RE: [leaf-user] ide flash drive question

> syslinux -s c: using syslinux.com (download from the net as > this is the DOS program not syslinux.exe FYI I have never had much luck with syslinux and CF-IDE. It sometimes worked with windows boot disks, though. I recommend the Dos 6.22 from http://www.bootdisk.com/. It will most likely no

RE: [leaf-user] Image CF drive

> Does anyone know of any windows tools that can do a disk > image of a CF card? > > I have multiple identical CF cards I need to propagate a > uClibc install to, bootable portion and all. The only tools I > have found that work with CF cards so far have been for linux. Disk Dump (for Windows)

RE: [leaf-user] multiple static ip address router/firewall

> Andrew Nance wrote: > | It is hard to estimate but somewhere around 750 Kbps to 1.5 > Mbps total > | bandwidth. > > Almost anything fairly modern (ie: Pentium-class PCI based > system) should be able to handle this kind of bandwidth. > Even 486 based systems with EISA cards (should you actu

RE: [leaf-user] Bering-uClibc packages in testing

> as you probably know there some packages in "testing" for > Bering-uClibc: Is ethtool supposed to be in testing? I think a lot of people use this.. Regards, P --- This SF.Net email is sponsored by the 'Do More With Dual!' webinar happenin

RE: [leaf-user] RE: Some questions regarding LEAF on WRAP box

> > Ã.Ãs<86><90>Ã?ÃS®-VO««Ý¢´%puÂ¥&`F... > > Yes, funny, the same thing happened to me some time ago. For unknown > reasons I had a line of garbage in leaf.cfg. It feels like IDE I/O is > shaky with CF's. Maybe one should have a look at hdparams. > Else it might > be possible that I did

RE: [leaf-user] Also need driver for Intel Pro 1000 MT

> Thanks, Erich. > I did try the e1000 driver that came with bering 1.2 CD, but > it did not work. Yes, I will have one of my lab techs do this > to make sure it works... but could be a lab exercise for > students as well. > > Both the intel and realtek are source tar gz's so we will > compile

RE: [leaf-user] Firewall failover

> We are investigating on firewall failover design. I have > searched the net and found that projects like LVS have it > mostly solved for their side but that netfilter lacks it. > > Of course, a simple failover of the firewall is available > using things like VRRP (KeepAlive software) but

RE: [leaf-user] Bering-uClibc Docs and IPSEC: FreeSwan or OpenSwan?

> > Given that Bering* only runs on the 2.4 kernel and to my knowledge > > does not include the backport of the Kernel 2.6 Native > IPSEC code, you > > want the Kernel 2.4 docs (http://shorewall.net/IPSEC.htm) > regardless > > of what color your Swans are. > > > > -Tom > > Thanks Tom. I've

RE: [leaf-user] Best 4-port NICs?

> Intel: Intel(r) PRO/1000 MT Quad Port Server Adapter $337 > Osicom: FE-2404-TX - 10/100BTX PCI FAST ENET NIC $329 > D-Link: DFE-570TX 4 port 21143 card (avail only on eBay) $80 > I'm thinking the Intel NIC would be best, but after looking > at it on intel.com I'm not sure it'll fit in a PCI slo

RE: [leaf-user] Best 4-port NICs?

> I'd appreciate a recommendation from the list on which 4-port > NICs work best with the Bering uClibc distro? > > Any known problems using them with single-port NICs on the > same machine? The situation is the same as with a normal distro. uClibc uses modules; therefore, you can insert comma

[leaf-user] RE: [leaf-devel] Bering-uClibc: qmail ???

> I am very surprised that I cannot find qmail for Bering-uClibc. > > What am I missing? > > Can somebody, please, make a Bering-uClibc qmail.lrp ??? Try Bering package http://leaf.sourceforge.net/packages/glibc-2.0/qmail.lrp. You will need to use at least http://cvs.sourceforge.net/cgi-bin/view

RE: [leaf-user] Write error on CF

> append console=ttyS0,19200 nodma=hda ide=nodma > append nodma=had ide=nodma Oops, append nodma=had ide=nodma Sorry for the extra mail. --- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Produc

RE: [leaf-user] Write error on CF

> Mar 3 10:26:46 phuoc kernel: hda: read_intr: status=0x59 { DriveReady > SeekComplete DataRequest Error } > Mar 3 10:26:46 phuoc kernel: hda: read_intr: error=0x40 { > UncorrectableError }, LBAsect=13453, sector=13536 > Mar 3 10:26:46 phuoc kernel: end_request: I/O error, dev 03:01 (hda), > sec

RE: [leaf-user] Cheap NICs or Expensive NICs?

