Jun 23, 2021, 3:54 PM

#

you mean that I'd allow a specific IP going trough 25565?

plain siren Jun 23, 2021, 3:55 PM

#

iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination 192.168.6.WHATEVERHOMEMCSERVERIS:25565

#

"DNAT" or Destination NAT.

crisp bay Jun 23, 2021, 3:55 PM

#

I'd need to look up the ufw, home server uses ufw and VPS uses iptables..

plain siren Jun 23, 2021, 3:56 PM

#

However, this would only route TO your MC Server from the VPS, you also need to tell the Home MC to route BACK to VPS also

crisp bay Jun 23, 2021, 3:56 PM

#

yeah I know, need to look up what I should set up in ufw

plain siren Jun 23, 2021, 3:57 PM

#

IIRC, IPTables is still used

crisp bay Jun 23, 2021, 3:57 PM

#

oh right, I remember doing iptables -L and I would see ufw rules too

plain siren Jun 23, 2021, 3:58 PM

#

Use SNAT or MASQUERADE to make sure the route back is the same so your servers think the traffic comes from wireguard interface and not the internet

#

Else itll just take default route back and try to send the return data to the internet..

#

And your MC Client will be like "What teh fuck, thats not where I requested the server?!"

#

"Das a whole diff public IP!"

crisp bay Jun 23, 2021, 3:59 PM

#

yup

crisp bay Jun 23, 2021, 3:59 PM

#

plain siren `iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination 192...

so this would fit my case or I should use SNAT or MASQUERADE?

plain siren Jun 23, 2021, 4:00 PM

#

You need both.

#

Thats just from VPS to MC Server.

#

The MC Server to VPS would be either SNAT or MASQUERADE

#

Else you get
MC User > VPS >(Wireguard)> Home Public IP > MC Server
MC User < Home Public IP < MC Server

#

And that aint where the MC User is expecting to get its data from.

crisp bay Jun 23, 2021, 4:02 PM

#

yup, I'll look and try doing it..

#

the domain IP on CF should be VPS's IP?

plain siren Jun 23, 2021, 4:03 PM

#

Yeah, i would use the following A rules I stated above then CNAME mc.domain.tld to vps.domain.tld

#

SNAT should do the following
MC User < VPS < (Wireguard) < MC Server, so basically just SNAT any traffic on 25565 back up to the VPS.

crisp bay Jun 23, 2021, 4:04 PM

#

I have CNAME for panel access

#

and for accessing MC server I'm gonna use the domain only, not subdomain..

plain siren Jun 23, 2021, 4:05 PM

#

mcpanel.domain.tld > CNAME > vps.domain.tld
@ > CNAME > vps.domain.tld
vps.domain.tld > A Record > VPS IP

#

@ represents the root domain typically.

crisp bay Jun 23, 2021, 4:12 PM

#

iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination 192.168.6.1:25565 for VPS and iptables -t nat -A PREROUTING -p tcp --dport 25565 -j SNAT --to-destination 192.168.6.2:25565 for home server?

plain siren Jun 23, 2021, 4:13 PM

#

crisp bay `iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination 192...

https://gist.github.com/tomasinouk/eec152019311b09905cd Heres a good ref for SNAT/DNAT examples

crisp bay Jun 23, 2021, 4:16 PM

#

yeah already on it

plain siren Jun 23, 2021, 4:17 PM

#

Frankly, despite my abilities, I am absolutely trash at IPTABLES Rules else I would give you the actual command. As ironic as that is.

crisp bay Jun 23, 2021, 4:17 PM

#

oof okay..

plain siren Jun 23, 2021, 4:18 PM

#

I have to use pen and paper to every damn time to draw it out visually

crisp bay Jun 23, 2021, 4:18 PM

#

I can't mess up IPtables right?

plain siren Jun 23, 2021, 4:18 PM

#

uhhh

crisp bay Jun 23, 2021, 4:18 PM

#

good question kekw

plain siren Jun 23, 2021, 4:19 PM

#

My IP Tables Rules looks like a fucking war zone usually since I add things to protect from malicious scanning and attacks

low pond Jun 23, 2021, 4:19 PM

#

I used to use this script which would download the IP assigned blocks PER country, and I'd block whoel china and rememebr the script used iptables

plain siren Jun 23, 2021, 4:19 PM

#

low pond I used to use this script which would download the IP assigned blocks PER countr...

