The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1025 »

dpkg chopra: Jun 9, 2007; Fast Food Fight; Grimey Drawer

MrPablo posted:

Use OUTPUT instead of PREROUTING, since it's traffic coming from your local machine:
code:
iptables -t nat -A OUTPUT -d 10.10.20.99 -j DNAT --to-destination 10.10.14.2

Just wanted to thank you for this, worked perfectly.

I'm now trying to set up a CRON job to run this every minute to check for IP changes. Right now what it does is run the following script every minute, which resolves the DDNS address, sets the iptables nat rule, and outputs the changes to a text file.

Only problem is that my text file basically looks like:

2015/08/26 - 00:00:00: IP set to X.X.X.X
2015/08/26 - 00:01:00: IP set to X.X.X.X
2015/08/26 - 00:02:00: IP set to X.X.X.X

Is there any simple way of only executing the rule change + output when the IP address changes?

Edit: I think I might have figured it out myself:

code:

#!/bin/bash

var=$(getent hosts ddnssaddress.com | cut -d' ' -f1) #First we define the function "var" which resolves the DDNS address into an IP and cuts off all other information from the output.

currentip=$(awk 'NR==1' /home/user/Desktop/pingoutput.txt) #We read the first line of a file used to store the current ip and define that as $currentip.

current_time=$(date "+%Y/%m/%d-%H:%M:%S") #We define the variable current time.

if [ "$currentip" != "$var" ] #If the current IP is not the same as the resolved IP then
        then
                echo "$var" > /home/user/Desktop/pingoutput.txt #We output the result to a file that will be used for comparison purposes.
                sudo iptables -t nat -D OUTPUT 1 #We delete the first numbered rule so as to not have multiple rules.
                sudo iptables -t nat -A OUTPUT -d 10.10.20.20 -j DNAT --to-destination $var #We add a new OUTPUT rule that reads the destination of each packet and replaces 10.10.20.20 with the result of $var
                echo "$current_time: Old rule deleted and new OUTPUT IP set to $var" >> /home/user/Desktop/iptables.txt #We echo some logging text.
fi

Seems to be working. Thanks for the help, guys.

dpkg chopra fucked around with this message at 20:01 on Aug 26, 2015

# ? Aug 26, 2015 19:37

Adbot: ADBOT LOVES YOU

# ? Apr 25, 2024 23:33

Weird Uncle Dave: Sep 2, 2003; I could do this all day.; Buglord

jre posted:

Is there no specific error from the mount command in /var/log/messages or /var/log/glusterfs/MOUNTPOINT.log ?
Also from the audit2allow rule is it not more the case that the gluster user doesn't have relabel permissions?

Nothing useful in /var/log/messages. (Literally nothing related to this, honestly.)

The Gluster mountpoint logs have ~100 lines for each failed mount, but about 90 of them are basically the same as for a successful mount. Here's some snippets from a failed mount

code:

[2015-08-26 13:54:17.886182] I [glusterfsd.c:1959:main] 0-/usr/sbin/glusterfs: Started running /usr/sbin/glusterfs version 3.5.5 
        (/usr/sbin/glusterfs --direct-io-mode=disable --fuse-mountopts=noatime,context="unconfined_u:object_r:httpd_sys_rw_content_t:s0"
        --volfile-server=gluster2.myorg.edu --volfile-server=gluster1.myorg.edu --volfile-id=/web-content
        --fuse-mountopts=noatime,context="unconfined_u:object_r:httpd_sys_rw_content_t:s0" /var/www/html)
[2015-08-26 13:54:17.888903] I [mount.c:290:gf_fuse_mount] 0-glusterfs-fuse: direct mount failed (Invalid argument), retry to mount via fusermount
[2015-08-26 13:54:17.893184] E [mount.c:298:gf_fuse_mount] 0-glusterfs-fuse: mount of gluster2.myorg.edu:/web-content
        to /var/www/html (default_permissions,noatime,context="unconfined_u:object_r:httpd_sys_rw_content_t:s0",allow_other,max_read=131072) failed
[2015-08-26 13:54:17.893526] E [glusterfsd.c:1793:daemonize] 0-daemonize: mount failed