> BTW, a single PC has IIRC <=400Kbps of throughput due to poor > memory mgmt between all the layers. This is without > customized reprogramming of the stack. > One link is > http://www.ifip.or.at/con2000/icct2000/icct452.pdf > that estimates 360Kbps on Linux. > > So cheap NICs might still be a

RE: [leaf-user] Cheap NICs or Expensive NICs?

> Quick question. > What is this impact of cheap NICs (8139too, smc900, etc) > instead of expensive NICs (3c905)? For instance, when > building a NAT/firewall device to share xDSL or cable. Cheaper NICs have a performance penalty, usually in interrupts. Interrupts limit the capability of your n

RE: [leaf-user] Compact Flash Boot Failure

Hi Brock, > Has anyone had a problem like this? I'd like to know if the > box could > be the problem before I take the time to replace this CF yet > again. The > unit is in a remote location and is fairly mission-critical. I can't > have this happen so regularly. This has happened to me.

RE: [leaf-user] VPN Tunnel up but *no* traffic across connection?

> left=68.208.33.25 > leftsubnet=10.154.16.0/22 > rightsubnet=10.154.16.0/255.255.252.0 (If I'm reading this correctly..) In left's view, 10.154.16.0/.252 is owned by left. Ipsec routes get a lower route priority than local interface routes. Therefore, traffic won't bother to traver

RE: [leaf-user] What is latest Freeswan for Bering 1.2?

> Dear List, > I am wondering if there is any newer version such as Freeswan > 2.06 in a > .lrp that is available. I am running Bering 1.2 (kernel 2.4.20). The > current version of freeswan is 1.99.6.2. FreeSWAN is now OpenSWAN. There are no updates for Bering. For Bering-uclibc though, you c

RE: [leaf-user] LEAF: HA and Load balancing

Hi Vic & KP, As always please let us know if you have any suggestions for the documentation. If an area is unclear that would be something that would be nice to fix. I haven't used Keepalived with LVS configuration ("health checker"), so maybe this is an area where you can help once you implemen

RE: [leaf-user] LRP router failing? - the Last Chapter (STH)DSL line-quality info

> The replacement for the suspect FlowPoint 2200 DSL router > arrived today > from the ISP (an Efficient Networks 5851). I plugged it into the > network sans the "crutch" switch between the two routers, and > it worked > like a charm. Hypothesis becomes history. Glad its working!! But let's

RE: [leaf-user] LRP router failing? - Alcatel SpeedTouchHome (STH)DSL line-quality info

> The bottom line to all of the above is that I'm more stumped > than ever and > don't know what to do next. I suppose I'll try to replace the > eth0 NIC in > the DachBox2 to try to eliminate the double fault > possibility. I actually > tried to do that earlier today as well, but neither of the

RE: [leaf-user] LRP router failing?

> I can do that on the one in Seattle, and on the remote router when I > get to Boise, Erich. I'll read up on tcpdump (never used it > before) and > give it a go. Thanks for the idea; I'm getting lots of input > on tools > I've never had to think about before, and that is why I came to this

[leaf-user] [offtopic] How to use QOS traffic shaping in Being U 2.2

> #tc class add dev $DEV parent 1:1 classid 1:20 htb rate > $[9*$UPLINK/10]kbit \ > tc class add dev $DEV parent 1:1 classid 1:20 htb rate `expr > 9 \* $UPLINK / 10`kbit \ >burst 6k prio 2 > > possibly the same thing. I did not have any performance degradation Does anyone have a script that

RE: [leaf-user] Bering-uClibc_2.2-beta5 HDD Version Question

> > Question: How can I remove /var/log at tmpfs? > > I don't see an entry for /var/log/ in /etc/fstab. Perhaps > this is configured > by leaf.cfg/syslinux.cfg; try entering "log_size=0M". I > would test it but > all my routers are now in production.. Hmm.. Actually a simpler solution would b

