Knowledge Base (Posts about network)

Rocky 9 kvm networked bridge interface

bgstack15 — Sat, 26 Jul 2025 13:05:00 GMT

Similar to what I did on CentOS 7 all those years ago, I needed to set up a bridge network interface in my current setup on Rocky 9. This design seems to be imperfect, but I guess it will have to do. The problem I have found is that it takes a few minute after boot before it is up, so my nfs server doesn't seem to start. But more on that later.

The main purpose of a bridged network device is so virtual machines will be on the main network, accessible to all systems.

After ensuring the basic network card exists, named enp0s25 on my system, use nmcli to make the new device.

sudo nmcli con add ifname br0 type bridge con-name br0
sudo nmcli con add type bridge-slave ifname enp0s25 master br0
sudo nmcli con modify br0 ipv4.addresses 192.168.1.58/24 ipv4.method manual # this server1 ip address
sudo nmcli con modify br0 ipv4.gateway 192.168.1.254 # default gateway of main network
sudo nmcli con modify br0 ipv4.dns 192.168.1.10,192.168.1.11 # default dns servers

Configure qemu to allow... whatever this allows. I didn't read it.

sudo tee -a /etc/qemu-kvm/bridge.conf <<EOF
allow all
EOF

And then take down enp0s25 and up br0.

sudo nmcli con down ep0s25 ; sudo nmcli con up br0 ;

Of course the usual warnings apply about doing this remotely. Yes, I did it remotely (the second time, when my config was actually valid).

It took within 2 minutes to actually bring the network up! So this affects nfs-server on reboot. Still, I will talk about that further down.

I wrote file bridge.xml. Its path is irrelevant because you will input it to virsh.

<network>
   <name>br0</name>
   <forward mode="bridge"/>
   <bridge name="br0"/>
</network>

And then load this definition to virsh.

sudo virsh net-define ./bridge.xml
sudo virsh net-start br0
sudo virsh net-autostart br0

And then restart libvirtd.

sudo systemctl restart libvirtd

Experiment for nfs-server

Because of the delays (only on my hardware?) for the bridge to come up, nfs-server fails to start. And since I serve /var/lib/libvirt/images to the other virtual machine hosts from this server, that is a huge problem! I currently have an experiment in place, and will need to determine over time if this has solved my problem.

I edited nfs-server:

sudo systemctl edit nfs-server.service
[Unit]
After=sys-devices-virtual-net-br0.device
Requires=sys-devices-virtual-net-br0.device
# :wq

Let us see over time if this will help the nfs server come up when the whole system/network is ready.

Auxiliary and raw notes

Reference 1's guide didn't seem to work so well for me. I had to delete all that effort, restore my network card definition entirely, and then try with Reference 2.

The commands that did not work for me:

sudo nmcli con show
sudo nmcli con delete enp0s25
sudo nmcli con add type bridge autoconnect yes con-name br0 ifname virbr0
sudo nmcli con modify br0 ipv4.addresses 192.168.1.58/24 ipv4.method manual
sudo nmcli con modify br0 ipv4.gateway 192.168.1.254
sudo nmcli con modify br0 ipv4.dns 192.168.1.10,192.168.1.11
sudo nmcli con add type bridge-slave autoconnect yes con-name enp0s25 master br0

I don't feel like learning what I did wrong with that. Reference 2 worked, and I have other problems than comprehending the network card stupidity of RHEL.

References

Weblinks

Internal files

server1a-log.md

Blocking outbound dns

bgstack15 — Sat, 25 Feb 2023 14:26:06 GMT

The overall goal is to have all dns requests possible go to my recursive servers.

List of my dns servers

$ dig -t NS ipa.internal.com
;; ANSWER SECTION:
ipa.internal.com.   604800  IN  NS  dns2.ipa.internal.com.
ipa.internal.com.   604800  IN  NS  dns1.ipa.internal.com.
;; ADDITIONAL SECTION:
dns1.ipa.internal.com.  604800  IN  A   192.168.1.50
dns2.ipa.internal.com.  604800  IN  A   192.168.1.51

Dns3 host is a freeipa domain replica but does not have dns+dhcp on it as of 2023-02.

Experiment 1

Just redirect all outbound dns requests to my dns servers. This is done by setting a command on router1.