(snip: about 80 lines, including the config graph)

[2015-08-26 13:54:18.235921] I [fuse-bridge.c:4857:fuse_thread_proc] 0-fuse: unmounting /var/www/html
[2015-08-26 13:54:18.247031] W [glusterfsd.c:1095:cleanup_and_exit] (-->/lib64/libc.so.6(clone+0x6d) [0x7f377b9ff9ad]
        (-->/lib64/libpthread.so.0(+0x7a51) [0x7f377c095a51]
        (-->/usr/sbin/glusterfs(glusterfs_sigwaiter+0xd5) [0x4053e5]))) 0-: received signum (15), shutting down
[2015-08-26 13:54:18.247053] I [fuse-bridge.c:5514:fini] 0-fuse: Unmounting '/var/www/html'.

A successful mount starts out basically the same, but from the third line on it's different (the third and fourth lines aren't even there, after the config graph there's a bunch of success messages about connecting to remote volumes and such, the last few lines about unmounting and shutting down aren't there).

If I remove the security context from the mount options, the file system will mount at boot time (though obviously without the intended security context).

I've run the entirety of my audit.log for the last week through audit2allow, and it only outputs two suggestions -- the one I posted before, and one related to httpd and log file renaming, almost certainly not germane to this problem.

And the timestamps match up. From audit.log:

code:

type=AVC msg=audit(1440597257.790:6): avc:  denied  { relabelfrom } for  pid=1548 comm="fusermount-glus"
        scontext=system_u:system_r:glusterd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1440597257.790:6): arch=c000003e syscall=165 success=no exit=-13 a0=158d290
        a1=158c060 a2=158d2f0 a3=406 items=0 ppid=1545 pid=1548 auid=4294967295 uid=0 gid=0 euid=0 suid=0
        fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="fusermount-glus"
        exe="/usr/bin/fusermount-glusterfs" subj=system_u:system_r:glusterd_t:s0 key=(null)

If I have any free time, I may try to build another server for the sole purpose of adding the suggested SELinux policy, to confirm whether that resolves the issue. I'm reasonably certain it will, but I'm justifiably itchy about doing it on production servers.

# ? Aug 26, 2015 20:17

CrushedWill: Sep 27, 2012; Stand it like a man... and give some back

Please don't laugh too hard (unless you really want to)

I'm a Windows guy, and had some spare time at work today so I decided to take a spare PC and install Arch on it. Surprisingly, everything went well through the base install, and I even have a base install of Xorg on it.

The problem is that the pointer won't move in X. I have the base cursor, but it won't budge. Two button MS USB basic mouse.

I've done a fair bit of RTFM trying to figure out why there might be an issue, but it's hard when I don't have a clue as to where to even start looking.

Feel free to say 'dumbass why did you install Arch" or something similar, I probably deserve it for the sheer audacity of the effort

# ? Aug 27, 2015 00:48

Suspicious Dish: Sep 24, 2011; 2020 is the year of linux on the desktop, bro; Fun Shoe

Do you have xf86-input-evdev installed?

# ? Aug 27, 2015 01:15

CrushedWill: Sep 27, 2012; Stand it like a man... and give some back

Suspicious Dish posted:

Do you have xf86-input-evdev installed?

Yes.

Problem solved. I had an image of WinXP on it, and wiped it for arch. Mouse and KB worked fine. After the wipe, X wouldnt work so I assumed all the hardware was working properly.

I decided to move the mouse to a different USB port, all is now well. Not sure why Arch disliked the original port the mouse was plugged in on (no not on shared hub).

Thanks for the help, I'm now going to try and put i3-gaps on, which is AUR

# ? Aug 27, 2015 01:50

Death Vomit Wizard: May 8, 2006; Bottom Feeder

jre posted:

Stick this at the top of the crontab

MAILTO=deathvomitwizard@example.com

Without this line it will have been attempting to send to the owner of the crontab e.g. user@localhost.localdomain

Ahh, success! For some reason I thought I had already tried this. Thanks.