RE: [leaf-user] Bering-uClibc_2.2-beta5 HDD Version Question

> However, I found some log (e.g. cron.log ) is missing. > > # df > Filesystem 1k-blocks Used Available Use% Mounted on > /dev/root 8192 4284 3908 52% / > tmpfs23392 0 23392 0% /tmp > tmpfs 528000 94

RE: [leaf-user] syst_size not working in leaf.cfg

> I'm using the Bering-uClibc_2.2-rc1 > _img_bering-uclibc-1680.exe?download> > floppy image. When I attempt to change the > root file system size ( syst_size=12M ) in leaf.cfg I get an > error ( for > mount option 'size' ) > and

RE: [leaf-user] Connecting to Exchange Server using VPN through Bering 2.0

> Our network at work has MS Remote Access Server (RAS) > running and I connect > to the network using MS VPN connection from my WinXP box at > Home. I am > going through a Bering uClibC 2.0 LRP box and this works no problem. > However, I can only make a single connection to the VPN. A co

RE: [leaf-user] Harddisk: Device... deceased :P

> Hmmm... Maybe I should just go with CF/DOM or something else, > solid state, > and set up a server to move the logs to $whenever, accepting > the fact that > chips get worn out aftesr so-and-so-many rewrites... Yes, this is what I would (have) done. CF is badass, it boots so fast. > I find i

RE: [leaf-user] Bering-uClibc_2.2-beta5 HDD Version Question

> 1. How to enable NumLock at startup Check your BIOS. AFAICT the LEAF distros won't have any tools like setleds to do this. Maybe you can ask nicely and KP or Eric will make you a package. It seems to be < 10k. Heck maybe busybox can do it.. > 2. It is possible to put and keep all the log (/

RE: [leaf-user] Bering and shorewall 2.0.x

> To upgrade to shorewall 2.0.x from version 1.4.2 on Bering, > is it possible to > install the new LRP on top of the existing one? Will it keep > my current configurations? Not sure about shorewall, but "local.lrp" backs up anything in /usr/local. You can put copies of your configurations the

RE: [leaf-user] Using both OpenVPN and IPSec

> Can we use both OpenVPN and IPSec on one LEAF (Bearing uClib) > firewall? Yes, assuming you have the space and horsepower. IPSec works on protocols 50 and 51, OpenVPN uses SSL. --- This SF.Net email is sponsored by the new InstallShield X.

[leaf-user] Leaf bering-uclibc 2.2beta2 && CF-IDE update

> For modules pls look here: > http://sourceforge.net/project/showfiles.php?group_id=13751&package_id=6 7534&release_id=220334 Is there modules for the latest beta? I need what I believe is ATP865 - a SIIG PCI IDE card. The Maxtor cards I wanted to use with the Promise chipset turned out to suck

RE: [leaf-user] About BeringUclib 2.1.2

> OK > the readme show > LEAF "Bering-uClibc" Firewall - V2.1.1 > > so I got the wrong version. > > Where can I download the correct version? http://sourceforge.net/project/showfiles.php?group_id=13751&package_id=6 7534 --- This SF.Net email

RE: [leaf-user] CF-IDE help

> The only time I came across something like that was when I pulled > the CF out of the USB adapter before I had selected 'Eject' > in windows. Any possibility of something like that? > Regards, > Dave. Unfortunately no. I have my CF-IDE adapters configured on secondary or primary IDE on both

[leaf-user] CF-IDE help

over properly but they don't actually copy. I've tried this process from both Linux and windows, with two completely different sets of hardware. I didn't run into this problem with my 256mb CF-IDE cards a year ago. Thanks much, Peter Mueller Operations Engineer (408)235-1700 x

RE: [leaf-user] LEAF article

> 1. What sort of throughput, for instance, could LEAF-Bering > theoretically > provide on a Pentium 100 system with edo ram and with 10/100 > nics, cables, > and switch, assuming that all other systems connected have > unlimited speed? With good NICs (eepro100 etc.) and not too many iptables r

RE: [leaf-user] Re: LEAF article

Hello Michelle, > Am 2004-05-03 14:51:10, schrieb Peter Mueller: > > >With good NICs (eepro100 etc.) and not too many iptables > rules you will max > >around 20mbit/sec. A good rule of thumb is 5 cycles per > megabit. This > >limit actually applies to al