DNS="192.168.1.50"
iptables -t nat -I PREROUTING -i br0 -p udp --dport 53 -j DNAT --to "${DNS}:53"
iptables -t nat -I PREROUTING -i br0 -p udp -s "${DNS}" --dport 53 -j ACCEPT
test -f /jffs/doh-ipv4 && sh /jffs/doh-ipv4
test -f /jffs/doh-ipv6 && sh /jffs/doh-ipv6

Added this to the "firewall command" of the router, web ui -> tab Administration -> tab Commands.

I modified dns1 named.conf to include some logging of queries:

channel queries_log {
  file "/var/named/queries" versions 600 size 20m;
  print-time yes;
  print-category yes;
  print-severity yes;
  severity info;
};
category queries { queries_log; };

Inside the logging{} section. Reference 6

This experiment was successful. On dns1, /var/named/queries shows the queries being submitted.

Experiment 2: see if I can get extra, permanent storage with usb drive

I grabbed a 128MB USB flash drive (yes, MB). I enabled usb support in the web ui: tab Services -> tab USB -> core USB Support is enabled, mount this partition to /jffs: 581af4db-8dfc-41af-9e8b-f612bd32508c

I also enabled jffs2 stuff in web ui: tab Administration -> tab Management -> section JFFS2 Support -> Intenal flash storage enabled

Some commands I ran on router1:

fdisk -l
# i already had a partition on msdos label, but it was not formatted yet
mkfs.ext4 /dev/sda1
modprobe ext4
mount /dev/sda1 /jffs

This appears to work persistently after reboots.

Experiment 3: manual DoH block functionality

I set up the blocking script and run it on the dd-wrt router. goal: manually copy up the IPv4 (and IPv6?) servers to be blocked, add routing rules to disallow connections to those

echo '#!/bin/sh' > ~/doh-ipv4
for ip in $( <doh-ipv4.txt awk '{print $1}' ) ; do echo "iptables -I FORWARD -p tcp -d ${ip} --dport 443 -j REJECT --reject-with tcp-reset" ; done >> ~/doh-ipv4
# copy it to router1
<~/doh-ipv4 ssh root@router1 'cat > /jffs/doh-ipv4'
ssh root@router1 chmod +x /jffs/doh-ipv4

Experiment 4: ipv6 doh blocking

echo '#!/bin/sh' > ~/doh-ipv6
for ip in $( <doh-ipv6.txt awk '{print $1}' ) ; do echo "ip6tables -I FORWARD -p tcp -d ${ip} --dport 443 -j REJECT --reject-with tcp-reset" ; done >> ~/doh-ipv6
# copy it to router1; scp was acting weird so use a stream
<~/doh-ipv6 ssh root@router1 'cat > /jffs/doh-ipv6'
ssh root@router1 chmod +x /jffs/doh-ipv6

Improve

I still need to set up a cron job script for doing all this automatically. For now, I have to run these steps manually. I suppose the script would pull the latest contents from the doh list git repo, generate the script, upload it, and optionally run it. I have not pondered how to prevent duplicate entries yet.

Dependencies

Upstream doh list at reference 2

Alternatives

Just allow all dns traffic to outside, which loses control of my network.

References

Weblinks

Internal files

I finally started using autofs for my network mounts!

bgstack15 — Tue, 22 Nov 2022 00:35:55 GMT

In the past, I wrote about my ripped-off myautomount program which was a bash rewrite of a Go tool from TridentOS.

One main use of autofs is to automount network locations. I of course have my own nfs server and several mounts that are useful on all my clients. Here is what I set up for myself:

File /etc/autofs.internal-wireless.

* -fstype=nfs,noatime,rw,nosuid,rsize=262144,wsize=262144,soft server3:/var/server3/shares/&

And file /etc/auto.master.d/internal-wireless.autofs.

/net  /etc/autofs.internal-wireless --timeout=5

I also set the user's xfe bookmarks to include /net/$USERNAME manually. I don't currently use nfs-mounted home directories, but each user has a primary export on the file server. For future reference, an Xfe bookmark is simply in file ~/.config/xfe/xferc:

[bookmarks]
BOOKMARK1=/net/${USERNAME}

Where $USERNAME is of course fully evaluated already, so /mnt/bgstack15.