# ? Aug 27, 2015 04:01

goose willis: Jun 14, 2015; Get ready for teh wacky laughz0r!

What's a decent rolling-release distro based off Debian/Ubuntu/whatever?

edit: if it has PPA compatibility, even better!

goose willis fucked around with this message at 01:26 on Aug 28, 2015

# ? Aug 28, 2015 01:12

evol262: Nov 30, 2010; #!/usr/bin/perl

goose fleet posted:

What's a decent rolling-release distro based off Debian/Ubuntu/whatever?

edit: if it has PPA compatibility, even better!

Aptosid. Or just use debian testing

# ? Aug 28, 2015 05:05

spankmeister: Jun 15, 2008

evol262 posted:

just use debian testing

# ? Aug 28, 2015 07:04

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

I've got all the fun networking problems.

Today the infrastructure I manage had an issue related to a yet-undiagnosed networking condition. Since I don't have access to the switches directly to pull any better diagnostics personally, that's all I can say right now -- things were working strangely, and connectivity between servers was intermittently fidgety. During this state, some of our systems (presumably) became so severely backed up that attempting to telnet to a local service on 127.0.0.1 would result in the sending socket going into SYN_SENT state. tcpdump of lo showed that the SYN packet to initiate the connection was hanging and not being sent at all. Likewise, sometimes trying to ping a server resulted in errors for a few send iterations while the system tried to open the raw ICMP socket. Our rmem/wmem are tuned very high relative to the network I/O of the systems, nf_conntrack's backlog was nowhere near full, and I'm out of my depth in how to dig any further into what's getting backed up so I can follow that back up to the network infrastructure.

Anyone have any ideas on where to start looking?

# ? Aug 28, 2015 18:21

ChubbyThePhat: Dec 22, 2006; Who nico nico needs anyone else

Those symptoms are very reminiscent of a network loop, but I don't want to believe that that could really be a possibility... (unless maybe they just installed some new HP switches which come with loving Spanning-Tree DISABLED BY DEFAULT :argh:

)

# ? Aug 28, 2015 18:42

Vulture Culture: Jul 14, 2003; I was never enjoying it. I only eat it for the nutrients.

ChubbyThePhat posted:

Those symptoms are very reminiscent of a network loop, but I don't want to believe that that could really be a possibility... (unless maybe they just installed some new HP switches which come with loving Spanning-Tree DISABLED BY DEFAULT )

The network loop/broadcast storm was the very first thing I considered, especially when I saw positive-valued pause frame counters in netstat -s on some of our servers, but the historical data on switch port traffic doesn't corroborate that. (We did have HP blade switches installed recently.)

I think I'm more interested in figuring out what part of the network stack is bottlenecking on the host so I can definitely start tracking it back up the pipeline.

# ? Aug 28, 2015 19:02

evol262: Nov 30, 2010; #!/usr/bin/perl

Route handler? Proto handler? Prerouting?

I'd probably start walking backwards from whatever you can dig out of ss, and go from there, attempting tcp_limit_output_bytes, tcp fastopen, tcp_tw_reuse, and tcp_tw_recycle. Of course, none of those really apply to ICMP, and they're all predicated on the same root problem.

If it's proto handler or route handler, I don't even know how to start troubleshooting that without systemtap. And you could theoretically adjust thash_entries, but it's really unlikely that that's a problem on modern systems with lots of memory.

Thomas Graf did an interesting talk on it last year, and the slides are available, which gives a good 10,000 ft view of how everything passes through everywhere, but I can't video of the session or the q&a afterwards

Not even close to my area of expertise either, but a lot of the guys who know this stuff in and out and work on it are very active on freenode/#openvswitch, and they may be able to point you in the right direction.

# ? Aug 28, 2015 19:49

some kinda jackal: Feb 25, 2003; �
�

Any thoughts on best practices on creating a partition vs using the raw disk for an lvm PV?

