Networking-Blog

Tags: vrf lite

by admin

Prevent a Route from being Redistributed from OSPF to BGP

Assume you wanted to prevent a route for 10.0.0.0/24 from being redistributed from OSPF to BGP.
One way to accomplish this would be to define an extended ACL matching this prefix and reference
it from the BGP redistribution route map:

router ospf 1
router-id 2.2.2.2
log-adjacency-changes
!
router bgp 65100
no synchronization
bgp router-id 2.2.2.2
bgp log-neighbor-changes
redistribute ospf 1 route-map OSPF->BGP
neighbor 172.16.23.3 remote-as 65100
no auto-summary
!
ip access-list extended OSPF_Redist
deny ip host 10.0.0.0 host 255.255.255.0
permit ip any any
!
route-map OSPF->BGP permit 10
match ip address OSPF_Redist

The above configuration prevents the exact prefix 10.0.0.0/24 from being advertised by denying the
10.0.0.0 network (“source” address) with a mask of 255.255.255.0 (“destination” address).
All other prefixes are allowed by the permit ip any any statement.

This can be accomplished more intuitively by employing a prefix list:

router ospf 1
router-id 2.2.2.2
log-adjacency-changes
!
router bgp 65100
no synchronization
bgp router-id 2.2.2.2
bgp log-neighbor-changes
redistribute ospf 1 route-map OSPF->BGP
neighbor 172.16.23.3 remote-as 65100
no auto-summary
!
ip prefix-list OSPF_Redist seq 5 deny 10.0.0.0/24
ip prefix-list OSPF_Redist seq 10 permit 0.0.0.0/0 le 32
!
route-map OSPF->BGP permit 10
match ip address prefix-list OSPF_Redis

March 7, 2011 3:18 pm

Tags: bgp route-map, ospf route-map

by admin

EIGRP Summary

EIGRP is similar to IGRP only in the sense that it uses the same metrics;

Delay
Bandwidth
Reliability
Load

passive-interface default to block all EIGRP adjacencies

no passive-interface default
!
router eigrp 80
passive-interface interface fastethernet 0/1 – no hello send but still advertise network.
passive-interface default – turns on passive-interface globally on all interfaces.
no passive-interface seial 0/1 – turns off passive-interface on these interfaces.
!
summary 172.16.0.0/16 to 172.16.7.255.
int serial 0/1
ip summary-address eigrp 90 172.16.0.0 255.255.248.0

Use specific wildcard mask
router eigrp 80
network 10.1.2.2 0.0.0.0 (host address only)

no auto-summary – Disables Auto Subnet Summarization.

default route pointing to 192.168.1.0/24
router eigrp 80
network 192.168.1.0
exit
ip default-network 192.168.1.0

in show ip route
will see “s* static route.

Unequal load cost balancing.
eigrp by default uses equal load cost balancing a variance of 1 meaning it will load balance
over 1 equal cost link of the same bandwidth.

configuring variance of 2 will load balance across 2 links as bad as the primary.

router eigrp 80
variance 2

you will see in routing-table 2 routes being used over 2 unequal cost bandwidth links

Frame Relay – locally significant
EIGRP Uses 224.0.0.10 mulicast

EIGRP packet delivery is handled using Reliable Transport Protocol (RTP).
EIGRP uses IP protocol number 88.

EIGRP uses the Neighbor Table to list adjacent routers.
Topology Table lists all the learned routes to a destination.
Routing Table contains the best route to a destination, which is known as the Successor.
The Feasible Successor is a backup route to a destination which is kept in the Topology Table.

Broadcast on router by default are denied.
EIGRP came up with “PSEUDO-BROADCASTS” or Manual Neighbors.

int s0/0
ip address 172.16.124.1 255.255.255.248 multipoint
frame-relay map ip 172.16.124.2 102 broadcast
frame-relay map ip 172.16.124.3 103 broadcast
!
show frame-relay map

Multipoint = everyone is on 1 subnet.
Point-to-Point = everyone is on its own subnet.

