2,126 reputation
77
bio website
location
age
visits member for 4 years, 4 months
seen Dec 18 at 18:46

Nov
26
comment Forward port 22 out a particular interface
I tested the above (simple) rules and observed expected port 22 traffic going out of an alternative route. It worked both with and without the SNAT rules.
Nov
26
comment Forward port 22 out a particular interface
I just tested don't have a suitable setup handy to do a full test but I did just test on a machine with two interfaces where one has a fake router on it. I saw the kernel making the right routing decisions for the port 22 traffic. To get that working I only need the routing tables/rules and the mangle table iptables rules. The --save-mark and --restore-mark rules were necessary to make things work.
Nov
26
comment Forward port 22 out a particular interface
Yes xt_connmark.
Nov
26
comment Forward port 22 out a particular interface
I also missed out -m multiport to get --ports 22 working. Without that you need to specify two rules for --dport 22 and --sport 22. Once we have got things working we should be able to use use --dport 22 only.
Nov
26
revised Forward port 22 out a particular interface
corrected --port to use -m multiport
Nov
26
revised Forward port 22 out a particular interface
added 1 character in body
Nov
26
comment Forward port 22 out a particular interface
Hang on. In the commands I posted above I used --set-mark 1. Your routing rules are expecting --set-mark 22. Try changing that. I'll edit the answer.
Nov
26
comment Forward port 22 out a particular interface
Use tcpdump to look at what is really going out on which interfaces. That should give you a clue as to what is going wrong. tcpdump -n -i eth0 port 22
Nov
24
answered Forward port 22 out a particular interface
Nov
24
comment Forward port 22 out a particular interface
I would leave the nat rules for now. They should be correct.
Nov
24
answered Forward port 22 out a particular interface
Nov
24
comment Forward port 22 out a particular interface
Also are you using any connection tracking in your rules or is it just what you have posted above?
Nov
24
comment Forward port 22 out a particular interface
It is not clear to me whether you are wanting to accept incoming ssh connections to your machine or whether you are trying to handle outgoing ssh connections to other machines. The rules for both are different.
Nov
6
comment Leap seconds and date
Take a look at the following on Stackoverflow it may help you to do what you want. stackoverflow.com/questions/19332902/…
Nov
6
comment Leap seconds and date
For reference I found the POSIX definition of seconds since the epoch at pubs.opengroup.org/onlinepubs/009695399/basedefs/… This defines it as "A value that approximates the number of seconds that have elapsed since the Epoch. ... each and every day shall be accounted for by exactly 86400 seconds"
Nov
5
comment Leap seconds and date
I'm still not sure how you know that your clock is set to "real" UTC. For the most part Linux/Unix just side steps the existence of leap seconds and pretends that they never existed. Thus after a leap second the epoch actually references one second later than it did prior to the leap second. See if the description at eecis.udel.edu/~mills/leap.html helps. Specifically section 3 "How NTP and POSIX Reckon with Leap Seconds" which says "Thus, when a leap second is inserted in UTC and subsequently in NTP or POSIX, knowledge of all previous leap seconds is lost."
Nov
5
comment Leap seconds and date
Your date command example does not prove anything about date being leap second aware. It just shows that %s and @ are consistent in their counting of seconds since the epoch. The full date manual page does state in relation to --utc that "Typically, system ignore leap seconds and thus implement an approximation to UTC rather than true UTC"
Oct
2
comment Does using noatime on modern Linux make sense?
Good question and sadly there is no simple answer. I would rather hope that applications that rely on atime would call this out in README, installation or FAQ documents. Historically one of the main users of atime relative to mtime has been file based mail user agents (MUA) to keep track of what has and hasn't been read since deliver. My approach has often been to just disable atime modification and keep an eye out for anything that breaks. Historically I have left /var with relatime tracking turned on but on newer installs I've tended to turn it off.
Sep
2
comment Why IP address for Linux Bridge which is layer 2 virtual device?
I am a little reluctant to trim all but the 2nd sentance. The first sentence answers the first line of your question. Admittedly the way to setup an IP-less interface on Debian/Ubuntu is only mildly related to your question so that could likely be deleted if considered too off-topic.
Sep
2
answered Why IP address for Linux Bridge which is layer 2 virtual device?