RE: [leaf-user] Re: LEAF article

> Applied to "all Linux servers", 20 Mbps is not even a > plausible "rule of > thumb". I routinely see 60 Mbps on big (multi-gigabyte) LAN-to-LAN > transfers (ftp, scp, and samba) between pairs of Linux > servers (equipment > varies, but typically either a 1 GHz P3 or a 1.7 GHz Celeron, usuall

RE: [leaf-user] pptpd VPN Settings

> on a Win2000 machine. If I telnet to my router on port 1723 from work > it connects briefly which seems indicate neither my work network or my > home ISP is blocking port 1723?? Does that sound right? I have been > told that my ISP doesn't block protocol 47 (GRE) but I'm not > absolutely Put

RE: [leaf-user] BGP

> I've got 2 T1s w/ two different ISPs (hence the desire to use BGP) > I already have two dinky cisco routers w/ v.35 interfaces. You'll never get any ISP to peer BGP with you for 2 T1 lines. Sorry. The best option for you if your requirement is NAT-centric is http://lartc.org/howto/lartc.rpdb.m

RE: [leaf-user] BGP

> I am also using bering-uclibc+quagga packeages for ospfd and bgp. > works great Where is the Quagga package? BTW if you want VRRP there is a keepalived package available. I am using one I made a long time ago, but I thought someone else made a newer one with ipvs support, too.. > do bering/b

RE: [leaf-user] TCP DOS Vulnerability - Relevent to LEAF?

> Any way you could expand on this, Peter? (Or anyone else?) Here is the thread on Quagga: http://lists.quagga.net/pipermail/quagga-users/2004-April/001748.html P --- This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a li

RE: [leaf-user] BGP

> Is LEAF capable of BGP route propagation? > > I hear that there are packages that support BGP called: > Zebra > http://www.zebra.org/ > Quagga > http://www.quagga.net/ > and > BIRD > http://bird.network.cz/ > > Is one of these supported by LEAF? > Are any of them recommended by anyone? I am us

RE: [leaf-user] TCP DOS Vulnerability - Relevent to LEAF?

> In the news, there's mention of a TCP vulnerability that may impact > LEAF. Apologies if this is not relevant to us. This vulnerability is 3 years old. Linux was patched even then, so LEAF is ok :). > details: > http://www.us-cert.gov/cas/techalerts/TA04-111A.html I checked with Zebra/Quagga

RE: [leaf-user] Bering 1.2 Throughput Test Results

> I did the test with the converted Bering-Contivity yesterday. > I ran the > VPN as AES then changed to 3DES and ran it again. AES was 6% > slower. Any ideas why this would be the case? AES should be faster. I remember seeing a few posts about this. For example, http://lists.freeswan.org/pip

RE: [leaf-user] Is my NIC the bottleneck?

Hello Peter, Nice name ;-) > Subject: [leaf-user] Is my NIC the bottleneck? > pn] I'm still running E2B on a P166. I have 768K > SDSL, and my leaf box is connected to the DSL modem I know it's already resolved, but I recommend using DSLReports's speed test for this kind of thing. Test a desk

RE: [leaf-user] Bering still active?

> Having installed, configured and put in place a Bering > firewall, I read > more and more about the "Bering derivative" called "Bering uClibc". > > The latest release was in January 2004 (unless I'm missing > something :-). > > Maybe I should have used this version instead? If you are using

RE: [leaf-user] Looking for a VPN Solution

> It has PPTP server built in and boots from a CD-ROM while the > configuration is saved to a floppy. There are some known > problems with some XP clients. Are they using ppp-2.4.2x and poptop-1.1.4x? The XP problems can be solved via iptables clamps (clamp-mss-to-pmtu I believe), or using an i

RE: [leaf-user] Which Distro for This Firewall/Router?

> I was going to model the entire project on VMware, but I found that > VMware limits number of NICs to 3, too few for most of my routers. I I don't think user-mode-linux has that built-in restriction. http://user-mode-linux.sourceforge.net/ -

RE: [leaf-user] which VPN to use ?