Advantage is multipoint it saves ip addresses.

Eigrp manual neighbors disables multicast and uses unicast.

router eigrp 25
neighbors 172.16.124.102
neighbors 172.16.124.103

In frame-relay networks :
Split Horizon is disabled on Physical Interfaces
Split Horizon is enabled on Sub-interfaces
!
Enable split horizon on a sub-interface :
This will allow routing updates to leave interface rather than just receive them :

On a multipoint set-up split-horizon will need to be disabled : Spoke and Hub Topology.

int s0/0.1
no ip split-horizon eigrp 25
!

Supports variable length subnet masks (VLSM).
Automatic Route Summarization.
3 Networks Summarization :

HQ
10.1.1.0/24
10.1.2.0/24
10.1.3.0/24
!
EAST
10.2.1.0/24
10.2.2.0/24
10.2.3.0/24
!
WEST
10.3.1.0/24
10.3.2.0/24
10.3.3.0/24
!
Summary Addresses :
in interface mode :

On HQ
ip summary-address eigrp 25 10.1.0.0 255.255.252.0/
!
On EAST
ip summary-address eigrp 25 10.2.0.0 255.255.252.0
!
On WEST
ip summary-address eigrp 25 10.3.0.0 255.255.252.0

Configure HQ router to utilise up to 30% more of the allocated interface bandwidth
than eigrp’s default configuration.

EIGRP’s default limits of 50% bandwith of the link bandwidth configured .

e.g
interface bandwidth configured :

int s0/0
bandwith 200
!
HQ router has 2 neighbors peering.

ip bandwidth-percent eigrp 25 80
equal 30% more bandwidth given.

Optionally, you can configure the amount of WAN link bandwidth that an
EIGRP router will use with this command:

Router(config-if)# ip bandwidth-percent eigrp XX

Once EIGRP is configured, you can check the status using the show ip route and
show ip eigrp commands.

!

MD5 authentication can be used to authorise EIGRP packets.
Configure Authentication Keys
!

config t

key chain EIGRP_KEYS

key 1

key-string CISCO1

accept-lifetime 00:00:00 jan 1 2010 00:00:00 feb 1 2010

send-lifetime 00:00:00 jan 1 2010 00:00:00 feb 1 2010

!

key 2

key-string CISCO2

accept-lifetime 00:00:00 jan 28 2010 infinite

send-lifetime 00:00:00 jan 28 2010 infinite
!

Enable Authentication :
!

config t

int s0/1.1

ip authentication mode eigrp 25 md5

ip authentication key-chain eigrp 25 EIRP_KEYS
!
!

Make sure NTP Clock is synchronised on all router for this to work accurately :
!

Troubleshooting :

debug eigrp packet

!

By default, EIGRP stub routers advertise information about two types of routes
back to the hub – directly connected networks and summary routes.

To change this default, use the eigrp stub command followed by the types of
routes you want the stub to advertise back to the hub.

The eigrp stub command run by itself simply configures the router as stub.
!

R1(config)#router eigrp 100
R1(config-router)#eigrp stub ?
!
connected Do advertise connected routes
receive-only Set IP-EIGRP as receive only neighbor
static Do advertise static routes
summary Do advertise summary routes

They will then advertise their directly connected networks and summary
routes back to the hub and will receive only a default route back from the hub.

EIGRP Stub Routers - CCNP ROUTE Exam

If R5 loses a successor and has no feasible successor, it will not send a
DUAL query packet to any of the stub routers, since it knows they are indeed
stub routers and cannot possibly have or acquire a replacement for the lost
successor route.

Logging EIGRP Neighbor State Changes

You want to log EIGRP neighbor state changes.