I typically create an 8e type partition on /dev/sdX1 and then pvcreate that, but I've been seeing some tutorials on just using the raw dev/sdX device rather than a subset partition.

# ? Aug 28, 2015 21:39

Cidrick: Jun 10, 2001; Praise the siamese

Martytoof posted:

Any thoughts on best practices on creating a partition vs using the raw disk for an lvm PV?

I typically create an 8e type partition on /dev/sdX1 and then pvcreate that, but I've been seeing some tutorials on just using the raw dev/sdX device rather than a subset partition.

I haven't read a compelling case for partitioning a disk and then pvcreating that. The only thing I read was that an idiot admin may mistakenly see an unpartitioned block device and reformat an in-use block device without thinking first, but that's more of a what-if scenario if you work with braindead co-workers.

I find it's much cleaner - especially when working with remote storage or a vmdk - to just pvcreate the raw block device. This is especially true when you go to resize it. No having to futz with kpartx to re-read the new partition boundaries, just echo 1 > rescan, pvscan, and lvextend.

# ? Aug 28, 2015 21:45

some kinda jackal: Feb 25, 2003; �
�

I think I started doing the partition just because it was mentioned in some centos document but now you make a really compelling argument for not using a partition to the point where I want to reconsider.

# ? Aug 28, 2015 21:48

Cidrick: Jun 10, 2001; Praise the siamese

There's a stackexchange discussion that disagrees with me, though. However, I find most of the reasons to be... not very good, and certainly not worth the headache of having to deal with partitions when you're dicking with drive resizing.

# ? Aug 28, 2015 22:30

theperminator: Sep 16, 2009; by Smythe; Fun Shoe

Martytoof posted:

Any thoughts on best practices on creating a partition vs using the raw disk for an lvm PV?

I typically create an 8e type partition on /dev/sdX1 and then pvcreate that, but I've been seeing some tutorials on just using the raw dev/sdX device rather than a subset partition.

Depends on whether your coworkers are incompetent and whether you wish to reboot your VM every time you resize it.

In some morons infinite wisdom they patched the kernel to block partition table reloads for disks that have in-use partitions (for Redhat/Centos at least.), this means that if you resize a partition on say Centos/RHEL 6 you have to reboot afterwards before you can do a pvresize & lvextend.
Not sure if this applies to other distros

Using the full disk rather than partitioning means you can do live resizes, which is preferable to me, and the people I work with are not dumb enough to gently caress it up.

theperminator fucked around with this message at 00:46 on Aug 29, 2015

# ? Aug 29, 2015 00:19

RFC2324: Jun 7, 2012; http 418

This maybe better posted in the Virtualization thread, but its all linux based so I'll start here.

What would be the best filesystem to use for a partition that I want to share as a block device to KVM guests?

To elaborate, have one drive that is a shared data drive, that the host can read/write, as well as multiple guests who are unable to communicate with the host over the network due to a bridged network setup.

I am looking at gluster right now, but from what I can see that wants to work over the network, which might make it a no go.

# ? Aug 29, 2015 01:40

evol262: Nov 30, 2010; #!/usr/bin/perl

You're looking at traditional clustered shared filesystems. ocfs2, gfs, etc. But none of them are going to be happy with concurrency without a way to communicate. There are janky solutions involving locking files from all the nodes placed in a particular portion of the disk (or another partition on it), and clvm can do some of those, but seriously consider adding a private NATed cluster network to synchronize

# ? Aug 29, 2015 03:10

RFC2324: Jun 7, 2012; http 418

evol262 posted:

You're looking at traditional clustered shared filesystems. ocfs2, gfs, etc. But none of them are going to be happy with concurrency without a way to communicate. There are janky solutions involving locking files from all the nodes placed in a particular portion of the disk (or another partition on it), and clvm can do some of those, but seriously consider adding a private NATed cluster network to synchronize

So do 2 interfaces on the guests, one bridged and one using just an internal only virtual network?