Use "Remote Printer" driver for cups-shared printer in cups client

bgstack15 — Thu, 17 Nov 2022 14:19:51 GMT

I use a cups print server to share a USB-connected printer. One of my new network clients needed the printer set up, and of course my client runs cups too. An existing cups client uses the printer with a "remote printer" driver that works well, and the closest model number in the built-in list after installing the generic, distro-provided package for this brand printed the page incredibly wrong.

So, I spent time learning how to set up the cups client to use "Remote Printer (grayscale, 2-sided printing)" driver, which presumably then lets the cups server use the correct driver I would have set up at least once on the real print server.

On the cups client, visit the cups web interface, normally http://localhost:631, and navigate to Administration -> add printer.

Select ipp printer type, and add your network printer: Mine was ipp://192.168.1.150:631/printers/printername. Add name, etc. Now, on the cups page where you select make and model or PPD file, select "Raw" -> IPP Everywhere. Then select button "Add Printer."

References

CUPS: Share printer with generic driver - Unix & Linux Stack Exchange

Run program without network access

bgstack15 — Fri, 05 Aug 2022 13:29:45 GMT

If you want to run a program with a special restriction, such as without network access, you can do that with the unshare(1) utility.

unshare -r -n makemkv

I had noticed that makemkv makes some unwanted network traffic, and I was too lazy to insert my network proxy from the past. So a quick Internet search later, and I learned about unshare.

Unshare -n usually needs -r so the application will run. Read the man page for details.

Fedora 33 nslookup works but ping does not

bgstack15 — Fri, 07 May 2021 13:12:26 GMT

On my shiny new upgraded Fedora 33 desktop, I was unable to connect to my ssh server vm3.ipa.example.com. Of course my vm environment uses dhcp and I know I've had some dynamic dns update problems, and I just rebooted my dns servers, so maybe something was amiss. I logged in to the console of the vm (virsh console vm3) and made sure the system had the IP address I expected. Nslookup works, and shows me the same IP address. So why does ssh show "hostname not found"? The answer is: systemd-resolved had taken control of /etc/resolv.conf and made it a symlink to ../run/systemd/resolve/resolv.conf which obviously is not what I want. So, I unlinked the file, made the real resolv.conf, and also threw in a bonus:

sudo unlink /etc/resolv.conf
echo "nameserver 192.168.1.1" | sudo tee /etc/resolv.conf
echo "nameserver 192.168.1.2" | sudo tee /etc/resolv.conf
echo "search ipa.example.com example.com" | sudo tee /etc/resolv.conf
sudo chattr +i /etc/resolv.conf

And then for good measure I disabled and masked systemd-resolved.

sudo systemctl disable --now systemd-resolved.service
sudo systemctl mask systemd-resolved.service

Don't let Systemd ruin your networking!

Some thoughts on connman and wicd

bgstack15 — Fri, 16 Oct 2020 13:14:12 GMT

I discussed these thoughts in the Devuan forum[1] but wanted to publish them on my own site as well. I was a huge fan of wicd, origin site notwithstanding. It met my needs and was easily configurable and understandable. But because it's python2 only (with some experimental python3 work), it was finally dropped from Devuan Ceres. So I had to find an alternative. There's always the unpopular Network Manager. So I checked out connman, which seems to do everything I've asked it to do. It even includes its own gui and trayicon implementation (connman-gtk), but Devuan also provides a separate connman-ui trayicon utility but it duplicates the tray icon feature. So far, to integrate connman into my workflows, I have two major notes.

Disable dns caching

I want /etc/resolv.conf to be the useful file it's always been, and not just point to 127.0.1.1 or some ridiculousness. So run the daemon with -r , by setting file /etc/default/connman.

DAEMON_OPTS="-r"

It's really nice that you can configure this utility in a traditional manner! And it was clearly documented in the man page.

Add xdg autostart etnry

I add file /etc/xdg/autostart/connman-gtk.desktop on all my systems, which is in the xdg autostart directory. And xdg autostart, is, a fd.o specification that describes a common way desktop environments can act in similar ways.

[Desktop Entry]
Type=Application
Exec=connman-gtk
Name=Connman Settings
Categories=GTK;GNOME;Settings;X-GNOME-Settings-Panel;X-Unity-Settings-Panel;HardwareSettings
Keywords=connman;network;settings;wired;wifi;wi-fi;bluetooth;vpn;tethering
X-GNOME-Settings-Panel=connman-gtk
X-Unity-Settings-Panel=connman-gtk
Icon=preferences-system-network

Of course, this file has no bearing on non-xdg-compliant window managers, so I also generally add to my user Fluxbox settings (file ~/.fluxbox/startup ) the following line.