Solution

To enable the logging of EIGRP neighbor state changes, use the eigrp log-neighbor-changes
configuration command:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#router eigrp 55
Router1(config-router)#eigrp log-neighbor-changes
Router1(config-router)#exit
Router1(config)#end
Router1#

Another closely related feature is the eigrp log-neighbor-warnings configuration command:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#router eigrp 55
Router1(config-router)#eigrp log-neighbor-warnings 300
Router1(config-router)#exit
Router1(config)#end
Router1#

When a neighbor relationship is lost, you also lose all of the routing entries for that neighbor.
And the effects of this lost routing information are often felt throughout the network. Therefore,
it can be extremely useful to have a good log of neighbor change events for troubleshooting strange
intermittent network problems.
However, this feature also gives you a good way of looking for faults on links that don’t have a way of
telling you about loss of connectivity. This command is enabled by default.

Troubleshooting EIGRP And Disabling Split Horizon

EIGRP has been correctly configured on each interface, 
but something odd occurs when we check the EIGRP tables - neither of the
spoke routers can see the other spoke router's loopback network.
!
Because EIGRP runs split horizon by default, R1 cannot send a
route advertisement out the same interface the advertisement was
received upon to begin with.

R1 is learning about R2's loopback and R3's loopback on Serial0,
so R1 cannot advertise those routes right back out the same interface.
We've got two choices - we can set up subinterfaces on R1 or we can
disable split horizon on R1's Serial0 interface

Let's disable SH with EIGRP, since the command is a little different than
what you may have seen in your studies.
!
R1(config)#int serial0
R1(config-if)#no ip split-horizon eigrp 100

Passive-Interface

The passive interface feature is used to make a routing protocol accept
routing information from neighbors, but prevent information from being
advertised to neighbors.


EIGRP discovers neighbors using hello messages before accepting routes and
installing them in the routing table. Hello messages are normally sent and
received on an interface configured for EIGRP.

However, the passive interface feature in EIGRP makes an interface stop sending
and receiving hello messages. This tears down any existing neighbor relationships
and stops learning routes from any EIGRP neighbors available on the interface and
configured as passive.


To enable Passive interface globally on all interfaces :
config t
router eigrp 10
passive-interface default 
then you will disable passive-interface on specified neighbor interfaces :


config t
router eigrp 10
no passive-interface loopback 0



To verify rather or not an interface is in passive-mode you can use :  
show ip protocols. 
Best Practices is to enable "Passive-Interface Default" on all interfaces
and to disable run the "no passive-interface fa0/0" on individual interfaces
to allow hello messages to communicate between neighbors to advertise their
networks.

January 31, 2011 8:36 pm

Tags: eigrp

by admin

Resolve IP MTU Fragmentation with GRE

This scenario illustrates GRE fragmentation.

Remember that you fragment before encapsulation for GRE, then do PMTUD for the
data packet, and the DF bit is not copied when the IP packet is encapsulated by GRE.
!
In this scenario, the DF bit is not set. The GRE tunnel interface IP MTU is,
by default, 24 bytes less than the physical interface IP MTU,
so the GRE interface IP MTU is 1476.

The the sender sends a 1500-byte packet (20 byte IP header + 1480 bytes
of TCP payload).
Since the MTU of the GRE tunnel is 1476, the 1500-byte packet is broken
into two IP fragments of 1476 and 44 bytes, each in anticipation of the
additional 24 byes of GRE header.
The 24 bytes of GRE header is added to each IP fragment.
Now the fragments are 1500 (1476 + 24) and 68 (44 + 24) bytes each.
The GRE + IP packets containing the two IP fragments are forwarded
to the GRE tunnel peer router.
The GRE tunnel peer router removes the GRE headers from the two packets.
This router forwards the two packets to the destination host.
The destination host reassembles the IP fragments back into the original
IP datagram.

Additional Notes :

Under normal circumstances, when two hosts communicate via TCP,
they communicate with each other to determine the Send Maximum Segment Size (SMSS).
Often this turns out to be 1500 bytes, which not coincidentally, is the maximum amount
of payload in an Ethernet frame.
All is well until a combination of technologies combine to break the system.

First, the packets travel through a GRE (generic routing encapsulation) tunnel across
an Ethernet interface. This encapsulation tacks on 24 bytes.

