#arpnetworks 2015-08-02,Sun

m0unds

oh, talking about it?

mercutio

mercutio has no idea how to fix most windows problems
yeah

m0unds

m0unds was a windows and unix sysadmin for 10 yrs

mercutio

my windows computer randomly had a black screen today

m0unds

throw it down a flight of stairs

mercutio

it was still working, sound etc.

m0unds

weird

mercutio

turning the monitor on and off didn't fix it

m0unds

display driver crash?

mercutio

probably
i rebooted and it's fine so far.

m0unds

was it coming out of sleep?

mercutio

nope

m0unds

mercutio

it doesn't sleep
maybe it should

m0unds

there's a longstanding AMD driver issue w/sleep and black screens
dunno if they ever fixed it

mercutio

well it is amd
maybe it started sleeping since upgrading.

m0unds

i know, that's why i mentioned it :)

mercutio

but then why'd it wait until today to crash
my linxu computer went through a period of crashing

m0unds

no time like the present

mercutio

i changed the motherboard and it was fine
i changed psu and case too though
but when linux crashes everyone now and then suspect hardware
when windows crashes every now and then suspect drivers :)
it did used to get ethernet brief lockups all the time from new
i never really noticed it except in dmesg
wow
@weather iran

[15:47]

BryceBot

Multiple locations matched your query: Abadan, IR (zmw:00000.1.40831), Abadeh, IR (zmw:00000.1.40818), Abu Musa, IR (zmw:00000.1.40890), Ahar, IR (zmw:00000.1.40704), Ahwaz, IR (zmw:00000.1.40811), Ali-Goodarz, IR (zmw:00000.1.40783), Anzali, IR (zmw:00000.1.40718), Arak, IR (zmw:00000.1.40769), Ardebil, IR (zmw:00000.1.40708), Babulsar, IR (zmw:00000.1.40736), Baft, IR (zmw:00000.1.40853), Bam, IR (zmw:00000.1.40854), Bandar Lengeh, IR (zmw:0000

mercutio

@weather bandar

BryceBot

Bandar, Indonesia: Mostly Cloudy ☁ 67°F (19°C), Humidity: 99%, Wind: From the West at 2 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=, or re-request this with: @weather -v bandar

mercutio

grr

m0unds

hahaha

mercutio

@weather brandar mahshar, ir

BryceBot

Error, No cities match your search query

mercutio

@weather bandar mahshar, ir

BryceBot

Error, No cities match your search query

mercutio

i suck at this
@weather bandar, ir

BryceBot

Error, No cities match your search query

m0unds

@weather bandar, iran

mercutio

anyway

BryceBot

mercutio

heat weave in iran

m0unds

weird

mercutio

@weather abadan, ir

BryceBot

Abadan, Iran: Clear 93°F (34°C), Humidity: 41%, Wind: From the NNW at 9 MPH -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=30.36666679,48.25000000 or re-request this with: @weather -v abadan, ir

mercutio

@weather Bandar Lengeh, IR

BryceBot

Bandar Lengeh, Iran: Haze 93°F (34°C), Humidity: 59%, Wind: Calm -- For more details including the forecast and almanac, see http://www.wunderground.com/cgi-bin/findweather/getForecast?query=26.53199959,54.82484818 or re-request this with: @weather -v Bandar Lengeh, IR

m0unds

oh, i didn't notice the second word in the name

mercutio

what that doesn't seem that hot

m0unds

what time is it there now?

mercutio

i dunno if that's the same city as bandar mahshahr

m0unds

0319

mercutio

but it was in that list of cities up there

m0unds

pretty hot for 3 am
haha

mercutio

oh wow
ok

m0unds

ehh
forecasted daytime temp is 101

mercutio

that's not so bad?

m0unds

it's forecasted to be 110 in phoenix, az tomorrow

http://time.com/3981478/iran-heatwave-bandar-mahsahr/

mercutio

m0unds

maybe because it's on the water or something?
oh, with the heat index
because of humidity

mercutio

In Iraq, air temperatures continued to exceed 120 degrees (49 Celcius) for the eighth day in a row on Sunday, according to the Weather Channel. The heat had become so scorching on Thursday that the Iraqi government mandated a four-day holiday.

m0unds

yeah, that'd be why then

mercutio

m0unds

high humidity + hot as hell
yeah, that blows
m0unds is happy to live in an arid climate

mnathani_

does unbound default to allow all source IPs for dns resolution?
turns out its only listening on localhost