> I have been using Bering (regular) very successfully for awhile here, > and I will need to be setting up a VPN to connect our office in Texas > with a newly opening office in Florida. I will have full > control over both > endpoints, and having interoperability between my VPN endpoints, > and

RE: [leaf-user] LEAF HA using keepalived

> Funny you should ask. I have keepalived 1.1.3 built out using the > libc225 and it seems to be working. All I did was compile the binary > and move it into your kpalived.lrp package. I did compile it > with ipvs > enabled, and am getting ready to get back into testing it. There was Sweet!

RE: [leaf-user] Gigibit Nic driver

> Thanks. > Does Bering-uClibc support this NIC? The closest module I > could find was > this: (See link) > > http://leaf.sourceforge.net/devel/jnilo/bering/latest/modules/2.4.20/kernel/ > drivers/net/e1000/e1000.o Yes, that is the one; this driver is from Intel and is supposed to be NAPI by d

RE: [leaf-user] Gigibit Nic driver

> ... Also has > anyone ever heard of a 4-port Gigabit Ethernet card? And just > as importantly, if this card is out there does Bering-uClibc > have a driver for it. Intel sells a quad-gigabit for the excellent i1000 line. http://www.intel.com/design/network/products/lan/controllers/ixf1104.

RE: [leaf-user] route external networks

> ip route add 192.168.0.0/16 dev eth0 scope link > ip route add 172.16..0.0/16 dev eth1 scope link > ip route add default via 192.168.202.2 dev eth0 > > where should i put these commands so they can be executed > automatically? /etc/init.d/networking in the start section might be easiest and mo

RE: [leaf-user] pptp server

> I've seen that exists a pptpd.lrp package (in the Jaques > Nilo's page) por Bering (not uClibc). > I want to know if exists the same package for Bering uClibc > (compiled against uClibc 0.9.20). Yes > I've tried to compile myself poptop-1.1.4 with uClibc 0.9.20 > but I couldn't. (problems w

RE: [leaf-user] LEAF Bering is NOT a ROUTER

> Hi everyone, i want to tell that today a make a exam of > "Network" in the university. And a question was: "Features of > a router". So i one i said was: "Bandwidth Management" And > then the said that this is imposible and that the LEAF Bering > Router is NOT a ROUTER. Uh. You mean like Qo

RE: [leaf-user] ipsec.lrp - does it do plain old DES?

> On Tue, 2003-07-08 at 06:38, Peter Mueller wrote: > > You have the right attitude, single-DES is crap. > > You bet it is. I cracked a 1DES key with a banana smoothie > in a whisker over 30 minutes last week. :) I used 5000 monkeys to crack it in 5 minutes, guess I got lu

RE: [leaf-user] ipsec.lrp - does it do plain old DES?

You have the right attitude, single-DES is crap. However, ipsec.lrp does support single-DES. Superfreeswan includes additional encyrption algorithm patches which Jacques includes. RTM ;-) - http://leaf-project.org/devel/jnilo/bipack2.html 12.8. ipsec.lrp This is the super-freeswan ipsec package

RE: [leaf-user] RealTek nic problem

> In /etc/modules it appears to depend only on mii.o that I loaded. Download the bering .config and try compiling the 8139 driver into the kernel. You could also try downloading Donald Becker's driver's from scyld and patching that into your kernel. (Like Lynn says, don't forget pci-scan!) ---

RE: [leaf-user] drivers added to /lib/modules

Hello Glenn, > Both NIC's while not > the same brand do use the same driver- tulip. Should I add > tulip.o to /lib/modules > twice or is once sufficient. I think once will do. If this > is answered in the docs I suppose I missed it. Secondly, if I'd guess this isn't in the docs as it's pro

RE: [leaf-user] tcpdump for Bear-Uclibc-1.1

Hi, > tcpdump running > with multicasts only coming in the active-filter idle > time out works! > with multicast and pings and ping replies coming in active-filter >never idle timeout occurs. > ping = icmp: echo request > ping reply = icmp: echo reply > > I have tried

[leaf-user] debian question, /etc/network/interfaces

Hi all, How do you force the duplex setting & speed on LRP? It seems /etc/network/interfaces is the key file, but the Debian man page (http://www.fifi.org/cgi-bin/man2html/usr/share/man/man5/interfaces.5.gz#lbA D) and LEAF user guide don't provide the answer. Thanks for your help P --

RE: [leaf-user] Squid

> Someone said me, that using a RAM as cache of a proxy reduces > the life of > the RAM to two years. Is it true? I don't see how this can be true. > When I run squid en a Bering Box, it opens 18 squid and 5 dnsserver > processes. Is it normal? > 23686 root 6352 S(squid) > 9198 root

RE: [leaf-user] Bering Kernel Source?