1500 – 24 = 1476

Thus, if either host sends a packet that is larger than 1476, the packet must be
fragmented (typically by one of the tunnel endpoints) to cross the tunnel.
Unfortunately, the hosts do not realize this, because they have only communicated with
one another and agreed upon the 1500 value, but connectivity isn’t broken.

At this point, any one of a number of things can break this connectivity.
If the transmitting host sets the Don’t Fragment bit, the router will be forced to drop
the packet. However, it will *usually* send an ICMP (Internet Control Message Protocol)
message informing the sender to use smaller packets. But even if it sends the ICMP messages,
they are often filtered or blocked by firewalls somewhere in the path, so the host never knows
why the packet wasn’t delivered.

Another problem that can occur is a firewall that blocks fragmented packets.

January 20, 2011 3:21 pm

(No tags)

by admin

Cisco Eigrp Summary 2

Variance

Every routing protocol supports equal cost path load balancing. In addition,
Interior Gateway Routing Protocol (IGRP) and EIGRP also support unequal cost path load balancing.

Use the variance n command in order to instruct the router to include routes with a metric of less
than n times the minimum metric route for that destination.

The variable n can take a value between 1 and 128.
The default is 1, which means equal cost load balancing.
Traffic is also distributed among the links with unequal costs, proportionately, with respect to
the metric.

router eigrp 1
network x.x.x.x
variance 2 ( load balance over 2 unequal cost links).

Traffic Sharing

EIGRP not only provides unequal cost path load balancing, but also intelligent load balancing,
such as traffic sharing.

In order to control how traffic is distributed among routes when there are multiple routes for
the same destination network that have different costs, use the traffic-share balanced command.
With the keyword balanced, the router distributes traffic proportionately to the ratios of the metrics that
are associated with different routes.

This is the default setting:

router eigrp 1
network x.x.x.x
variance 2
traffic-share balanced

When you use the traffic-share command with the keyword min, the traffic is sent only
across the minimum-cost path, even when there are multiple paths in the routing table.

router eigrp 1
network x.x.x.x
variance 3
traffic-share min across-interfaces

Load Balancing in CEF

Cisco Express Forwarding (CEF) is an advanced Layer 3 switching technology which can be used for
load balancing in routers. By default, CEF uses per-destination load balancing.

If it is enabled on an interface, per-destination load balancing forwards packets based on the
path to reach the destination. If two or more parallel paths exist for a destination,
CEF takes the same path (single path) and avoids the parallel paths.

This is a result of the default behavior of CEF. CEF takes the single path in cases when load sharing is
done simultaneously on interfaces of different physical types, such as serial and tunnel.

In order to utilize all the parallel paths in CEF and load balance the traffic, you must enable
per-packet load balancing.
When you have different physical interfaces like serial and tunnel. So, on the basis of the
configuration and topology (serial or tunnel), load sharing can fail to work correctly with the
default CEF load balancing mode.

Enable these commands for load sharing on a per-packet basis:

interface serial 0
ip load-sharing per-packet

no passive-interface default

passive-interface default to block all Eigrp adjacencies. Using no passive-interface default
will allow EIGRP communication.

router eigrp 80
passive-interface interface fastethernet 0/1 – no hello send but still advertise network.
passive-interface default – turns on passive-interface globally on all interface.
no passive-interface seial 0/1 – turns off passive-interface on these interfaces.

Ip summary-address eigrp

To configure a summary aggregate address for a specified interface, use the
ip summary-address eigrp command in interface configuration mode.

summary 172.16.0.0/16 to 172.16.7.255

int serial 0/1
ip summary-address eigrp 90 172.16.0.0 255.255.248.0

Configured Eigrp Host Address Only.

router eigrp 80
network 10.1.2.2 0.0.0.0 (host address only).

ip default-network

You can use ip default-network when ip routing is enabled on the Cisco router.
When you configure ip default-network the router considers routes to that network for installation
as the gateway of last resort on the router.

