nano /etc/network/interfaces
from 'man interfaces': address and netmask are required, gateway optional [I need it however]
apt-get install iputils(?)
ping6 -I eth0 <ipv6_address>
http://www.shorewall.net/6to4.htm#id2672474 Dec 3 16:04:53 vm-mgr kernel: [ 375.333415] Shorewall:net2fw:DROP:IN=eth0 OUT= MAC=b6:5d:03:e9:5b:10:00:01:71:0b:85:9c:08:00 SRC=192.88.99.1 DST=Inet2_IP LEN=124 TOS=0x00 PREC=0x00 TTL=249 ID=0 DF PROTO=41
To ping all hosts in your lan, ping the whole link-local area http://tldp.org/HOWTO/Linux+IPv6-HOWTO/x811.html:
ping6 -I eth0 ff02::1
/* ipv6 DONE IPv6: sgiebels@toad:~]$ ping6 www.pcprobleemloos.nl AAAA record
http://www.deepspace6.net/projects/initscripts-ipv6.html#id2851702 #6to4 relay tunnel router
http://tldp.org/HOWTO/Linux+IPv6-HOWTO/configuring-ipv6to4-tunnels.html 9.4.1.1. Using “ip” and a dedicated tunnel device ipv4=“145.99.246.40”; printf “2002:%02x%02x:%02x%02x::1” `echo $ipv4 | tr “.” “ “` 2002:9163:f628::1[root@localhost network-scripts]# nano ../network
/sbin/ip tunnel add tun6to4 mode sit ttl 64 remote any local 145.99.246.40 /sbin/ip link set dev tun6to4 up[root@localhost network- /sbin/ip -6 addr add 2002:9163:f628::1/16 dev tun6to4 /sbin/ip -6 route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1 ping6 ipv6.google.com
[root@localhost sgiebels]# ifup eth0 Global IPv6 forwarding is enabled in configuration, but not currently enabled in kernel Please restart network with '/sbin/service network restart'
Example–Using nsloo
*/
Note: be careful when adjusting firewall settings on a remote computer, make sure you don't lock yourself out!
# iptables -F
# chmod 700 rc.firewall
# nano rc.firewall
# update-rc.d rc.firewall defaults 19
update-rc.d: using dependency based boot sequencing
insserv: warning: script 'rc.firewall' missing LSB tags and overrides
http://www.linuxtopia.org/Linux_Firewall_iptables/x5091.html http://www.google.nl/search?hl=nl&q=rc.firewall+simple+iptables&aq=f&aqi=&aql=&oq=&gs_rfai=
cd /etc/init.d http://electron.mit.edu/~gsteele/firewall/ wget http://electron.mit.edu/~gsteele/firewall/firewall script is broken, edit INTERFACES (br0 or eth0) testen firewall vm-mgr chmod ugo+x /etc/init.d/firewall update-rc.d firewall start 40 S . stop 89 0 6 .
