The UNIX and Linux Forums - IP Networking

Corporate VPN service with separate nets for different users/groups

signal — Tue, 17 Nov 2009 09:42:44 GMT

Hi

We are going to host some services for customers with separate private networks for each customer. Each customer will need one or more users.

I have to put up a VPN solution, and I would like to use something that will work on "any" platform, easily, without too much installation/configuration. I feel PPTP is a good option since the "agent" is included on most platforms. We have a firewall/router on a Debian Linux server, and I'd like to extend it's services to include the VPN service. It has access to all nets, so it should be easier to get that to work.

My firewall/router has four interfaces, but only three of concern. eth0 is the outside, eth1 is the inside and eth2 is DMZ. I use proxyarp to get traffic from eth0 to eth2, with iptables filtering. eth1 has three internal nets in the 192.168.* series. The new nets I want to use for customers will be separate VLAN's on that interface with 10.20.x.* addresses. The firewall/router will of course have an IP in each of these (typically .1).

The big question is how to set this up? Can pptpd be used? Should this be done on a separate server?

Need to check the connectivity between 2 servers

rjanardhan83 — Tue, 17 Nov 2009 07:02:32 GMT

Hi All,

I need an automation script to check the connectivity between 2 UNIX servers.

Could anybody please help in this regards?

regards,
janardhan

Command to ping 1500 bytes of data to a destination system

rvan — Mon, 16 Nov 2009 09:57:56 GMT

Hi All,

I want to ping 1500 bytes of data from a pc to another pc in the network. What is command used for the same?

Thanks

How can I disable ping replies?

itisijayare — Wed, 11 Nov 2009 02:37:07 GMT

I want my system to not reply to pings. Does anybody know how to do that in any system?

OPENVPN on FREEBSD

cozsmin — Fri, 06 Nov 2009 16:03:53 GMT

Hello gurus ,

I have a vmware machine on xp wich holds a FREBSD 8.0 BETA2 i386

my xp ip is 192.168.0.12
my freebsd le0 ( ext iface, vmware bridged ) is 192.168.0.105 ( can ping google; etc...)
my freebsd le2 (int iface, vmware local only) is 192.168.141.5
my freebsd le1 is disabled as i wanted to ;

on the external lan we have another ( real machine ) freebsd 7.2-RELEASE i386

I have installed on both bds`s openvpn "openvpn-2.0.6_9"

I want to put the vpn server on the virtual bsd ( 0.105) and the client on the real bsd ( 0.2)
They are installed ( the packages) and i have already configured openvpn.conf 4 each machine , one to be server(..0.105) and the other to be the client (..0.2),
I can start the server (/usr/local/etc/rc.d/openvpn start )
ps ax | grep vpn - gives me :
1116 ?? Ss 0:00.54 /usr/local/sbin/openvpn --cd /usr/local/etc/openvpn --daemon openvpn --config /usr/local/etc/openvpn/openvpn.conf --writepid /var/

and the openvpn.conf on the server has the uncommented lines :

Code:

port 1194

proto tcp

;proto udp  - i put it so u dont ask about it 

[SIZE=2]

;dev tap - same 

dev tun

[SIZE=2]ca "/var/openvpn/keys/ca.crt"

cert "/var/openvpn/keys/server.crt"

key "/var/openvpn/keys/server.key" # This file should be kept secret

[SIZE=2]dh "/var/openvpn/keys/dh1024.pem"

[SIZE=2]server 192.168.7.0 255.255.255.0

[SIZE=2]ifconfig-pool-persist ipp.txt

[SIZE=2]client-to-client

[SIZE=2]keepalive 10 120

[SIZE=2]comp-lzo

[SIZE=2]persist-key

persist-tun

[SIZE=2]status openvpn-status.log

[SIZE=2]verb 3

and the ifconfig gives me :

Code:

[SIZE=2]

[SIZE=2]le0: flags=8843 metric 0 mtu 1500

        options=8

        ether 00:0c:29:4a:4f:fa

        inet 192.168.0.105 netmask 0xffffff00 broadcast 192.168.0.255

        media: Ethernet autoselect

        status: active

le1: flags=8802 metric 0 mtu 1500

        options=8

        ether 00:0c:29:4a:4f:04

        media: Ethernet autoselect

le2: flags=8843 metric 0 mtu 1500

        options=8

        ether 00:0c:29:4a:4f:0e

        inet 192.168.141.5 netmask 0xffffff00 broadcast 192.168.141.255

        media: Ethernet autoselect

        status: active

plip0: flags=8810 metric 0 mtu 1500

lo0: flags=8049 metric 0 mtu 16384

        options=3

        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5

        inet6 ::1 prefixlen 128

        inet 127.0.0.1 netmask 0xff000000

tun0: flags=8051 metric 0 mtu 1500

        inet 192.168.7.1 --> 192.168.7.2 netmask 0xffffffff

        Opened by PID 1102

and the client hat the following uncommented openvpn.conf lines :

Code:

client

;dev tap

dev tun

proto tcp

;proto udp

remote 192.168.0.105 1194

nobind

user nobody

group nobody

persist-key

persist-tun

ca ca.crt

cert client.crt

key client.key

comp-lzo

verb 3

I must tell you that i copied directly the files generated (ca.crt, cert.crt and client.key ) from the server

For any doubts if "telnet 192.168.0.105 1194" from the client (0.2) i get :
[SIZE=2]

Code:

[SIZE=2]

Trying 192.168.0.105...

Connected to 192.168.0.105.

Escape character is '^]'.

@:����K@:����K

meaning i am connected to the soket :)

Ok now . When i try from 192.168.0.2 ( client ) to :
# /usr/local/etc/rc.d/openvpn start
Starting openvpn.