For every network configured with, if a router has a route to that network, that route is flagged as
a candidate default route.

ip default-network 192.168.1.0

“show ip route” will see s* static route.

January 17, 2011 10:19 am

Tags: cisco eigrp, eigrp

by admin

ASA – Group Object

Create a Object-Group icmp-type ICMP traffic :

object-group icmp-type INBOUND
description Permit necessary inbound ICMP traffic
icmp-object echo
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded

Create a Object-Group service for TCP traffic :

object-group service INBOUND tcp
description Inbound Access
port-object eq 3389
port-object range 9998 9999

January 8, 2011 9:02 pm

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router

Tags: asa, icmp object group, object group, tcp object group

by admin

ADSL2 v ADSL2+

There’s a common misconception that ADSL2+ is faster than ADSL2 on any line.
That’s not really the case. In simple terms,

ADSL2+ utilises twice the frequency range available on your phone line that ADSL2 does.
This again, in simple terms means twice as fast BUT that is only seen on short low attenuation lines.

If your line is only capable of supporting 7meg on ADSL2 then it’s only capable of supporting 7meg on ADSL2+
as it can only usually allow the use of the same frequencies for both (see below).

However, if you’re lucky enough to have a line that can support higher frequencies then you get up to :

12meg on ADSL2 (the maximum possible)
but up to
24meg on ADSL2+.

The cross over between ADSL2 and ADSL2+ is therefore in the 10-12 meg range (typically 35-40db if the line is relatively noise free).

It can give faster speeds but usually only on short lines as explained above.
The only time that wouldn’t be true is for a moderately short line
(that offered some higher frequencies above those usable by ADSL2)
that had induced noise at the lower frequencies and was clean at higher frequencies,
in which case ADSL2+ would possibly be better as it could use those higher frequencies.

There is also the possibility that a network uses equipment whose firmware works better in
certain conditions with specific ADSL modes hence why it is mentioned G.DMT sometimes being
better for problem lines.

January 8, 2011 5:36 pm

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router

Tags: adsl2, dsl

by admin

Cisco: 1841 – 3G Configuration

This configuration example is for use with a 3G WIC card within a Cisco based
Router.

This was configured with a Vodafone Network.

Initialization

Place the SIM card into it, then insert the card in the router and power it on.

Create a Profile specific to your mobile ISP

Insert the APN told by your ISP (Vodafone UK: ‘Internet’ username: ‘web’ password: ‘web’)
Insert the authentication method (chap or pap) and the credentials, also supplied from your ISP

Below is an example of a Vodafone UK Cellar Profilule.
Router# cellular 0/0/0 gsm profile create 1 Internet chap web web

From the profile you’ve just created, you can review it using command

router# sh cellular 0 profile

Profile Information
====================
Profile 1 = ACTIVE
--------
PDP Type = IPv4
PDP address = 192.168.1.1
Access Point Name (APN) = Internet
Authentication = PAP
Username: web, Password: web 

* - Default profile

Configuration

You need to define a chat script first, which is used for modem setup and call
initialization. If you are familiar with IOS dial configurations, you feel at home.
Please note that the last number in the dial string (1 in the example below) refers
to the modem profile number you hopefully have defined earlier.

! your chat script
chat-script vodafone “” “ATDT*98*1#” TIMEOUT 60 CONNECT

! the bare interface config
! subcommands at the Cellular interface

interface Cellular0/0/0
ip address negotiated
ip virtual-reassembly
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string vodafone
dialer-group 1
async mode interactive
ppp chap hostname web
ppp chap password 0 web
ppp ipcp dns request

!

ip route 0.0.0.0 0.0.0.0 Cellular0
dialer-list 1 protocol ip permit

! this is the async line assigned to the 3G modem
you need to specify your chat script here

line 0/0/0
script dialer vodaphone
no exec
rxspeed 3600000
txspeed 384000

If cellular int does not get an ip address, might need to go into
config t and add this line even thou we see it above :

line 0/0/0
script dialer vodaphone

!
!