cp firewall /lxc/vm-template/rootfs/etc/init.d/firewall
1a2,19 > ipt_LOG 3570 6 > xt_tcpudp 1743 59 > iptable_raw 1471 0 > xt_comment 599 33 > iptable_nat 3551 1 > nf_nat 10568 1 iptable_nat > ipt_REJECT 1517 4 > ipt_addrtype 1345 3 > xt_multiport 1775 4 > xt_MARK 617 1 > iptable_mangle 2325 1 > nf_conntrack_ipv4 7597 38 iptable_nat,nf_nat > nf_defrag_ipv4 779 1 nf_conntrack_ipv4 > xt_conntrack 1955 35 > nf_conntrack 38075 4 iptable_nat,nf_nat,nf_conntrack_ipv4,xt_conntrack > iptable_filter 1790 1 > ip_tables 7690 4 iptable_raw,iptable_nat,iptable_mangle,iptable_filter > x_tables 8327 10 ipt_LOG,xt_tcpudp,xt_comment,iptable_nat,ipt_REJECT,ipt_addrtype,xt_multiport,xt_MARK,xt_conntrack,ip_tables
http://www.shorewall.net/ It uses iptables as back-end
Installation:
apt-get install shorewall shorewall6 make
will also install: bc libdb4.7 libgdbm3 libio-socket-inet6-perl libsocket6-perl perl perl-modules
Enable shorewall startup upon boot:
cat /etc/default/shorewall
# prevent startup with default configuration # set the following varible to 1 in order to allow Shorewall to start startup=1
Do the same for '/etc/default/shorewall6'
root@vm-net:/etc/default# /etc/init.d/shorewall start Starting "Shorewall firewall": not done (check /var/log/shorewall-init.log). root@vm-net:/etc/default# tail /var/log/shorewall-init.log Compiling... Processing /etc/shorewall/shorewall.conf... Dec 2 01:06:49 Processing /etc/shorewall/shorewall.conf... Dec 2 01:06:49 ERROR: Your kernel/iptables do not include state match support. No version of Shorewall will run on this system ERROR: Your kernel/iptables do not include state match support. No version of Shorewall will run on this system root@vm-net:/etc/default# /etc/init.d/shorewall6 start Starting "Shorewall6 firewall": not done (check /var/log/shorewall6-init.log). root@vm-net:/etc/default# iptables -L
/etc/init.d/shorewall6 start Starting "Shorewall6 firewall": not done (check /var/log/shorewall6-init.log). root@vm-net:/etc/default# tail /var/log/shorewall6-init.log 01:08:03 Shorewall configuration compiled to /var/lib/shorewall6/.start ERROR: IPSET=/usr/sbin/ipset does not exist or is not executable: Firewall state not changed Dec 02 01:08:03 ERROR: IPSET=/usr/sbin/ipset does not exist or is not executable Dec 02 01:08:03 ERROR:Shorewall6 restart failed:Firewall state not changed Terminated [: 167: -lt: unexpected operator ERROR: IPSET=/usr/sbin/ipset does not exist or is not executable: Firewall state not changed Dec 02 01:08:03 ERROR: IPSET=/usr/sbin/ipset does not exist or is not executable Dec 02 01:08:03 ERROR:Shorewall6 restart failed:Firewall state not changed Terminated
root@vm-net:/etc/default# apt-get install ipset
root@vm-net:/etc/default# which ipset /usr/sbin/ipset
/etc/init.d/shorewall6 start Starting "Shorewall6 firewall": done.
I'm used to using 'ifconfig' but I know should read more about 'ip'. 'ip' is a program included in the iproute2 package. ip replaces ifconfig and route in modern Linux systems.
root@vm-net:/etc/shorewall# make
Shorewall isn't started Compiling... ERROR: Your kernel/iptables do not include state match support. No version of Shorewall will run on this system
If you run 'iptables -L' on the vm-mgr, and retry this, it works ok. Still have to check if this happens more often, or if this problem returns after a reboot. It has something to do with the modules (loaded on the vm-mgr). Will have to debug with 'lsmod' before and after the 'iptables -L' action.
/* iptables -t nat -I PREROUTING -s ! 10.76.0.0/24 -p tcp –dport 80 -j DNAT –to 10.76.0.80:80 iptables -t nat -A PREROUTING -p tcp -d 145.99.246.62 –dport 80 -j DNAT –to-destination 10.76.0.80 */ http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables
apt-get install dnsutils bind9
The last configuration I would like to demonstrate today is changing the default logging file. First, I'll change the logging line in /usr/local/etc/dhcpd.conf so that it looks like this: # Use this to send dhcp log messages to a different log file (you also # have to hack syslog.conf to complete the redirection). log-facility local7; Next, I'll create an empty log file called dhcpd.log: # touch /var/log/dhcpd.log Then, I'll create an entry for this logfile in /etc/syslog.conf by adding this line: local7.* /var/log/dhcpd.log
apt-get install whois apt-get install dnsutils
dnsutils containes 'whois'?