[16:02]

mercutio

nope
it allows ::1 and 127.0.0.1 and some others it hink
search for acl
oh it's not acl :")

[16:04]

mnathani_

interface: 0.0.0.0

mercutio

it's access-control

mnathani_

I put that in there, but its still listening on localhost only

mercutio

access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
oh
did you restart it?

mnathani_

yup

mercutio

could it bind that address?
i'm nost listening on 0.0.0.0
i listen on the real addresses
but 0.0.0.0 should work
oh, unless you have an authorative dns server on the host too

mnathani_

got it to listen on 192.168.64.1

mercutio

cool

mnathani_

but now I need the access control

mercutio

yip
i pasted that up there
so first you refuse
then you accept
ie it's last match not first match

mnathani_

ok, dns is good now

[16:09]

mercutio

sweet

[16:09]

mnathani_

time to try the transparent proxy using squid

mercutio

oh god
i mean cool :)
you got your firewall rules down? :)

mnathani_

you mean iptables nat 80 to 3128 or something like that?

mercutio

also you may want to try trafficserver instead of squid these days
is that ipfw?
oh
iptables word
yeh sending 80 to 3128
i just use explicit proxy except for wireless at home
proto tcp if enp4s0 saddr 192.168.1.0/24 dport http REDIRECT to-ports 8080;
that's what i'm doing with ferm

mnathani_

does trafficserver have a binary or do I need to build from source
running ubuntu

[16:12]

mercutio

it's got old binaries in ubuntu last i knew
what version does it say?
http://packages.ubuntu.com/search?keywords=trafficserver
trusty has 3.2 that's probably fine
i think 5 is what it's up to
i compile from source myself
but i did a couple of patches etc
so yeah its' ok if you're ok behind two major versions behind
September 08, 2014: The old, legacy release of ATS, v3.2.x, is no longer supported. We have removed it from the download site, but it is available via the archives. We urge everyone to migrate to v4.2.x or 5.x as soon as possible.
July 4, 2015: The latest stable release, v5.3.1, is now available from the Downloads section. This is the LTS release for 5.x
yeah i'd go with source
trafficserver has http2 support :)
and a few other cool things
but squid maybe easier to get started with

[16:12]

mnathani_

do you generally need to enable nat / ip forwarding for other non http traffic?

[16:16]

mercutio

the default trafficserver config is more towards reverse proxies than forward
yes
saddr 192.168.0.0/16 outerface ppp0 SNAT to 202.49.67.22;
i do it with that
but then i have normal ip's mixed too, that i don't want to nat
proxies don't give much improvement with few users generally btw

[16:16]

mnathani_

my proxy is already behind nat

mercutio

the majority of "slow" web sites these days are https
ahh

mnathani_

so perhaps I could simply enable routing

mercutio

then you can just let the normal nat work it's magic
ip forwarding yes
net.ipv4.ip_forward=1
erk that doesn't seem to ber it
oh zsh just wasn't completing

mnathani_

the nat gateway would need to know how to get back to my 192.168.64.0/24 segment

mercutio

why?
i don't do full transparent with proxies

mnathani_

its on 10.10.0.0/16

mercutio

so it's just like any other
oh
yeh the nat router should also nat 192.168.64.0/24
and have routes to reach it

mnathani_

right

mercutio

dsl modems can be a pita for that :/

mnathani_

do you transparent proxy https as well?

mercutio

nope

mnathani_

good think I have a mikrotik

mercutio

you can only tcp proxy it
which i want to do again
so who here is using a ssid ending in optout_nomap?
err _optout_nomap

m0unds

not me, don't care enough

[16:30]

................. (idle for 1h23mn)

mnathani_

step 2 complete, Nat is working and my vm on 192.168.64.0/24 has internet access using the ubuntu gateway that has ip forwarding enabled. Now all I need to do is get the transparent proxy working

[17:53]

brycec

FWIW I've had no such issue on my system, whether Windows 7, 8.1, or 10. And it sleeps a lot. 15:44:06 m0unds | there's a longstanding AMD driver issue w/sleep and black screens

[18:06]

mercutio

mnathani_: just go explicit ?
ie set your proxy in your browser
or in http_proxy on command line

[18:06]

mnathani_

my goal is transparent proxy

mercutio

mnathani_

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
that eth0
is that on the interface facing client?

mercutio

is eth0 in?

mnathani_

or towards internet
in that iptables rule

mercutio

that looks fine
have you got squid setup to listen in transparent mode
that's the interface that http connections come in on