# ? Aug 29, 2015 03:28

evol262: Nov 30, 2010; #!/usr/bin/perl

Yep -- separate cluster networks used to be pretty common for this crap 5+ years ago (and to negotiate who held the service address, and cluster heartbeats, and a bunch of other stuff) in the days before haproxy and cloud services ruled the world.

If you want to be able to share a disk across a bunch of systems and have them all able to write it, it's still something you can do. Of course, you'd do it for something like vcs/vxfs shared disks and rac and ocfs and rhcs with a scsi array cabled to both or the same fc/iscsi lun mapped to both. Locally, you may as well just export it over nfs unless you need "real filesystem" semantics for some reason, or you want to learn about clustered filesystems

# ? Aug 29, 2015 03:34

RFC2324: Jun 7, 2012; http 418

evol262 posted:

Yep -- separate cluster networks used to be pretty common for this crap 5+ years ago (and to negotiate who held the service address, and cluster heartbeats, and a bunch of other stuff) in the days before haproxy and cloud services ruled the world.

If you want to be able to share a disk across a bunch of systems and have them all able to write it, it's still something you can do. Of course, you'd do it for something like vcs/vxfs shared disks and rac and ocfs and rhcs with a scsi array cabled to both or the same fc/iscsi lun mapped to both. Locally, you may as well just export it over nfs unless you need "real filesystem" semantics for some reason, or you want to learn about clustered filesystems

This is on my home server/lab, so its mostly for learning, hopefully without upsetting the delicate balance of torrents and other stupid poo poo too badly. Trying to set it up so all the host is doing is running libvirtd and holding the data, while having a dedicated VM for each different service I am running(samba, transmission, etc)

I wanted to have a central data store mainly for purposes of flexibility, and just to know how to do it for when I need to deal with it in a production environment, preferably without having to deal with vxfs. I have worked with vxfs, but don't want to have to pay for something like that in my home lab, and thought it was mainly for SAN storage.

# ? Aug 29, 2015 04:29

evol262: Nov 30, 2010; #!/usr/bin/perl

You can use a macvtap interface on the host, but NM doesn't have a friendly way to manage this. You can use ovs bridges, which don't have that problem at all, but neither virt-manager nor NM (last time I looked) have friendly ways to manage this, and you need to edit guest xml and interface confs by hand. Or use a plain Linux bridge, which is also OK with this, but it takes an iptables rule and a couple of sysctls

vxfs is used for shared block storage. Like ocfs2 and gfs. ocfs2 is pretty painless to set up, actually, though gfs2 is arguably more widely used (and less painful than it used to be, since pacemaker takes over a lot of the bullshit cluster.xml used to). If you want to share a block device, you need some clustered filesystem.

Alternatively, libvirt can just pass poo poo in directly ala virtualbox, which maybe sounds like what you want if the host won't need to access samba/etc

evol262 fucked around with this message at 05:15 on Aug 29, 2015

# ? Aug 29, 2015 05:05

RFC2324: Jun 7, 2012; http 418

evol262 posted:

Alternatively, libvirt can just pass poo poo in directly ala virtualbox, which maybe sounds like what you want if the host won't need to access samba/etc

I was trying this one originally, but everything I saw said you need to use the 9p filesystem, which requires custom compiling it into the kernel.

Thanks for the pointers

# ? Aug 29, 2015 06:04

The Gay Bean: Apr 19, 2004

Something spooky is happening here and I don't know how to fix it. Summary: traffic that appears identical to tcpdump is being treated by iptables differently. Details below.

Test setup:

* device 0 - A linux machine sitting on IP 192.168.0.121

* device 1 - a dumb device that just sends packets to port 4000 on 192.168.0.121. The IP address of this device is set with the command: sudo arp -s 192.168.0.27 MAC_ADDRESS, because it does not make DHCP requests and can't be made to do anything other than its job.

