Hi,
Let me try to explain what this crafty title actually means :-)
I have two networks, Boss network, with IP 192.168.3.0/24. This network also has internet router with IP 192.168.3.1. Network consists several computers, NAS and various entertainment devices.
Then, I have Guest network with IP 192.168.2.0/24.
Mikrotik router (hAP AC) is between them, with Boss connected to eth1 and Guest connected to eth5 which has some guest mobile devices and three mikrotiks (it's remote location, two mikrotiks are P2P connection and one serves wireless on remote location). Route is set so that Guest network knows how to reach Boss network (where internet router is).
Ok, now what I would like to do:
- Guest should be able to access internet ONLY, but nothing else on Boss network
- Boss should be able to access all mikrotiks on Guest network (Boss can access all devices on Guest network if that makes it easier)
I could define a firewall rule for each Mikrotik on Guest, but I am wondering if there is a better way, something like - allow return packets from Guest for every connection initiated from Boss. I tried allowing "established connections" using following commands:
/ip firewall filter
add action=drop chain=input comment="Drop Invalid connections" connection-state=invalid
add action=accept chain=input comment="Allow Established connections" connection-state=established
But it seems I do not understand what "established" connection means, because this does not work since I have drop rule below which gets matched instead of established rule and blocks all returned traffic:
add action=drop chain=forward comment="Block access from Guest to Boss" dst-address=192.168.3.0/24 src-address=192.168.2.0/24
And it only works when I add per-Mikrotik rule before the Drop rule above (which I would like to avoid):
add action=accept chain=forward comment="Allow Mikrotik1 on Guest to return packets to Boss" dst-address=192.168.3.0/24 src-address=192.168.2.10
Also, what is the proper way to allow internet connection on Guest through Boss? Allow packets to 192.168.3.1? That will probably allow access to main Mikrotik configuration interface as well which I would VERY MUCH like to avoid.
Thanks, Mario
I have two sites, A and B that are about 30 miles apart.
- A: 10.1.0.0/24
- B: 10.10.0.0/24
Both sites have a server:
- A: 10.1.0.25
- B: 10.10.0.25
When I am on a desktop at site A I can ping both servers.
When I am on a desktop at site B I can ping B's server but not A's.
When I am on a desktop at site B can ping every device on the A network except for that one server.
When I run a tracert from B to the server at A I get the following:
Tracing route to 10.1.0.25 over a maximum of 30 hops
1 * * * Request timed out.
2 31 ms 26 ms 28 ms 10.1.0.25
Trace complete.
The routing allows all traffic to flow freely between both networks. What am I missing here?
Question:
Is it possible to DIY a data diode (or unidirectional networking, if you prefer) by utilizing a single fiber between two switches?
I'm thinking.. By disabling UDLD, and force the interfaces to be up/up.. It should be possible, shouldn't it?
The whole story:I'm in the need of sending UDP-traffic from network "A" to "B", but can't allow traffic to flow the other way. And I don't trust access lists, as the management of the switch can be compromised either due to misconfiguration or bugs, so I need a physical barrier. And since fiber-SPFs contains one sender and one receiver..
I have tried some in lab, but I'm über-n00b when it comes to network and Cisco.
What I have done so far is:Patched up two switches: TX->RX
Configured both switches ignore UDLD, and forced the interfaces to be up/up regardless of any errors.
What I see from logs is that switch "A" is sending a few bits, but "B" doesn't receive..
And even if "B" is forced up/up, the indicator-light at the physical interface isn't lit..
Any tips?
The current config isn't available, so I'm not able to post it for a few days.. But if anyone has done this before.. Or got som ideas.. Please shout out..
I was troubleshooting an issue on a switch that had no connections other than the uplink and noticed something odd: I was seeing a steady 10Mb/sec received on the uplink port. At first I brushed it off as broadcasts and multicast, but it bugged me. So I did a packet capture and noticed all of the traffic was from one Palo MAC address to another Palo mac address. I looked at my Palos and the MACs belonged to the HA2 ports. The traffic was going from the active Palo's HA2 port to the passive Palo's HA2 port.
I looked at the switch port where the passive Palo's HA2 is connected and it had no MAC address associated. Apparently, when using ethernet as the transport, once the initial handshake is complete between the active and passive, the passive Palo stops transmitting on HA2. Once that MAC ages out of the switches, then that HA traffic gets flooded every trunk that VLAN is enabled on.
I tried enabling "HA2 keep-alive" in the HA2 setup, but that simply resulted in the HA2 being reported as down (I am investigating this).
The easy fix is to switch to "ip" as the transport. I haven't tested "udp".
The difficult fix is to block your HA2 VLAN on trunk ports leading to switches outside the path from Palo to Palo.
Observed on 9.1.11-h3, but I assume it affects all versions.
I tried opening a ticket, but the tech refused to admit this was an issue and refused to take any action.
Since it gets talked about quite a lot on this sub as of late, can we all be sure to be on the same page?
Loopring is not a decentralised exchange (DEX). But rather Loopring is a DEX protocol. Think of it like a framework, or a system. But not the exchange itself. In the same way a broker is not the exchange you are buying from, Loopring is not the exchange either. Loopring is the protocol, or process, you are interacting with that facilitates the transaction.
The Loopring protocol uses something called a ‘unidirectional order model’ that uses ‘order-matching’ and ‘ring-sharing’ to pool orders from as many exchanges as possible, and then fill these orders by matching them with the order books of all of the exchanges that participate in the Loopring network.
in Loopring’s own words: > Since every order is just an exchange rate between two tokens, a powerful feature of the protocol is the mixing and matching of multiple orders in circular trade. By using up to 16 orders instead of a single trading pair, there is a dramatic increase in liquidity and potential for price improvement.
In layman’s terms, the Loopring protocol enables a multitude of transactions to occur in single batches by bundling them all together in a very intelligent and novel way - which means that each individual transaction is associated with greatly reduced fees.
Now we know what Loopring actually is, let’s move onto the token. The LRC tokens are the ‘bond’ that exchanges must stake in order to participate in the protocol. The locked LRC is partially or completely slashed when a EX (Exchange) violates protocol rules, such as failing to submit a proof for a committed block on time, or having a reversion.
In other words, The EX owners on the Loopring network are required to stake LRC to build their reputation and provide economic security for their users.
This is because this type of staking is to guarantee the EX owner has something to lose if they violate the protocol rules. For an exchange, Staking of LRC tokens simply ensures optimal behaviors, such as speedy processing of requests, and no trade reversions.
The amount of staked LRC thus reflects an EX’s likelihood or disincentive to violating protocol rules. The more LRC locked, the more reliable an EX should be - but this fact matters more for the protocol itself rather than something the end-user should particularly concern themsleves with.
Anyway, these exchanges are third parties, and Loopring is the ‘open-sou
... keep reading on reddit ➡I don't want to step on anybody's toes here, but the amount of non-dad jokes here in this subreddit really annoys me. First of all, dad jokes CAN be NSFW, it clearly says so in the sub rules. Secondly, it doesn't automatically make it a dad joke if it's from a conversation between you and your child. Most importantly, the jokes that your CHILDREN tell YOU are not dad jokes. The point of a dad joke is that it's so cheesy only a dad who's trying to be funny would make such a joke. That's it. They are stupid plays on words, lame puns and so on. There has to be a clever pun or wordplay for it to be considered a dad joke.
Again, to all the fellow dads, I apologise if I'm sounding too harsh. But I just needed to get it off my chest.
Hello.
I have a rather strange problem with my FPR2110 (running on ASA appliance mode).
ASA version is 9.14(3)18.
I have set up routing of multicast packets to some interfaces - including bridge group interfaces. When I restore the configuration using ASDM, it works perfectly for both kind of interfaces.
However, when I restart the box, the multicast data is no longer routed to the bridge group interfaces but is to the non-bridged interfaces.
If I restore the config again (without reloading), everything works.
I have checked show running-config before restarting as well as after restoring - and they are identical.
Does anyone have any ideas about what is happening?
Relevant part of the running-config:
hostname XYZ
service-module 0 keepalive-timeout 4
service-module 0 keepalive-counter 6
multicast-routing
names
no mac-address auto
!
interface Ethernet1/1
nameif outside
security-level 0
ip address 10.88.200.1 255.255.255.0
!
interface Ethernet1/2
nameif inside-A
security-level 50
ip address 10.98.200.1 255.255.255.0
!
interface Ethernet1/3
nameif inside-B
security-level 10
ip address 10.48.200.1 255.255.255.0
!
interface Ethernet1/13
bridge-group 1
nameif inside-C
security-level 100
!
interface BVI1
nameif my-bridge-group
security-level 100
ip address 10.100.80.1 255.255.0.0
!
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network mc-traffic-src
host 10.88.200.17
object network mc-traffic-ip
host 225.100.100.1
object service multicast-data
service udp destination eq 4001
access-list outside_access_in extended permit object multicast-data object mc-traffic-src object mc-traffic-ip
nat (outside,inside-A) source static mc-traffic-src mc-traffic-src destination static mc-traffic-ip mc-traffic-ip service multicast-data multicast-data unidirectional no-proxy-arp description Data
nat (outside,inside-B) source static mc-traffic-src mc-traffic-src destination static mc-traffic-ip mc-traffic-ip service multicast-data multicast-data unidirectional no-proxy-arp description Data
nat (outside,inside-C) source static mc-traffic-src mc-traffic-src destination static mc-traffic-ip mc-traffic-ip service multicast-data multicast-data unidirectional no-proxy-arp description Data
access-group outside_access_in I’m pretty new, but my company has gotten into small-scale production (including lighting and video walls), and I’ve always had a nagging question about why the standard for lighting control, which in my experience is usually DMX512, hasn’t evolved much in the almost 40 years it’s been around.
In particular, DMX seems to have the following issues:
-
No error detection/correction - obviously this means things can be triggered due to things like EMI or lack of proper termination (I rarely see people working in production properly terminating their lines)
-
Unidirectional - This creates all types of headaches because lights cannot “talk back” to the console, output heat or runtime information, auto-address themselves, etc. With that being said, of course 5 pin allows for bidirectional communication.
-
Extremely low bandwidth - The bitrate of DMX is 250kbits/sec, with a maximum of two data lanes. With that being said, the low bandwidth does allow for somewhat longer cables due to a larger “eye.” But DMX is unsuitable for sending video information due to this, so lights and video panels (and lasers for that matter) tend to need different lines.
Networking technology, lighting technology (hell, there weren’t even commercially available blue LEDs when DMX came out), and computing technology has come a long way since DMX512 was introduced. Yet we still seem to primarily use it for lighting control despite its limitations.
Is it simply a case of there not being a widely adopted standard or interest group to advocate for a better standard/experience for LDs?
Compare this to PCIe technology, which has gone through basically 6 revisions (with backwards compatibility) in less than 20 years, supports extremely high data rates, automatic addressing of peripherals (although it isn’t hot-pluggable natively), etc.
Can someone explain this to me, a relative newbie?
The nurse asked the rabbit, “what is your blood type?”
“I am probably a type O” said the rabbit.
The doctor says it terminal.
Alot of great jokes get posted here! However just because you have a joke, doesn't mean it's a dad joke.
THIS IS NOT ABOUT NSFW, THIS IS ABOUT LONG JOKES, BLONDE JOKES, SEXUAL JOKES, KNOCK KNOCK JOKES, POLITICAL JOKES, ETC BEING POSTED IN A DAD JOKE SUB
Try telling these sexual jokes that get posted here, to your kid and see how your spouse likes it.. if that goes well, Try telling one of your friends kid about your sex life being like Coca cola, first it was normal, than light and now zero , and see if the parents are OK with you telling their kid the "dad joke"
I'm not even referencing the NSFW, I'm saying Dad jokes are corny, and sometimes painful, not sexual
So check out r/jokes for all types of jokes
r/unclejokes for dirty jokes
r/3amjokes for real weird and alot of OC
r/cleandadjokes If your really sick of seeing not dad jokes in r/dadjokes
Punchline !
Edit: this is not a post about NSFW , This is about jokes, knock knock jokes, blonde jokes, political jokes etc being posted in a dad joke sub
Edit 2: don't touch the thermostat
Do your worst!
How the hell am I suppose to know when it’s raining in Sweden?
We told her she can lean on us for support. Although, we are going to have to change her driver's license, her height is going down by a foot. I don't want to go too far out on a limb here but it better not be a hack job.
Ants don’t even have the concept fathers, let alone a good dad joke. Keep r/ants out of my r/dadjokes.
But no, seriously. I understand rule 7 is great to have intelligent discussion, but sometimes it feels like 1 in 10 posts here is someone getting upset about the jokes on this sub. Let the mods deal with it, they regulate the sub.
They were cooked in Greece.
I'm surprised it hasn't decade.
He lost May
Now that I listen to albums, I hardly ever leave the house.
Said if she ever hosts a gender reveal party, when it comes time to pop the balloon she'll spray everyone with water.
Gender is fluid.
Two muffins are in an oven, one muffin looks at the other and says "is it just me, or is it hot in here?"
Then the other muffin says "AHH, TALKING MUFFIN!!!"
Don't you know a good pun is its own reword?
For context I'm a Refuse Driver (Garbage man) & today I was on food waste. After I'd tipped I was checking the wagon for any defects when I spotted a lone pea balanced on the lifts.
I said "hey look, an escaPEA"
No one near me but it didn't half make me laugh for a good hour or so!
Edit: I can't believe how much this has blown up. Thank you everyone I've had a blast reading through the replies 😂
It really does, I swear!
But let me give it a shot.
And now I’m cannelloni
Because she wanted to see the task manager.
He’s the new temp.
But that’s comparing apples to oranges
And boy are my arms legs.
Amy
Put it on my bill
Heard they've been doing some shady business.
but then I remembered it was ground this morning.
Edit: Thank you guys for the awards, they're much nicer than the cardboard sleeve I've been using and reassures me that my jokes aren't stale
Edit 2: I have already been made aware that Men In Black 3 has told a version of this joke before. If the joke is not new to you, please enjoy any of the single origin puns in the comments
They’re on standbi
Disclaimer: This was originally for GME apes, as most are not well-versed in the world of crypto, so this is a no-nonsense, plain English breakdown for the most part. I’m still learning all the ins and outs too, but I think I can offer a good breakdown of Loopring and the LRC token for those that haven’t quite grasped it all yet. If there is anything inaccurate in this post, please let me know and I will update both posts:
Loopring is not a decentralised exchange (DEX). But rather, Loopring is a DEX protocol. Think of it like a framework, or a system. But not the exchange itself. In the same way a broker is not the exchange you are buying from, Loopring is not the exchange either. Loopring is the protocol, or process, you are interacting with that facilitates the transaction.
The Loopring protocol uses something called a ‘unidirectional order model’ that uses ‘order-matching’ and ‘ring-sharing’ to pool orders from as many exchanges as possible, and then fill these orders by matching them with the order books of all of the exchanges that participate in the Loopring network.
in Loopring’s own words: > Since every order is just an exchange rate between two tokens, a powerful feature of the protocol is the mixing and matching of multiple orders in circular trade. By using up to 16 orders instead of a single trading pair, there is a dramatic increase in liquidity and potential for price improvement.
In layman’s terms, the Loopring protocol enables a multitude of transactions to occur in single batches by bundling them all together in a very intelligent and novel way - which means that each individual transaction is associated with greatly reduced fees.
Now we know what Loopring actually is, let’s move onto the token. The LRC tokens are the ‘bond’ that exchanges must stake in order to participate in the protocol. The locked LRC is partially or completely slashed when a EX (Exchange) violates protocol rules, such as failing to submit a proof for a committed block on time, or having a reversion.
In other words, The EX owners on the Loopring network are required to stake LRC to build their reputation and provide economic security for their users.
This is because this type of staking is to guarantee the EX owner has something to lose if they violate the protocol rules. For an exchange, Staking of LRC tokens simply ensures optimal behaviors, such as speedy processing of requests, and no trade reversions.
The amount of staked LRC thus reflects an
... keep reading on reddit ➡