Yeah basically this kinda shit

low pond Jun 23, 2021, 4:20 PM

#

i remmeber it had "iptables flag flag DROP"

plain siren Jun 23, 2021, 4:20 PM

#

But Instead of outright BLOCKING or Denying, I do some trickery

low pond Jun 23, 2021, 4:20 PM

#

and i'd just block china out kek, no more weird SSH bots

low pond Jun 23, 2021, 4:20 PM

#

plain siren But Instead of outright BLOCKING or Denying, I do some trickery

oh 😛

plain siren Jun 23, 2021, 4:20 PM

#

I return Host Not Found, Timeout, or whatever instead

#

So it looks less like something is there

#

And more like nothing is there in the response

low pond Jun 23, 2021, 4:20 PM

#

Huh, wouldn't that be just "natural", i.e: if the server doesnt respond anything then we just presume its not listening on anything

plain siren Jun 23, 2021, 4:20 PM

#

so most automated tools will just keep on going

plain siren Jun 23, 2021, 4:21 PM

#

low pond Huh, wouldn't that be just "natural", i.e: if the server doesnt respond anything...

Yeah, it looks more natural

#

Shit like SKID DDoS Tools and such will most of the time fail on the Skid since itll report back to them with an error "Host not found" or some stupid shit

low pond Jun 23, 2021, 4:22 PM

#

if ya ping me in my residental IP it wouldnt respond back i think my isp has that disbaled too, it just would show "lost packets" or something

plain siren Jun 23, 2021, 4:22 PM

#

and they have no way to force the attack

low pond Jun 23, 2021, 4:22 PM

#

plain siren Shit like SKID DDoS Tools and such will most of the time fail on the Skid since ...

Heh, seems a cool thing to do. respond with stuff instead of compeltly DROPPING them.

#

But i used to just drop whole china, mainyl to get rid of the SSH bots. they were BOTS so they arent that smart anyway

plain siren Jun 23, 2021, 4:23 PM

#

I dont like doing massive block lists since that takes alot of time to do the table comparisons for every new connection

low pond Jun 23, 2021, 4:24 PM

#

plain siren I dont like doing massive block lists since that takes alot of time to do the ta...

hwut what do you mean

#

I actually don't get it, what takes time

plain siren Jun 23, 2021, 4:24 PM

#

Does this IP match this block rule? No?
Ok what about this block rule? No?
How about this block rule? no

low pond Jun 23, 2021, 4:25 PM

#

Bruh...

#

I mean, i didn't notice any network slowdown or something

#

it wasnt even a powerful VPS

plain siren Jun 23, 2021, 4:25 PM

#

if you ping from a new IP you would notice the first ping had a huge latency

low pond Jun 23, 2021, 4:26 PM

#

Oh, huh, never checked that

#

when I used to talk about that other's would just say "i ThInK GeOBlOCKINg a COuNtRy iS StUPiD"

#

and the reasons would just be, because well the users or real people from the country wouldn't be able to visit your site etc... I mean I used to not care as my site had nothing to do with chineese people anyway kek

lean pebble Jun 23, 2021, 5:14 PM

#

crisp bay I can't mess up IPtables right?

Yeah you can mess up iptables

crisp bay Jun 23, 2021, 5:17 PM

#

oh so I better screenshot it and if I do, I can just delete every rule and re-add them

lean pebble Jun 23, 2021, 5:17 PM

#

Yap

#

You can just backup the iptables configuration

crisp bay Jun 23, 2021, 5:17 PM

#

yeah