show command:

Just in case you need it for troubleshooting, here are the show commands to use.

show cellular 0 network
show cellular 0 hardware
show cellular 0 connection
show cellular 0 radio
show cellular 0 profile
show cellular 0 security
show cellular 0 all Debug commands :
debug chat Rather than reloading the router to restart the module, you can
actually using CLI to reset or reboot the module :

debug chat

router(config)# service internal
router(config)# exit
router# test cellular 0 modem-power-cycle ! for rebooting
router# test cellular 0 modem-reset ! for resetting

debug commands :

debug chat
debug modem
debug dialer events
debug ppp authentication
Remember to create the Cellular Profile, after tftp config to router :
cellular 0/0/0 gsm profile create 1 Internet chap web web
This is the bare configuration, you will need to add NAT, firewalls etc etc.

January 6, 2011 5:54 pm

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router

Tags: 3g, 3g 1841, cisco 1841

by admin

Linux Video Driver Version Command

Video Driver Version Command

dmesg | grep NVIDIA
sudo lspci -vvnn | grep 10de

What I did from the command line is to find the packages for nvidia

(dpkg -l | grep nvidia)
and then
apt-get remove nvidia-173

(or whatever package you get from the previous command).

The problem is that you will still have the nvidia modues listed in xorg.conf.
So, I also mv /etc/X11/xorg.conf /etc/X11/xorg.conf_backup
and rebooted.

I landed in a graphical mode as usual, without the nvidia GL stuff,
but then there are graphical tools to set it up.

At this state, it’s safe to delete the xorg.conf backup you just created.

####################
Whenever I try to start my computer from kernel version 3 (it boots fine with 2.6) Kubuntu stops booting
altogether.

11.10 stops booting at “Checking battery state … [OK]”

I had to reinstall my graphics drivers.