These doesn't work, see pcap_findalldevs.txt
problem with pcap in lxc containers ('pcap_findalldevs')
eth0 / eth1 ?Possible cause: eth1 exists on vmmanager, not in vm-net??
root@vm-net:~# tcpflow tcpflow[1073]: SIOCGIFFLAGS: eth1: No such device root@vm-net:~# trafshow pcap_findalldevs: SIOCGIFFLAGS: eth1: No such device
Haven't tested wireshark, likely same issue.
apt-get install netdiag trafshow
Free Newsserver on IPv6 at NewsXS! NewsXS, a great news service provider offers free access to it's newsserver and newgroups, as a stimulus to getting more people using IPv6 (instead of IPv4, which is very quickly nearing its end of life)
http://packages.debian.org/nl/squeeze/sabnzbdplus
Add 'contrib' and 'non-free' to the apt sources:
nano /etc/apt/sources.list
deb http://ftp.nl.debian.org/debian squeeze main
to:
deb http://ftp.nl.debian.org/debian squeeze main contrib non-free
Install the software:
root@vm-net:/usr/src# apt-get install sabnzbdplus
The following NEW packages will be installed: file javascript-common libexpat1 libjs-excanvas libjs-mochikit libmagic1 libsqlite3-0 libtidy-0.99-0 mime-support par2 python python-chardet python-cheetah python-configobj python-feedparser python-libxml2 python-minimal python-openssl python-support python-utidylib python-yenc python2.5 python2.5-minimal python2.6 python2.6-minimal sabnzbdplus sabnzbdplus-theme-classic sabnzbdplus-theme-plush sabnzbdplus-theme-smpl unrar unzip wwwconfig-common
https://addons.mozilla.org/en-US/firefox/addon/7617/?src=external-sabfront host = 0.0.0.0 #localhost
Edit sabnzbd.ini to allow other hosts than 'localhost' to access
https://<<public_ip>>:8080
follow the instructions
SABnzbd+ 0.5.4 uses port 8080 for http traffic, and 9090 for https.
Open both ports in the firewall
Check out sabconnect++, the best plugin for Chrome & SabNZBD
root@vm-net:/etc/shorewall6# telnet -6 reader.ipv6.xsnews.nl 119
Trying 2001:67c:174:101::2... Connected to reader.ipv6.xsnews.nl. Escape character is '^]'. 201 reader.ipv6.xsnews.nl NNRP Service Ready (no posting).
Press 'Ctrl-]' q <return> to exit telnet.
root@vm-mgr:/var/log# modprobe ip6_tables root@vm-mgr:/var/log#
ping6 2a00:1450:8001::93
http://www.shorewall.net/MyNetwork.html#params /etc/shorewall/notrack #SOURCE DESTINATION PROTO DEST SOURCE USER/ # PORT(S) PORT(S) GROUP net:!192.88.99.1 - 41 dmz 206.124.146.255 udp dmz 255.255.255.255 udp loc 172.20.1.255 udp loc 255.255.255.255 udp $FW 255.255.255.255 udp $FW 172.20.1.255 udp $FW 206.124.146.255 udp This file omits the 6to4 traffic originating from 6to4 relays as well as broadcast traffic (which Netfilter doesn't handle).
na bind9: + copy configs http://www.matja.com/media/lessfsNotes.html http://www.mail-archive.com/lxc-users@lists.sourceforge.net/msg00211.html dig hotelpart.com mx
'AAAA' dns records are used for IPv6 addresses ('A' dns records for 'old style' IPv4) lookup ipv6 host nslookup dig
http://rollcage.bl.echidna.id.au/IPv6/sun/files/c0204.htm
1. On the command line, type the following command.
% nslookup
The default server name and address display, followed by the nslookup command angle bracket prompt.
2. To see information about a particular host, type the following commands at the angle bracket prompt.
>set q=any
>host-name
3. To see only AAAA records, type the following command at the angle bracket prompt.
>set q=AAAA
—- Please leave feedback or questions at the main page.