/usr/bin/connman-gtk &

Final thoughts

So far I haven't discovered how connman-gtk stores its settings that appear to be per-user, for the "prefer to load straight to tray icon." Oh dear, now that I think about it, it's probably a gsettings or dconf or similar. Say it ain't so!

References

https://dev1galaxy.org/viewtopic.php?pid=24641#p24641

Setting up a transparent proxy for internal network

bgstack15 — Sun, 04 Oct 2020 12:49:38 GMT

Overview

This document explains how to set up a web proxy on the internal network so that it can act as a configured proxy as well as transparent network proxy, including both http and https traffic. Exceptions for sites (destinations) as well as clients can be configured.

Architecture

A dd-wrt router is the heart of the example network, at 192.168.1.2. Proxy server proxy.ipa.example.com at 192.168.1.82 provides both transparent proxy and configured proxy behavior.

Configuring router for transparent proxy

The router is set up with dd-wrt firmware: DD-WRT v3.0-r43055 big (05/05/20) and contains a firewall start script (nvram get rc_firewall) which forces all World Wide Web traffic (tcp ports 80 and 443) to a transparent proxy.

#!/bin/sh
WEB_SERVER=192.168.1.14
PROXY_IP=192.168.1.82
OBI_IP=192.168.1.27
CHROMECAST_IP=192.168.1.29
iptables -t mangle -I PREROUTING 2 -p tcp -m multiport --dports 80,443 -s $OBI_IP -j ACCEPT
iptables -t mangle -I PREROUTING 3 -p tcp -m multiport --dports 80,443 -s $CHROMECAST_IP -j ACCEPT
iptables -t mangle -I PREROUTING 5 -p tcp -m multiport --dports 80,443 -s $PROXY_IP -j ACCEPT
iptables -t mangle -I PREROUTING 6 -p tcp -m multiport --dports 80,443 ! -s $PROXY_IP -j MARK --or 3
iptables -t mangle -I PREROUTING 7 -p tcp -m multiport --dports 80,443 -j CONNMARK --save-mark
ip route add $WEB_SERVER via $WEB_SERVER dev br0 table 2
ip route add default via $PROXY_IP dev br0 table 2
ip rule add fwmark 3 table 2

The MARK rule performs a logical OR to set just a few binary flags, so it does not merely "set" all the flags. See Weblink 7. The web server steps are there to ensure that incoming web traffic get to the web server. Observe that CHROMECAST_IP is granted ACCEPT in the firewall. The Chromecast device is given a reserved IP address in DHCP which is described later. An attempt was made to perform logging on the router level, and while this provides IP addresses, it was not sufficient for the needs of this project. See weblink 12.

Configuring the proxy server

First, configure the firewall. Set contents of file /etc/firewalld/direct.xml.

<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule ipv="ipv4" table="nat" chain="PREROUTING" priority="0">-i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3130</rule>
<rule ipv="ipv4" table="nat" chain="PREROUTING" priority="0">-i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3129</rule>
</direct>

I was unable to find any other mechanism within firewalld that works for getting the traffic transparently to squid (i.e., that keeps the client IP address). See weblink 7. Also allow a few services and additional ports.

firewall-cmd --permanent --add-service=http --add-service=https --add-service=squid --add-port=3129/tcp
firewall-cmd --permanent --add-port=3130/tcp --add-port=3129/tcp
firewall-cmd --reload

Configuring squid

Configure squid itself. Fill file /etc/squid/squid.conf with contents.

# Research for a log filter includes:
# tail -f /var/log/squid/access.log | grep -iE '200 [0-9]+ GET https?:\/\/[^ ]+'

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 70      # gopher
acl Safe_ports port 210     # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280     # http-mgmt
acl Safe_ports port 488     # gss-http
acl Safe_ports port 591     # filemaker
acl Safe_ports port 777     # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 ssl-bump \
  cert=/etc/pki/tls/certs/proxy.ipa.example.com.pem \
  key=/etc/pki/tls/private/proxy.ipa.example.com-nopw.key \
  cafile=/etc/pki/tls/certs/ca-ipa.example.com.crt \
  generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
https_port 3129 intercept ssl-bump \
  cert=/etc/pki/tls/certs/proxy.ipa.example.com.pem \
  key=/etc/pki/tls/private/proxy.ipa.example.com-nopw.key \
  cafile=/etc/pki/tls/certs/ca-ipa.example.com.crt \
  generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
http_port 3130 intercept ssl-bump \
  cert=/etc/pki/tls/certs/proxy.ipa.example.com.pem \
  key=/etc/pki/tls/private/proxy.ipa.example.com-nopw.key \
  generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER

acl step1 at_step SslBump1
acl SAFE_sites ssl::server_name .telephony.goog .discord.gg
acl DIRECT_sites_name dstdomain .youtube.com
# DIRECT_sites_ip is primarily for youtube; not from nslookup; only from examining squid logs
acl DIRECT_sites_ip dst 172.217.164.74 64.233.177.106 173.194.219.95 64.233.177.99 31.13.65.1 31.13.65.36 74.125.138.95 64.233.185.139 64.233.185.91 172.217.164.78
acl DIRECT_sites any-of DIRECT_sites_name DIRECT_sites_ip
acl DIRECT_site_clients srcdomain tab1.ipa.example.com
acl WORK_clients srcdomain device1.ipa.example.com

always_direct allow DIRECT_sites DIRECT_site_clients
ssl_bump splice DIRECT_sites DIRECT_site_clients
ssl_bump splice SAFE_sites
ssl_bump splice WORK_clients
ssl_bump peek step1
ssl_bump bump all # needed for youtube somehow
coredump_dir /var/spool/squid
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern .       0   20% 4320
strip_query_terms off    #This will allow checking which youtube URLs were visited by user

visible_hostname proxy.ipa.example.com
logformat squid %ts.%03tu %>a %>A %03>Hs %rm %>ru %[un %<a %mt

The order of these entries matters. Additionally, the Chromecast materials may be out of date, but Youtube it still important. An important consideration is to keep the work computer's vpn uninterrupted. Several comments in this file demonstrate which lines are important to that end. The certificate used here is described in a few steps. The cafile used is the root CA cert for the entire FreeIPA infrastructure in the example network. Without this configuration, it is possible that clients who trust the root CA would still not trust the web traffic because squid would have an incomplete cert chain.

Initializing squid

The dynamic ssl certificate database needs to be initialized outside of squid itself. This only needs to be run once.

/usr/lib64/squid/ssl_crtd -c -s /var/lib/ssl_db
chown -R squid /var/lib/ssl_db
restorecon -Rv /var/lib/ssl_db

Without this step, squid could fail to start, or it could fail with an error about crashing too rapidly after so long. See weblink 3.

Getting a valid ssl certificate for squid

See post Getting a valid subCA certificate for squid from FreeIPA

Operations

It is probable that in the future I will want to make changes. A few possible changes are described below.

Disabling transparent proxy at router

If the proxy server is offline, then all outbound www traffic will fail. The best way to disable the transparent proxy setting entirely is to disable the ip rule on the router. Ssh in to the router or visit the web portal. Run command:

ip rule del fwmark 0x3

To re-enable, run the one ip rule command from the rc_firewall startup script.

ip rule add fwmark 3 table 2

Adding a new exclusion for a client on router

To allow a single client unmonitored access to the www, you can add a new rule to the router. This can be achieved by running a single command, or by updating the rc_firewall script.

iptables -t mangle -I PREROUTING 1 -p tcp -m multiport --dports 80,443 -s 192.168.1.300 -j ACCEPT

Where the IP address here is the target client. To remove a specific rule, run

iptables -t mangle -D PREROUTING 1

But ensure that the rule it will remove is not the main one that allows outbound www traffic from the proxy server.

Adding new sites and clients in squid

To exclude the ssl decryption of a site in squid, add it to the SAFE_sites entry in squid.conf and restart squid. You can confirm the syntax is valid without affecting the running daemon by running the following command.

squid -k parse ; echo $?

To exclude a combination of site and client, you can add a site or client to their respesctive lists uner attributes

DIRECT_sites_name
DIRECT_sites_ip
DIRECT_site_clients

Using the proxy by choice

If for some reason you want to manually configure a proxy, you can set the exact following values.

export http_proxy=http://proxy:3128
export https_proxy=http://proxy:3128

It is worth noting that squid has to act differently when being used as a "transparent proxy" so those ports are 3129 (https) and 3130 (http). But port 3128 can be used explicitly for both protocols. Manually choosing to use the proxy can make troubleshooting easier. For example, mobile devices' applications rarely use the host proxy settings, but it can be easier to whitelist requests.

