Re: Use an specific ADSL depending on IP

past I will turn the inner eye to see its path. Where the fear has gone there will be nothing. Only I will remain. Bene Gesserit Litany Against Fear. -- Michiel van Baak mich...@vanbaak.eu http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why

Re: Restricting source with dDNS (dynamic DNS)

for public keys, and go with that. This is the way i chose (mostly because of GPRS/UMTS/HSDPA access nowedays) and it's working great. -- Michiel van Baak mich...@vanbaak.eu http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts

Re: Reality check

from balance on 1.2.3.4 and give the box a new task once all webtraffic is going directly to 5.6.7.8 No need for extra boxen or whatever. -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts

Re: queuing question

. -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts and computer aficionados are both called users?

Re: simulate max traffic on an interface using queue

to be shaped as well let all traffic go through the machine and queue on both interfaces. -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts and computer afficionados are both called users?

Re: spamd reflector

to me though. Why cant you run spamd in front of your MX ? -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts and computer afficionados are both called users?

Re: Firewall and the best PF throughput

mbit when you use the right setup. -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts and computer afficionados are both called users?

Re: PF Table Size - Sanity Check

stuff ? Those are EMT64. -- Michiel van Baak [EMAIL PROTECTED] http://michiel.vanbaak.eu GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x71C946BD Why is it drug addicts and computer afficionados are both called users?

Re: auto-adding bad hosts to a table

-conn 10, max-src-conn-rate 2/10, \ overload ssh_attack flush) I guess you could use something like max-src-conn-rate 1/10 Greetz, -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Why is it drug addicts

Re: NAT / RDR Questions

Can't you use IAX2? I trashed all SIP did providers and switched to IAX2 and haven't been happier with my system since -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Why is it drug addicts and computer

Re: pf/carp for redundant production use

connections are coming from outside to inside and that is working well. :) Is the same true when the master dies ?? -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Why is it drug addicts and computer

Re: [Fwd: Problems with voip and state clashes]

? I know this is short on details, but if theres an easy way to do that, I don't need to bore you with them ;-) Thanks a lot, Tim Tim, Without details of your current setup it's hard to help. Please provide some more info. -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED

Re: natting static IP's

here do that. They simply arp for all MAC addresses on the network and that way the router sees an ip that is from your configured lan. I know it's lame, but hey, it works -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch

Re: PF help

. -- Michiel van Baak http://michiel.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Two of the most famous products of Berkeley are LSD and BSD. I don't think that this is a coincidence.

Re: Is NAT in PF UPnP enabled or Non UPnP?

, do something like: rdr on $ext_if proto tcp from any to $ext_if port 3389 - $winmachine1 port 3398 rdr on $ext_if proto tcp from any to $ext_if port 3390 - $winmachine2 port 3389 etc -- Michiel van Baak http://lunteren.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op

Re: questions about daniel hartmeier's pf.conf example ...

all TCP/UDP traffic out ? Or is what I am currently doing better ? 99% of the time it is enuf to filter incoming traffic and allow outgoing out Cheers - Alex -- Michiel van Baak http://lunteren.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch

Re: NAT state not deleted after IP change (DHCP)

. Try to stay away from iLIBc, it is huge but doesn't sound any better then ulaw. Just my 2 cents. -- Michiel van Baak http://lunteren.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Two of the most famous products of Berkeley are LSD and BSD

Re: NAT state not deleted after IP change (DHCP)

calls. I do know those 50 calls went smoothly thru a cheap Realtek based card plugged into our good old Pentium 133 MMX. Thanks, Cyrill -- Michiel van Baak http://lunteren.vanbaak.info [EMAIL PROTECTED] GnuPG key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x7E0B9A2D Two of the most

Re: macros and anchors

macro(s) across multiple files. This could be accomplished with a include directive, which is not supported by pfctl nowadays. But I don't know what Daniel and Henning think of it. Like Daniel posted on Friday 28: http://www.benzedrine.cx/pf-include.diff Have fun. -- Michiel van Baak http

Fw: memory issue

On Fri, 21 May 2004 09:55:56 +1200 Russell Fulton [EMAIL PROTECTED] wrote: On Fri, 2004-05-21 at 00:15, Michiel van Baak wrote: On Thu, 13 May 2004 12:47:42 +0200 Michiel van Baak [EMAIL PROTECTED] wrote: Hi all, I'm trying to setup my spamd table in pf. I used Daniel's script

memory issue

); }' | \ pfctl -t spamd -Td -f - cat nonspammers.tmp | \ awk '{ printf(!%s\n, $1); }' | \ pfctl -t spamd -Ta -f - -- Michiel van Baak http://lunteren.vanbaak.info [EMAIL PROTECTED]

ftp and irc problems

Hi all. @ the end of this email is my complete pf.conf file. I'm running -CURRENT from Fri Nov 21 I know I'm behind,.. cvs up is running I have a major problem with my pf setup and I cannot find my answer anywhere. 1. Hosts out on the internet cannot passive ftp to my server. And a lot that

Re: ftp and irc problems

On Tue, 2003-12-16 at 18:21, Michiel van Baak wrote: Hi all. @ the end of this email is my complete pf.conf file. I'm running -CURRENT from Fri Nov 21 I know I'm behind,.. cvs up is running I have a major problem with my pf setup and I cannot find my answer anywhere. 1. Hosts out

Re: latest snapshot, pf blocks until reloaded

Make sure to have the following line in your /etc/sysctl.conf net.inet.ip.forwarding=1 During one of my upgrades this setting was lost. Took me 3 days to figure it out. Maybe this happened to you too. Michiel On Sun, 2003-11-02 at 19:17, pf-list wrote: I may be experiencing the same problem

Re: pfstat gone nuts

On Thu, 2003-10-09 at 19:36, Colin Harford wrote: http://www.ualberta.ca/~charford/pfstat1.jpg So, I think a picture is worth a thousand words. I've had pfstat working for a couple weeks on this machine without problems. It is monitoring a single 100 megabit pipe, usually with 3 mb/sec

Re: failing file transfers (seti@home)

and change all the Windows systems :) Peter Make a registry export from this key and put it in the domain login script :)) That way we do something like this here. -- Michiel van Baak-( When one burns one's bridges, what )- [EMAIL PROTECTED] -( a very nice fire

Re: Port = domain

On Wed, 26 Mar 2003 15:42:24 - Richard Maclannan [EMAIL PROTECTED] wrote: Can anyone tell me which ports are covered by port = domain? To stop me from asking any more obvious questions, is there a list of name aliases for certain ports? Thanks, Richard Maclannan Facilities Technical

Re: Priorizing empty ACKs

:) Is this patch going to be in 3.3 ?? I'm running 28/2/2003 3.2-current and this patch did the job. Would be nice to see it in 3.3 so I can roll out it easily on wrk servers. Michiel van Baak

Re: iptables

Mhz here and it works SUPER as 3.2-current firewall for my home network. As far as I can notice I have no network slowdown compared to the firewall at work (pII 400). For me this makes more sense then a graph. pf is FAST, even on slow hardware. Michiel van Baak PS: For the record - I have 110

Re: dDoS attacks

On Tue, 5 Nov 2002 17:28:18 -0500 jolan [EMAIL PROTECTED] wrote: On Tue, Nov 05, 2002 at 02:49:42PM +0100, Michiel van Baak wrote: Anyone who can enlighten me ? ddos attacks need to be blocked at the router and even then it doesn't mean you're going to come away from one unscathed

Re: dDoS attacks

Thnx all. The trick with the max states and timeouts works fine. Michiel