Nothing happends and if i try again , nothing , i belive it is something with the authentification as the server listens but you are the gurus

Is Possible to Registrar a MAC Address in a VPN

andresguillen — Fri, 06 Nov 2009 15:55:15 GMT

Hi Gurus, I have a question:
I have a connection VPN to my Branch Office, but some day the Network administrator send an e-mail and he tell me that I must be disconnected the VPN. But In that moment I don't use the VPN, Someone was coneccted to the VPN I think.
The Question is:
I want to know if exist a System or tecnology that when you access a VPN, the firewall (or equipment that manage the VPN) register the MAC address of the Station/PC that use the VPN?
For example If someone know my user/pass of my VPN can do anything in my branch Office, and the Network Administrator would think that I do it. When I'm not the person that use the VPN.
Thantk gurus for your suggestions or advice
Andres

do peers communicate via protocol?

zius_oram — Thu, 05 Nov 2009 06:44:49 GMT

actual transmission path is physical layer. do peers in n layer communicate on any issue using n layer protocol with each other. as far as i know this communication is said to be virtual.

UDP Server/Daemon for receiving & acknowledging data

allbread — Tue, 03 Nov 2009 21:08:49 GMT

I'm looking for a couple high level pointers to writing a UDP server that will be acknowledging data at a rate of approximately twelve packets every second and will be running on and older but more or less dedicated Solaris 9 box.

Acknowledging the data packets is relatively simple, after checksumming I need only pull the header data from the original packet and include it in the acknowledgment. I will need to keep a log of the acknowledgments sent, either by just streaming to a binary file or to an archive via MQSeries.

It's been suggested that I look into inetd... I'm also looking over a couple simple UDP client/server examples, but I'm a relative noob at networking and could use a couple high level pointers lest I end up in any number of rabbit-holes along the way.

Any suggestions/advice would be much appreciated...

Thanks!

Bandwidth shaping on specific port

Zamba — Sat, 31 Oct 2009 22:16:38 GMT

Hi,

I've been looking for a few hours now, reading various docs and man pages, but the info I found so far is either not what I was looking for or I just don't get how to do the thing I need....

So, my "problems" is that I have a server running on a specific port and I need to shape traffic only on this port (7979) in order to reduce bandwidth. I want it to only have a max up speed of 10 KB/s and max down speed of 10 KB/s also. What I've been looking for for the past few hours is a command or some other shaping software that will be able to limit the incoming & outgoing bandwidth only on this port. I read the man pages of 'tc' but I didn't get much wiser from it, so I came asking here in the hope someone could provide me with the commands and their params how to do that or offer another solution, if possible. I'm on Linux btw :)

Thanks

Total byte

Dedalus — Fri, 30 Oct 2009 16:35:03 GMT

Hi

I've a pkts trace and I'm performing some test on it. I'd like to figure out also the numbers of total byte in that trace.
Any idea?

thanks in advance

D.

Stuck ARP entries

Corona688 — Wed, 28 Oct 2009 15:20:30 GMT

About a week ago a customer hooked up a wireless router backwards to our network, causing it to serve incorrect DHCP addresses to some of them. Our networks are mostly statically assigned so this didn't cause as much damage as it might have, but now, over a week later, I still have incomplete 192.168.10.x entries stuck in the ARP table:

Code:

$ arp -n

Address                  HWtype  HWaddress           Flags Mask            Iface

192.168.20.27            ether   00:60:B3:20:71:32   C                     lan

192.168.20.36            ether   00:15:E9:84:E8:60   C                     lan

192.168.20.64            ether   00:22:5F:14:B4:75   C                     lan

192.168.10.101                   (incomplete)                              lan

192.168.20.33            ether   00:13:4F:00:A2:85   C                     lan

192.168.10.84                    (incomplete)                              lan

208.92.117.109           ether   00:80:AE:97:78:1F   C                     wan

192.168.10.65                    (incomplete)                              lan

192.168.20.46            ether   00:07:E9:BD:FB:79   C                     lan

192.168.10.90                    (incomplete)                              lan

192.168.20.130           ether   00:60:B3:07:10:16   C                     lan

192.168.20.21            ether   00:13:4F:00:40:85   C                     lan

192.168.10.88                    (incomplete)                              lan

192.168.20.43            ether   00:15:E9:32:C4:F1   C                     lan

192.168.20.14            ether   00:13:4F:00:64:FF   C                     lan

$

arp -d cannot delete the incomplete entries, and they won't go away. I suppose they're harmless but I'd get rid of them if I could. Is there any better way than a reboot?

nslookup en modo interactivo no guarda historial de tipeo

buchho — Tue, 27 Oct 2009 06:01:25 GMT

Estimados, c�mo podr�a hacer para que el nslookup en modo interactivo me guarde el historial de lo que ya he tipeado para hacerlo nuevamente? al presionar la tecla de la flecha hacia arriba me salen unos caracteres como estos ^[[A cada vez que presiono, esto no sucede cuando lo hago desde un winxp alguna sugerencia?

Gracias de antemano.
Atte.
Gabo.-

==================================================
Note from Moderator:

Gabo, please use English in this forum.

Rough translation to English:

how could I do to make the nslookup in interactive mode history me save what I typed to do it again? by pressing the up arrow I get a character like this ^ [[ Every time I press, this does not happen when I do it from a winxp any suggestions?

how to increasing routing table entries

adassss — Fri, 23 Oct 2009 06:17:36 GMT

hi ,
I need to routing table entries.How can it be done.
using Script I'm adding entries into routing table.it supports upto 250.but i need to add more than this limit.
is there any way that we can tweak kernel code and increase the limitation??
:confused: