Mostrando postagens com marcador Networking. Mostrar todas as postagens
Mostrando postagens com marcador Networking. Mostrar todas as postagens

Configuring Static Routes with ip commands

As a system administrator, you can configure static routes using the ip route command.
To display the IP routing table, use the ip route command. For example:
~]$ ip route
default via 192.168.122.1 dev ens9  proto static  metric 1024
192.168.122.0/24 dev ens9  proto kernel  scope link  src 192.168.122.107
192.168.122.0/24 dev enp1s0  proto kernel  scope link  src 192.168.122.126
The ip route commands take the following form:
ip route [ add | del | change | append | replace ] destination-address
See the ip-route(8) man page for more details on the options and formats. 
 
To add a static route to a host address, in other words to a single IP address:
~]# ip route add 192.0.2.1 via 10.0.0.1 [dev interface]
where 192.0.2.1 is the IP address of the host in dotted decimal notation, 10.0.0.1 is the next hop address and interface is the exit interface leading to the next hop. 
 
To add a static route to a network, in other words to an IP address representing a range of IP addresses:
~]# ip route add 192.0.2.0/24 via 10.0.0.1 [dev interface]
where 192.0.2.0 is the IP address of the destination network in dotted decimal notation and /24 is the network prefix. The network prefix is the number of enabled bits in the subnet mask. This format of network address slash network prefix length is sometimes referred to as classless inter-domain routing (CIDR) notation.
To remove the assigned static route:
~]# ip route del 192.0.2.1

Export/import windows server DNS zones

You can use Export-DnsServerZone and Import-DnsServerZone.
  1. Export: Export-DnsServerZone -Name "test.com" -Filename "test.com.dns"
  2. Import: Import-DnsServerZone -Name "test.com" -Filename "test.com.dns"

The file "test.com.dns" will be created in "C:\windows\system32\dns" folder


Only export dns records:

Get-DnsServerResourceRecord -ZoneName "test.com" | Export-Csv -Path "C:\temp\dns.csv" 


Import option 2:

dnscmd localhost /zoneadd teste.com /primary /file teste.com /load




Command ip examples

 
# Forcefully close a connection to a specific destination
sudo ss -K dst 192.168.1.100

# view routes
ip r
ip route

# To reject a route (block traffic to an IP)
ip route add unreachable 74.1.1.0/24
ip route del unreachable 74.1.1.0/24

  
# add route 
sudo ip route add {NETWORK/MASK} via {GATEWAYIP}
sudo ip route add {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} dev {DEVICE}
sudo ip route add default {NETWORK/MASK} via {GATEWAYIP}

# Here is another example where I am setting up route for my VPN gateway:
ip link set dev tun0 up mtu 1500
ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
ip route add 139.59.2.125/32 via 192.168.2.254
ip route add 0.0.0.0/1 via 10.8.0.1
ip route add 128.0.0.0/1 via 10.8.0.1


Edit config file such as /etc/sysconfig/network-scripts/route-eth0 on a CentOS/RHEL/Fedora Linux for interface eth0 using a text editor such as nano command or vim command:
vim /etc/sysconfig/network-scripts/route-eth0

Append the following text:
172.10.1.0/24 via 10.0.0.100 dev eth0

Save and exit (close) the file in a vim text editor. Finally, restart your network service on a CentOS/RHEL/Fedora Linux so they take effect:
systemctl restart network.service



A note about ip command and persistence static routing on a Debian/Ubuntu

Edit your /etc/network/interfaces file for say eth0:
vi /etc/network/interfaces

Update it as follows:

auto eth0
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.254
## static ip config START ##
up /sbin/ip route add 172.10.1.0/24 via 10.8.0.1 dev eth0
down /sbin/ip route delete 172.10.1.0/24 via 10.8.0.1 dev eth0
## static ip config END ##


## How to find the route used for an destination IP

The syntax is as follows:
ip route get to {IPv4_address_here}
ip route get to {IPv6_address_here}
ip route get to 172.66.43.74

Outputs indicating that 172.66.43.74 can be reached via the wg0 interface with 192.168.13.4 as source IP:

172.66.43.74 dev wg0 table 51832 src 192.168.13.4 uid 1000 
    cache 

Export netflow from linux server

 
https://github.com/irino/softflowd

pico /etc/systemd/system/softflowd.service

[Unit]
Description=Softflowd exporter
After=network.target


[Service]
ExecStart=softflowd -i ens160 -v 9 -s 1 -t maxlife=1 -t general=15 -d -n 10.25.10.59:9996
Restart=always
User=root
Group=root

[Install]
WantedBy=default.target



Monitoring response time with curl

 

 curl -s -o /dev/null -w "Conecction: %{time_connect}s | Start transfer: %{time_starttransfer}s | Total time: %{time_total}s\n" https://example.com
 

 curl -s -o /dev/null -w "Conecction: %{time_connect}s | Start transfer: %{time_starttransfer}s | Total time: %{time_total}s\n" https://example.com >> /tmp/curl.txt 

 

Veeam RMAN plugin Windows network tuning

 

In larger environments lots of connections are made by the Plug-In backups. It is recommended to tune the network settings of the involved Windows machines in the Veeam infrastructure (Windows VBR server and Windows repository servers) according to the Microsoft guide to improve network performance:

  • Increase the available dynamic port range. The default dynamic ports range in Windows is 49152-65535 which is 16384 ports. Use the following command to increase the amount of available dynamic ports for IPv4 to 55525 without affecting ports of Veeam services:

    netsh int ipv4 set dynamicport tcp start=10010 num=55525

  • Add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpTimedWaitDelay and set it to 30 to reduce the time a port keeps being blocked for reuse (default is 240 seconds)

Fix netplan gateway4 deprecated

 

example:                  

network:
  version: 2
  ethernets:
    ens192:
      dhcp4: false
      dhcp6: false
      addresses:
        - 10.20.0.16/23
      nameservers:
        addresses:
        - 10.20.0.11
        search:
        - mpro.gov
      routes:
        - to: default
          via: 10.20.0.250
        - to: 10.0.0.0/8
          via: 10.20.0.254
        - to: 172.16.0.0/12
          via: 10.20.0.254


Fix permissions:
chmod 600 /etc/netplan/*.yaml 

 

 

View network connections, ports and process


View network connections, ports and process:

lsof command example

Type the following command to see IPv4 port(s), enter:
# lsof -Pnl +M -i4

Type the following command to see IPv6 listing port(s), enter:
# lsof -Pnl +M -i6

Process information
# lsof -p PID

netstat command example


Type the command as follows:
# netstat -patun

OR
# netstat -netpl


Disable IPv6 on Ubuntu


Disable in current session:

$ sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
$ sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1


The above IPv6 disable settings would not persist after the reboot. The usual way on how to load the above settings is to edit the /etc/sysctl.conf configuration file by adding the following lines:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1


WARNING: Please note, that at the time of writing this method to disable IPv6 after reboot using /etc/sysctl.conf configuration file on Ubuntu 18.04 does Not work. However, this seems to be a bug so feel free to try.
The recommend method to disable IPv6 on Ubuntu 18.04 after reboot is to configure the GRUB boot loader to pass kernel parameter during the boot time.

To do so open the /etc/default/grub using your favorite text editor with root privileges and change/add:

FROM:
GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX=""

TO:
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"
GRUB_CMDLINE_LINUX="ipv6.disable=1"



update-grub

Reboot the system to disable IPv6 support.

 

 

 

View what process listen at port


View what process listen at port

Linux:
$ sudo lsof -i -P -n
$ sudo lsof -i -P -n | grep LISTEN



Windows:
netstat -bano | more
netstat -bano | grep LISTENING
netstat -bano | findstr /R /C:"[LISTEING]"


GPO error with samba 4

GPO from samba 4 don't work.

On server:  
samba-tool ntacl sysvolreset

On windows client: 
gpupdate /force




Linux shell network monitoring tools


1. Overall bandwidth - nload, bmon, slurm, bwm-ng, cbm, speedometer, netload

2. Overall bandwidth (batch style output) - vnstat, ifstat, dstat, collectl

2. Bandwidth per socket connection - iftop, iptraf, tcptrack, pktstat, netwatch, trafshow

3. Bandwidth per process - nethogs


 
 

Limit bandwidth in Linux


wondershaper - An easy tool to limit bandwidth of a particular interface.

apt-get install wondershaper

$ sudo wondershaper {interface} {down} {up}

the {down} and {up} are bandwidth in kpbs

So for example if you want to limit the bandwidth of interface eth1 to 256kbps downlink and 128kbps uplink,

$ sudo wondershaper eth1 256 128

To clear the limit,

$ sudo wondershaper clear eth1 

Enable/disable windows firewall

Win XP
(desativar FW) netsh firewall set opmode disable
(habilitar FW) netsh firewall set opmode enable

Win 7
(desativar FW) netsh advfirewall set allprofiles state off
(habilitar FW) netsh advfirewall set allprofiles state on

(parar serviço FW) net stop MpsSvc
(iniciar serviço FW) net start MpsSvc

* Para executar remoto, utilize PSEXEC.EXE ou envie um .BAT com os comandos para o usuário.

Windows Firewall Inbound Dynamic RPC

To create a rule that allows inbound network traffic to the RPC Endpoint Mapper service

  1. On MBRSVR1, in Group Policy Management Editor for your server GPO, in the navigation pane, right-click Inbound Rules, and then click New rule.
  2. On the Rule Type page, click Custom, and then click Next.
  3. In the This program path text box, type %systemroot%\system32\svchost.exe.
  4. Next to Services, click Customize.
  5. Click Apply to this service, select Remote Procedure Call (RPC) with a short name of RpcSs, click OK, and then click Next.
  6. On the warning about conflicting with Windows service-hardening rules, click Yes.
  7. On the Protocol and Ports page, for Protocol type, select TCP.
  8. For Local Port, select RPC Endpoint Mapper, and then click Next.
  9. On the Scope page, click Next.
  10. On the Action page, click Next.
  11. On the Profile page, clear the Private and Public check boxes, and then click Next.
  12. On the Name page, type Allow RPC Endpoint Mapper, and then click Finish.

Or:  netsh advfirewall firewall add rule name="Allow RPC" protocol=tcp service=rpcss dir=in action=allow profile=domain


 Source: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732839(v=ws.10)
 

Corrigir erro NATS no Segura

  ### erro Nats orbit nats stop orbit nats setup orbit services reload orbit services restart all ls -lh /var/orbini/system/incdt/ 

Mais vistos