* device 2 - A linux machine sending packets to port 4000 on 192.168.121 with the command:

code:

watch -n  1 "date | nc -4u -w1 -v 192.168.0.121 4000"

tcpdump output of the situation:

code:

22:00:01.845359 IP 192.168.3.30.50705 > 192.168.0.121.4000: UDP, length 1
22:00:01.845391 IP 192.168.3.30.50705 > 192.168.0.121.4000: UDP, length 29
22:00:02.022257 IP 192.168.0.27.27 > 192.168.0.121.4000: UDP, length 12
22:00:03.022797 IP 192.168.0.27.27 > 192.168.0.121.4000: UDP, length 12
...

In this circumstance, the output of "socat udp-l:4000,fork stdout" is:

code:

(junk);XWed Sep  2 22:02:18 PDT 2015
(junk);XWed Sep  2 22:02:22 PDT 201
...

And the output of "socat udp-l:4000,fork stdout" is empty.

The weird junk is from the sensor, and the dateis from the above command. Note that the destination IP/port of this traffic is the exact same according to tcpdump. Now if I forward all traffic from UDP port 4000 to 2700:

code:

sudo iptables -t nat -A PREROUTING -p udp --dst 192.168.0.121 --dport 4000 -j DNAT --to-destination 192.168.0.121:2700

tcpdump looks the exact same, but now, the output of "socat udp-l:4000,fork stdout" is:

code:

(lots of junk)...

and the output of "socat udp-l:2700,fork stdout" is:

code:

XXXWed Sep  2 22:05:42 PDT 2015
XXXWed Sep  2 22:05:46 PDT 2015
XXXWed Sep  2 22:05:50 PDT 2015
...

As you can see, traffic from device 1 is getting ignored by iptables and continuing to the host on port 4000, but traffic from device 2 is getting caught by the rule and getting forwarded to port 2700. I can clear iptables and reissue the rule all day and it just switches between those two states.

Anyone have some insight into what might be happening?

The Gay Bean fucked around with this message at 06:47 on Sep 3, 2015

# ? Sep 3, 2015 06:11

Storgar: Oct 31, 2011

Hey, it's me again. I installed Korora on a Thinkpad Yoga 12, and thanks to my experience in this thread, everything went off without a hitch. But now I want to get touch support working and I can' t seem to find any relevant documentation. For instance, where is the Korora driver source? I can't seem to find xorg.conf, or any udev rules, or whatever. All the config files seem to be completely missing?

Anyway, I'll cut to the chase. I was hoping to get started with linux (driver/kernel?) development. Does anyone know where I can learn more and get started? Also, does anyone know where I can find Korora specific code?

# ? Sep 3, 2015 07:14

evol262: Nov 30, 2010; #!/usr/bin/perl

Re: iptables. Can you post your entire ruleset, please?

Storgar posted:

Hey, it's me again. I installed Korora on a Thinkpad Yoga 12, and thanks to my experience in this thread, everything went off without a hitch. But now I want to get touch support working and I can' t seem to find any relevant documentation. For instance, where is the Korora driver source? I can't seem to find xorg.conf, or any udev rules, or whatever. All the config files seem to be completely missing?

xorg.conf is dynamically generated. udev rules are in /lib, and you put system-specific rules (of which you have none) in /etc. Linux is slowly moving away from static configs and into dynamic configuration except where needed. Expect /etc to slowly empty out.

Korora is a fedora remix. Less than 1/1000 odds they've written any drivers, and almost no chance that they haven't upstreamed them if they have. Install kernel-devel.

Storgar posted:

Anyway, I'll cut to the chase. I was hoping to get started with linux (driver/kernel?) development. Does anyone know where I can learn more and get started? Also, does anyone know where I can find Korora specific code?

kernel-devel. For korora-specific stuff, I'd look at korora-release and their kickstarts, but it bet it's renaming in anaconda, some repos added, some additional packages, and swapping branding, with no significant engineering/code.

# ? Sep 3, 2015 16:08

Storgar: Oct 31, 2011

Oh I see. I'm taking a look at Fedora and I realized that they support KDE Plasma 5 too. You're right about the Korora differences I think.