sudo apt-get install --reinstall nvidia-173

January 2, 2011 1:04 pm

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router

Tags: linux driver, linux nvidia, linux video

by admin

Home Linux Ubuntu Iptables Firewall Rule

# Generated by iptables-save v1.4.4 on Wed Dec 29 15:11:27 2010
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT –reject-with icmp-port-unreachable
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 222 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 222 -m state –state NEW -m recent –update –seconds 60 –hitcount 8 –rttl –name SSH –rsource -j DROP
-A INPUT -d 172.16.254.3/32 -i eth0 -p tcp -m tcp –dport 8080 -j ACCEPT
-A INPUT -d 10.20.254.254/32 -i eth0 -p tcp -m tcp –dport 1723 -j ACCEPT
-A INPUT -d 172.16.254.3/32 -i eth0 -p udp -m udp –dport 7777 -j ACCEPT
-A INPUT -d 172.16.254.3/32 -i eth0 -p udp -m udp –dport 7778 -j ACCEPT
-A INPUT -d 172.16.254.3/32 -i eth0 -p udp -m udp –dport 7787 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 5800 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 5900 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 5901 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 5902 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 5938 -j ACCEPT
-A INPUT -s 10.20.254.249/32 -d 192.168.2.4/32 -i ppp0 -p tcp -m tcp –dport 139 -j ACCEPT
-A INPUT -s 192.168.6.0/29 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 139 -j ACCEPT
-A INPUT -s 172.16.254.3/32 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 139 -j ACCEPT
-A INPUT -s 172.16.254.3/32 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 10.0.1.0/24 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 192.168.6.0/29 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 10.20.254.249/32 -d 192.168.2.4/32 -i ppp0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 192.168.3.0/29 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 192.168.4.0/28 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -s 172.16.0.2/32 -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 445 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 21 -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 192.168.2.4/32 -i eth0 -p udp -m udp –dport 514 -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 192.168.2.4/32 -i eth0 -p udp -m udp –dport 9996 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p udp -m udp –dport 50518 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p tcp -m tcp –dport 50518 -j ACCEPT
-A INPUT -d 192.168.2.4/32 -i eth0 -p udp -m udp –dport 6881 -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 10.20.254.248/29 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 172.16.254.2/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 172.16.254.3/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.2.1/32 -d 172.16.254.3/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.4.0/28 -d 192.168.2.4/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.4.0/28 -d 172.16.254.3/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 192.168.6.0/29 -d 192.168.2.4/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 172.16.0.2/32 -d 192.168.2.4/32 -i eth0 -p icmp -j ACCEPT
-A INPUT -s 10.20.254.248/29 -d 10.20.254.248/29 -i ppp0 -p icmp -j ACCEPT
-A INPUT -s 10.20.254.249/32 -d 192.168.2.4/32 -i ppp0 -p icmp -j ACCEPT
-A INPUT -m limit –limit 5/min -j LOG –log-prefix “iptables denied: ” –log-level 7
-A INPUT -j DROP
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 80 -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -p tcp -m tcp –sport 8080 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 443 -j ACCEPT
-A OUTPUT -s 10.20.254.254/32 -p tcp -m tcp –sport 1723 -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -p udp -m udp –sport 7777 -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -p udp -m udp –sport 7778 -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -p udp -m udp –sport 7787 -j ACCEPT
-A OUTPUT -s 10.20.254.254/32 -p gre -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 5938 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 5900 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 21 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.2.1/32 -p tcp -m tcp –dport 2222 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.3.2/32 -p tcp -m tcp –dport 2223 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.4.2/32 -p tcp -m tcp –dport 2223 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.2.1/32 -p udp -m udp –dport 53 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 30000 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.2/32 -d 192.168.2.1/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.2/32 -d 172.16.254.1/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.2/32 -d 172.16.254.3/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -d 172.16.254.1/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -d 172.16.254.2/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -d 192.168.2.4/32 -p icmp -j ACCEPT
-A OUTPUT -s 172.16.254.3/32 -d 192.168.4.0/28 -p icmp -j ACCEPT
-A OUTPUT -s 10.20.254.254/32 -d 192.168.2.1/32 -p icmp -j ACCEPT
-A OUTPUT -s 10.20.254.254/32 -d 192.168.2.4/32 -p icmp -j ACCEPT
-A OUTPUT -s 10.20.254.249/32 -d 192.168.2.4/32 -p icmp -j ACCEPT
-A OUTPUT -s 10.20.254.254/32 -d 10.20.254.249/32 -p icmp -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p udp -m udp –dport 69 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 23 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p udp -m udp –dport 123 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 81.103.221.11/32 -p tcp -m tcp –dport 25 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.2.1/32 -p udp -m udp –dport 514 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.2.1/32 -p udp -m udp –dport 161 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.2.1/32 -p udp -m udp –dport 162 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 4070 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 192.168.5.2/32 -p tcp -m tcp –dport 9100 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -d 94.136.40.61/32 -p tcp -m tcp –dport 110 -j ACCEPT
-A OUTPUT -s 192.168.2.4/32 -p tcp -m tcp –dport 1024:65535 -j ACCEPT
-A OUTPUT -m limit –limit 5/min -j LOG –log-prefix “iptables denied: ” –log-level 7
-A OUTPUT -j DROP
COMMIT
# Completed on Wed Dec 29 15:11:27 2010
# Generated by iptables-save v1.4.4 on Wed Dec 29 15:11:27 2010
*nat
:PREROUTING ACCEPT [430:32842]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [2773:170524]
COMMIT
# Completed on Wed Dec 29 15:11:27 2010
# Generated by iptables-save v1.4.4 on Wed Dec 29 15:11:27 2010
*mangle
:PREROUTING ACCEPT [1735576:104189954]
:INPUT ACCEPT [1735512:104181797]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2877496:3782379744]
:POSTROUTING ACCEPT [2874912:3782220690]
COMMIT
# Completed on Wed Dec 29 15:11:27 2010

December 31, 2010 5:32 pm

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router