Assign a reserved IP address in dhcp

The internal network uses ISC dhcpd for assigning IP addresses to clients. To add a host to have a specific reservation, you have to edit the dhcpd.conf through the local mechanism dhcpd-control on host dns1.

sudo dhcpd-control --edit

This will open a cached copy of the dhcpd.conf.combined which will get replicated to host dns2 if any changes are made. The changes must be made between headings:

- BEGIN POOLS FOR SYNC
- END POOLS FOR SYNC

Add an entry using the MAC address of the client and the desired reserved IP address.

host Obi200 { hardware ethernet 9c:7e:fe:60:64:f3; fixed-address 192.168.1.27; }

Improvements

Need to discover how to get android to think it has Internet access.

References

Man pages

/usr/share/doc/squid-3.5.20/squid.conf.documented

Weblinks

http://silverskysoft.com/open-stack-xwrpr/2015/09/creating-a-subordinate-certificate-authority-in-freeipa/
https://serverfault.com/questions/624879/ssl-crtd-helpers-are-crashing-too-rapidly-in-squid
https://netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.txt General guide for iptables
https://www.agix.com.au/minimal-transparent-squid-proxy-with-ssl-interception-bumping-on-centos-7/ useful examples about ssl_bump
https://wiki.squid-cache.org/Features/SslPeekAndSplice
https://wiki.dd-wrt.com/wiki/index.php/Squid_Transparent_Proxy "Alternative Solution" to Proxy Server on the LAN Subnet
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1217511#1217511 I opened a thread on dd-wrt forum for help, but it turned out to be squid-side firewall problems.
https://docs.mitmproxy.org/stable/howto-transparent/ minor examples of ip rules
http://www.silverhawk.net/2016/07/centos-7-squid-and-firewall.html Ultimately unused examples for firewalld and squid acls
https://elatov.github.io/2019/01/using-squid-to-proxy-ssl-sites/ Great initial reference for establishing squid ssl_bump
https://nlug.ml1.co.uk/2014/01/the-missing-firewall-logs-of-dd-wrt/4528 A modest attempt to log traffic on the router, without regard to www hosts and requests.

Windows: Map network drives from csv

bgstack15 — Tue, 15 Oct 2019 13:22:09 GMT

Even back in my olden days of using a non-free operating system, I was automating my tasks. The non-persistent sessions at the computer science lab required that I script my tasks. This is what I came up with for mapping network drives. You can set a csv file with the following contents:

driveletter,sharename,username,password,vollabel
SERVER,192.168.1.2
w,vol1\ben,,,W_svol1_ben
x,vol1,,,X_svol1
y,vol2,,,Y_svol2
z,vol5,,,Z_svol5
SERVER,hulk
s,hulk_ben,,,S_hulk_ben
t,smash,,,T_smash
SERVER,dax
u,dax_ben,,,U_dax_ben
v,science,,,V_science

So it's not a real csv file; it's got headers delineated by "SERVER" and a server name. The script will operate on the following lines, until the next "SERVER" line. It will mount the drive letter, from the following CIFS share, using a username and password or prompting if blank, and a pretty name. It will only mount those entries, if the SERVER actually is reachable. So it fails safely if you are on a different network than the requested server at the time. The script is available on my gitlab. And that example csv is also there. I eventually scrapped this script when I deployed an Active Directory domain and I used group policy to define a number of mounts to define.

ansible use jump box

bgstack15 — Wed, 14 Aug 2019 13:05:16 GMT

If you need to connect through an intermediate jump box, or bastion server, here's how you configure the inventory file:

[other-lan]
c7-prod-app-01 
[other-lan:vars]
ansible_ssh_common_args='-o ProxyCommand="ssh -W %h:%p -q ansible_user@jumpbox.otherlan.example.com"'

If the jump box can resolve the target name as is, you don't need to specify the IP address. However, you can also force a specific IP address.

c7-prod-app-01 ansible_host=10.300.15.3

References

Weblinks

Shamelessly ripped from Ansible with a bastion host / jump box? [stackoverflow.com]