# ? Sep 3, 2015 17:18

The Gay Bean: Apr 19, 2004

evol262 posted:

Re: iptables. Can you post your entire ruleset, please?

code:

$sudo iptables  -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
$sudo iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       udp  --  0.0.0.0/0            192.168.0.121        udp dpt:4000 to:192.168.0.121:2700

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Some other things I've tried since

* Disabling rp_filter

* Enabling logging of martians and looking at logs

* Checking for invalid checksums or problems in Wireshark

* Writing a C UDP listener; when I did this, the packets from host1 did not come through to recv_from calls, but the packets from host2 did (without the firewall rule active).

The data from the sensor is visible in Wireshark, tcpdump, and socat but invisible to my C program and iptables.

The super crazy thing is that a default boost::asio socket is capable of seeing the data, so it seems like there's some socket option that can be set to make it magically visible. I just haven't found it yet.

# ? Sep 3, 2015 18:19

Saukkis: May 16, 2003; Unless I'm on the inside curve pointing straight at oncoming traffic the high beams stay on and I laugh at your puny protest flashes.
I am Most Important Man. Most Important Man in the World.

The Gay Bean posted:

code:
sudo iptables -t nat -A PREROUTING -p udp --dst 192.168.0.121 --dport 4000 -j DNAT --to-destination 192.168.0.121:2700
As you can see, traffic from device 1 is getting ignored by iptables and continuing to the host on port 4000, but traffic from device 2 is getting caught by the rule and getting forwarded to port 2700. I can clear iptables and reissue the rule all day and it just switches between those two states.

Anyone have some insight into what might be happening?

Does anything change if you use iptables rule

code:

sudo iptables -t nat -A PREROUTING -p all --dst 192.168.0.121 --dport 4000 -j DNAT --to-destination 192.168.0.121:2700

The only rational explanation I can think of that Iptables doesn't consider it UDP traffic. Maybe it could "UDP lite".

# ? Sep 3, 2015 23:24

The Gay Bean: Apr 19, 2004

Seems like "-p all" and "-p udpite" both don't take the "--dport" option.

Alright, I'm convinced that this is actually a bug and not something I'm doing wrong, so I'll report this to the iptables guys.

# ? Sep 4, 2015 01:03

other people: Jun 27, 2004; Associate Christ

The Gay Bean posted:

Seems like "-p all" and "-p udpite" both don't take the "--dport" option.

Alright, I'm convinced that this is actually a bug and not something I'm doing wrong, so I'll report this to the iptables guys.

netstat -s?
Does a log rule in front of your NAT rule match both packets?
Does one of the packets have a VLAN tag?

If all else fails, try dropwatch. It's a pretty simple rule; I have to believe there is something wonky with your packet...

# ? Sep 4, 2015 03:42

The Gay Bean: Apr 19, 2004

Okay, I have a better idea of what is going on now.

There are two devices on the network sending UDP/IP packets with:

source = 192.168.0.27
destination = 192.168.0.121

Only the mac address of the source is different. This appears to be confusing iptables.

It seems like "-m --mac-source" can only apply to ACCEPT/DROP rules so I'm still a bit stumped on what to do.

# ? Sep 4, 2015 06:04

other people: Jun 27, 2004; Associate Christ

The Gay Bean posted:

Okay, I have a better idea of what is going on now.

There are two devices on the network sending UDP/IP packets with:

source = 192.168.0.27
destination = 192.168.0.121

Only the mac address of the source is different. This appears to be confusing iptables.

It seems like "-m --mac-source" can only apply to ACCEPT/DROP rules so I'm still a bit stumped on what to do.

Huh? You have two devices with the same IP address?

# ? Sep 4, 2015 13:19

The Gay Bean: Apr 19, 2004

It's a sensor (not a polished ready for market product, from one of our partner companies) with an ethernet interface. When connected to a network it has a very specific set of behaviors that it can perform: wait for udp packets on port 4000 containing a startup key, send a response to 192.168.0.121, then start sending data to 192.168.0.121:4002. All packets they send have the sender ip set to 192.168.0.27 in the IP header.