[18:08]

mnathani_

in my case its eth1

[18:09]

mercutio

oh :)
well there goes the issue
in my case it's enp4s0
don't you love the naming

[18:09]

mnathani_

I am getting connection refused

mercutio

are you listening on port 3128

mnathani_

for http requests from my client

mercutio

sudo netstat -tnlp | grep 3128

mnathani_

I am not
so that would be a problem

[18:12]

mercutio

well there goes the issue
i think it's http_port in squid
yeh http_port 3128 http11 transparent
although if you just installed squid you may have to run squid -z to create the cache directories

[18:12]

mnathani_

http_port 3128
I have that in my config

[18:13]

mercutio

so squid isn't running then
append transparent
i dunno if you still need http11 or snot
i only see that http11 was added in 2.7, not that it was deprecated, hmm.
it seems transparent is changing to the word intercept though

[18:13]

m0unds

brycec: i'm happy you didn't experience it
because it's horribly annoying

[18:15]

brycec

m0unds: thanks :p

m0unds

i've seen it on more machines than i haven't seen it on, so you're a lucky duck

mnathani_

ok, I get access denied now
so that looks better

mercutio

sweet now ip acl

brycec

Wow. And yet both mine and my lady's windows desktops are just peachy.
So 100% okay in my experience, m0unds

mercutio

brycec: large sample set there

brycec

mercutio

i seem to remember some computer screwing up if it suspended and it wouldn't come back at one point
but memory is sketchy
i just remember thinking it wasn't good to plug in the sleep button

http://forums.anandtech.com/showthread.php?t=2322060

m0unds

mercutio

because it can cause issues when used :)

m0unds

^ that mess

brycec

Heh, then again those posts are from 2 years ago. Plenty of time for change.

[18:18]

mercutio

heh i like it how windows includes ethernet drivers now days

m0unds

right, but i was managing a site with 30 7xxx era firegl and radeon cards and most of them would die if the machine was left unattended and went to sleep overnight or whatever

mercutio

that used to be my biggest gripe

m0unds

to the point that i had to set a policy to prevent sleep so i didn't have to deal with it every morning

brycec

That really sucks

mercutio

m0unds: were you using microsoft or ati drivers?

m0unds

AMD, had to
needed opencl

mercutio

ahh
i used to find that the ati drivers were worse than the microsoft ones
unless you needed to play games

m0unds

and as luck had it, they started replacing those boxes when my contract was ending
the bastard

mercutio

intel hd seems nice and stable.

m0unds

mnathani_

Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.

[18:21]

mercutio

mnathani_: fix your acl :)
acl's are two step in squid
you need like acl localnet src 192.168.0.0/16
http_access allow localnet
and they're first match
so you hvae to allow before you deny

[18:21]

mnathani_

my allows were under another deny way up in the config
its a 7000 line config
probably easier to wipe it clean and start fresh

[18:24]

mercutio

heh
use grep
cat /etc/squid/squid.conf | grep ^http_access

[18:25]

brycec

why not just "grep ^http_access /etc/squid/squid.conf" ?

[18:26]

mercutio

brycec: that'd work too, but i find it easier to think that way around :)

[18:26]

brycec

[18:26]

mercutio

i'm not a big fan of condensing

[18:27]

brycec

brycec is a huge fan of optimising

[18:27]

mercutio

on grep'ing a 7000 line file?
does it save more than a msec?
i don't even use egrep usually :)

[18:28]

brycec

In this case, probably not. But I'm not saying that optimisation is for speed
It just makes it, whatever it is, optimal :) Could be readable, simpler, fewer system calls, etc

[18:29]

mercutio

ahh, i find it more readable, simpler with it spread out

[18:30]

brycec

If you were grepping multiple files, you would almost certainly prefer the "condensed" form as then grep can report *which* file matched.

[18:30]

mercutio

but yeah there may be fewer system calls with your method. but that's not even a certainty

[18:30]

brycec

I find mine to be more readable. But to each their own.

[18:31]

mercutio

yeah different thinking styles and all that
i like to think of the "object i'm doing something with" then what i do with it
rather than what i'm doing with it, then what object i'm doing on it

[18:31]

mnathani_

coredump_dir /var/spool/squid3

mercutio

also if you need to change it to something else it's much easier
like that word doesn't work..

mnathani_

do I need that in my config?

mercutio

mnathani_: that's normal
yes
squid spool directory is given less space to allow some space for coredump
and for file system overheads
did you figure out your acl? :)