Upset millennial.
Code quality matters.
- 0 Posts
- 12 Comments
31·12 days agoComes to internet for help
Handed a path to a solution
shoots footgun
Draw it!!!
Draw a network map!!! It’s what I’ve done on every security engagement, ever. Mark out all your IP addresses, draw lines to denote the communicating RHP (random high port) against the well-known, e.g. 443/tcp HTTPs, for networks of hosts to servers. Then draw boxes around those IP spaces that are colocated on the same box. Then draw red lines perpendicular to every connection from a client to server that isn’t bounded on a single host.
The red lines denote non-localhost traffic - places to be observed, and for the most part the only IP:port assignments you should be relying on for routing.
My rec, draw the map and if that doesn’t help get back to us w it - or feel free to dm me.
Edit: I’ll find and post an example as a response this thread later.
Bro the E485 was bomb for linux. My job at the time purchased a dozen of them for infosec dev, we had gentoo built and deployable for them in about a day. Shit I still have one in the basement acting as a cluster head 😂
20·18 days agoWiki foundation should file legal strikes against them for violation of other entities 8-K reporting requirements.
Yeah they have to distribute all that compute for a reason.
The federal government has interceded and the new penalty is $1.9 million.
Bye bye KDE.
I gave the example of PPPoE, the other option is to read the linked kernel docs to understand traffic steering and infer where those situations could occur.
Opensense is often bound by single-core operations depending on where a network packet may plumb itself through the kernel. A great example is any PPPoE connections on the base OS BSD. Vyos doesn’t have these same limitations since it’s minted on Linux - which supports traffic steering.
Really though, IaC for vyos has always been rock solid. Even though the persistent config in Opnsense is cool, adding new features or configs can be a bit of a pain in the ass
I have absolutely no idea. I just run this over wireguard and call it a day.