Hi Nick, > I've downloaded the source for kernel 2.4.20 from kernel.org. great > I'm assuming that using the config file that you pointed me to, > adjusted so that the Math-Emulation flag is on, I should be able > to build the kernel that I need? mod it however you'd like, but be a little caref

RE: [leaf-user] [bug] Dachstein with IPSEC image

> ipchains -I forward 2 -s 192.168.0.0/16 -d 192.168.31.0/24 -j ACCEPT > ipchains -I forward 3 -s 192.168.31.0/24 -d 192.168.0.0/16 -j ACCEPT > > Well, this is just in case it can be useful for anyone else. I have no > idea how to do it, but should this be integrated on the image > configuration ?

RE: [leaf-user] Disabling all logging

> I want disable all logging on my LRP box I have searched the > archives and > found no reference for this. > > I am using the Bering 1.0 stable image. Bering uses syslog. I think you can just edit /etc/syslog.conf, save the /etc/ .lrp image, then /etc/init.d/syslogd restart... P --

RE: [leaf-user] Bering Kernel Source?

Hi Nick, > I'd like to try Bering, but only have a 486SX to try it out on, > so I believe that I'll need to recompile the kernel. I think this is correct, Bering is compiled for 486DX by default.. > The only sources that I can find are for 2.4.18, which was for > Bering 1.0-RC1. Will this work

RE: [leaf-user] Bering+uClibc and keepalived

Hi Charles, > I am currently trying to get keepalived to run correctly but > running into a > small problem. I keep getting the error: > Starting Keepalived v1.0.0 (06/01/2003) > Configuration is using : 22095 > Registering Kernel Netlink Reflector. > VRRP_Instance(VI_1) provide at least one ip

FW: [leaf-user] modules aren't loading at boot

Brad & Mohan, > I think you mean "packages". "Modules" usually refers to > the blah.o kernel modules that go in /lib/modules . Yes, of course. Sorry, it was a very late for me. > http://leaf.sourceforge.net/devel/jnilo/bubooting.html#AEN1155 > > and read about using a lrpkg.cfg file instead

[leaf-user] modules aren't loading at boot

Hi all, What could be the reason why two modules might not load at boot? When I mount the media manually and lrpkg -i the .lrp's everything seems fine. If nobody has any ideas, how do I turn up logging so that I can at least have a starting point of where I'm going wrong? Thanks P # cat /mnt/

[leaf-user] kpalived.lrp now available, [minor] update to bgpd.lrp and zebra.lrp

n the sourceforge or mirror page somewhere? This is not my website and I'm able to provide these files only for a little while, especially if there's too much usage. FYI this is my first LRP so please be gentle in your flames

RE: [leaf-user] shorewall and keepalived

> Peter -- is the problem then to get Shorewall to PASS VRRP > packets (as > opposed to the problem statement in the original post)? I assume they are compatible and it should even be easy to configure shorewall to pass the traffic through. I'll be setting up keepalived to authenticate to the o

RE: [leaf-user] shorewall and keepalived

Hi Charles, > I am just curious if anyone has used the shorewall package as well as > keepalived on the same system. And how did you overcome the > issue of both > shorewall and keepalived wanting to do VRRP for the ip > addresses? Just got > this dropped in my lap and not really sure how t

RE: [leaf-user] distribution for flash + 2.4.20 + iptables (no shorewall)

Hi Tom & list, > If you understand enough to create your own secure firewall > using iptables, > then I'm amazed that you feel the need to post on a mailing > list to learn > how to omit one small package (Shorewall) from a simple > floppy-based Linux > distribution (Bering). Nevertheless, I

[leaf-user] distribution for flash + 2.4.20 + iptables (no shorewall)

Hi gang, What would be the best distribution to use on a flash + 2.4.x system? I like Bering, but I am going to be setting up linux routers with BGP so I don't want to experiment with learning shorewall on these systems. Space is not an issue as I have 256-mb flash cards. Thanks much for your t