It was designed to be connected to another NIC, but it's much more convenient to just hook it up to the wall. We also want to connect multiple sensors to the same computer, but we don't want to install 4 NICs to connect 3 sensors, especially since we want to use it on site with laptops.

So I have 3 choices: get it to work with iptables, ask our partner company if they can redesign their product for us, or resign to having every deployment require more hardware and either stick to desktop boxes or buggy usb3 network adapters.

Right now I'm making a tee program in libpcap to listen on port 4000/4002 and forward to a different port on the local host depending on the incoming packet's source MAC address. If there's a better way to do it I'm willing to give it a shot.

The Gay Bean fucked around with this message at 14:26 on Sep 4, 2015

# ? Sep 4, 2015 14:22

Megaman: May 8, 2004; I didn't read the thread BUT...

I'm running Freenas, and I have NFS enabled for my Linux machines. When I share /mnt/foo read only, it works, when I share /mnt/foo/bar as read write it works, but when I do both it gives me an error:

can't change attributes for /mnt/foo/bar: MNT_DEFEXPORTED already set for mount 0xfffffe0037f869a8
bad exports list line /mnt/foo/bar -mapall

And then of course when I try to mount I get:

mount request denied from 192.168.1.106 for /mnt/foo/bar

Is there a way around? Am I just being stupid about my mounting? I thought you could mount a parent directory and subdirectory in NFS. Or is NFS not that sophisticated?

# ? Sep 4, 2015 16:03

evol262: Nov 30, 2010; #!/usr/bin/perl

The Gay Bean posted:

If ARP who has has multiple systems holding the same IP, you're gonna have a bad time with iptables. Have you looked at arptables?

Megaman posted:

I'm running Freenas, and I have NFS enabled for my Linux machines. When I share /mnt/foo read only, it works, when I share /mnt/foo/bar as read write it works, but when I do both it gives me an error:

can't change attributes for /mnt/foo/bar: MNT_DEFEXPORTED already set for mount 0xfffffe0037f869a8
bad exports list line /mnt/foo/bar -mapall

And then of course when I try to mount I get:

mount request denied from 192.168.1.106 for /mnt/foo/bar

Is there a way around? Am I just being stupid about my mounting? I thought you could mount a parent directory and subdirectory in NFS. Or is NFS not that sophisticated?

You should set up another export if you want to mount a subdirectory with different options.

# ? Sep 4, 2015 17:31

minato: Jun 7, 2004; cutty cain't hang, say 7-up.; Taco Defender

Re: iptables. off the top of my head, I'd suggest putting a trace on the packet as it goes through iptables so you can see exactly what rules are getting hit.

It looks something like:

code:

# modprobe ipt_LOG
# iptables -t raw -A OUTPUT -p udp -j TRACE
# iptables -t raw -A PREROUTING -p udp -j TRACE

And then tail the "messages" log to show the iptables chains and the line numbers of the rules it's matching. Keep in mind that if the "matched rule number" = 1+ the total number of rules in the table, that means it fell off the end of the table and used the table default. And refer to this diagram to know how the packet will flow through iptables. http://inai.de/images/nf-packet-flow.png

It's a long shot and probably wrong, but it seems iffy to me that (a) you're putting your rules in the NAT table when NAT (in the traditional sense) doesn't apply to UDP because it's connectionless, and (b) you're having to specify the IP address of the destination, rather than just the new port. But I doubt those things are causing your problem.

# ? Sep 4, 2015 23:37

Adbot: ADBOT LOVES YOU

# ? Apr 25, 2024 23:33

Megaman: May 8, 2004; I didn't read the thread BUT...

evol262 posted:

If ARP who has has multiple systems holding the same IP, you're gonna have a bad time with iptables. Have you looked at arptables?

You should set up another export if you want to mount a subdirectory with different options.

I'm confused, I already have two exports. One for the parent directory, and one for the subdirectory. The subdirectory should have r/w, and the parent r/o, but this does not work, or am I misunderstanding your comment?

# ? Sep 6, 2015 20:13

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1025 »