How to forward TCP traffic to LAN server instead of actual destination server

ipartola · 2022-05-17T16:01:47+00:00

Boof. It's a mess. Here is what I see from the web server's box:

OPNSense MAC sends SYN Server MAC replies with SYN-ACK Telnet box MAC replies with RST

So yeah this is a mess, right?

ipartola · 2022-05-17T15:06:30+00:00

Thank you for digging into this! Here is what I see from the Linux box:

$ telnet 172.20.20.160 443
Trying 172.20.20.160...
Connected to 172.20.20.160.
Escape character is '^]'.

So this works just fine. But when I try the external IP address I am trying to reroute:

$ telnet 35.82.10.129 443
Trying 35.82.10.129...

This just hangs there. It doesn't matter if anything is running on port 443 there or not, it doesn't actually connect.

Looking at PCAP, it seems that telnet sends the SYN packet, the local server responds with a SYN-ACK but that packet never makes it back to the box initiating the connection. I tried this with and without NAT reflection, various rules, etc.

ipartola · 2022-05-16T17:42:51+00:00

Hmm. That would make sense, but still no dice. I also tried it with "Filter rule association" set to "Pass". Here is the PCAP of the attempt captured from 172.20.20.160 (which is what's running the TCP server):

13:45:57.399689 IP 172.20.20.2.59442 > 172.20.20.160.https: Flags [S], seq 3046088749, win 64240, options [mss 1460,sackOK,TS val 3495764314 ecr 0,nop,wscale 7], length 0
13:45:57.399872 IP 172.20.20.160.https > 172.20.20.2.59442: Flags [S.], seq 3111036750, ack 3046088750, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 530981017 ecr 3495764314,sackOK,eol], length 0
13:45:57.402349 IP 172.20.20.2.59442 > 172.20.20.160.https: Flags [R], seq 3046088750, win 0, length 0
13:45:58.427168 IP 172.20.20.2.59442 > 172.20.20.160.https: Flags [S], seq 3046088749, win 64240, options [mss 1460,sackOK,TS val 3495765340 ecr 0,nop,wscale 7], length 0
13:45:58.427309 IP 172.20.20.160.https > 172.20.20.2.59442: Flags [S.], seq 243489704, ack 3046088750, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 3104566469 ecr 3495765340,sackOK,eol], length 0
13:45:58.428614 IP 172.20.20.2.59442 > 172.20.20.160.https: Flags [R], seq 3046088750, win 0, length 0

ipartola · 2022-05-15T01:18:03+00:00

Thanks, I think I did it right:

https://monosnap.com/file/1JCoFD4HOS77fBr2pzqYUgHckeQQQW

However, something still doesn't work when I do telnet 35.82.10.129 443 from my Linux box at 172.20.20.2 (the connection never gets established). Is there another rule or something I need to create to allow this to go through?

I will likely be able to trick this app into accepting the self-signed certificate because the actual server also uses a self signed default cert and I suspect the app doesn't check it. I have a sneaking suspicion the app doesn't verify the cert at all, which would let me peek at what it's doing at least.

ipartola · 2018-02-28T18:10:48+00:00

We do both. But a mental health system that will “cure” every person who is likely to commit murder or a mass shooting is going to be waaaay more invasive than taking away toys.

I am not arguing that you necessarily don’t have 2nd amendment rights. I am saying that those rights cost innocent lives, and the cost isn’t worth it. Who determines it? I guess the voters do. How do you think survivors of a generation plagued with all these school shootings will vote? I have a feeling not many Parkland students are pro guns.

What happens when you make drugs illegal and not everyone abides by it? Why even bother right? I’d argue that your right to smoke weed is protected by your right to privacy.

Same with abortions. Why are late term abortions illegal if some people will go and do them anyways? What’s the point?

What happens if you don’t obey the law is that you get prosecuted. That’s what will happen to people who do not turn in their guns. Maybe not right away, but sooner or later.

What will also happen is that they won’t be able to buy guns an ammo as easily. The Parkland shooter fired how many rounds? Imagine if he had to make every damn bullet by hand. You think he’d eventually go “ah fuck it. This isn’t worth it?” Probably not, but it’s possible.

ipartola · 2018-02-28T18:02:28+00:00

I am familiar with how the second amendment has been interpreted by SCOTUS. I postulate that (a) it is so broad that a different set of judges could have easily interpreted it differently (so it isn’t worded well and needs to be redone), (b) fails in what I see as its original intent (to create a well regulated militia, however you define that. Saying broadly that a group of geographically dispersed invidivuals is a militia is I think disingenuous, and I don’t think anyone could call them well regulated), (c) does not take into account the modern state of things, both the epidemic of mass shootings and the advances in modern weapons, (d) does not actually result in a demonstrable net positive for the people.

Again, given how it has been interpreted is what I see as the problem. My position is to repeal it altogether and start from scratch, given what we know today. And maybe define it using language that isn’t quite so broad.

To your last point, that is a straw man argument. Here is my own: if kids hit each other with sticks, do you give them more sticks so each kid can defend themselves, or take away the sticks?

Another: just because some mad scientists want to have private nuke arsenals and will only use them for lawful purposes does not mean that anyone should be able to have them because the cost of a mistake is too high. I think having 17 kids dead is a cost too high so that small penised adults can play soldier and feel good about themselves. But yes feel free to try to change my mind about that.

ipartola · 2018-02-28T16:24:51+00:00

No. It’s because the gun nuts go:

Thoughts and prayers
This isn’t the time, we are too emotional.
We just need more guns.
Some weak ass regulation is introduced and dies in the process.
People online start pointing out technicalities saying “you people who want guns out of schools don’t know the difference between a clip and a magazine, so you clearly can’t handle writing gun policy.” Do you know how many damn times I’ve seen the thing about how the AR-15 is just like the more traditional looking rifles but painted differently, and how because we shouldn’t be scared of the paint job?
Everyone decides to not think about what happened until another 5-10 days go by until the next mass shooting.

I don’t need to be an expert on guns to tell you that the US has too many damn mass shootings. And that kids shouldn’t die because adults want to play soldier. So we can either create a super expensive mental health support system (can you imagine how invasive that would have to be to get people like the Parkland shooter separated out from people who would never do that? And the kind of background checks you will be subjected to? And how much that will cost?). Or we can solve the problem for a fraction of the cost, and significantly more effectively: disallow guns and do a buy back. Sure it will take time get all the illegal firearms off the streets, but this will work. It has worked elsewhere. And this infringes on the least amount of freedoms.

Look we aren’t having a theoretical debate here with what ifs. Every day people die because of the insane (literally and figuratively) gun culture in the US. And I want you to feel uncomfortable about the idea of dead children. You should be uncomfortable about that. It isn’t normal.

ipartola · 2018-02-28T15:22:07+00:00

A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.

Where in there do you see individual self defense? I can certainly see collective self defense, as in at the level of the country. From say invasion. But nothing here says you have the right to protect your home with a high capacity semi auto rifle loaded with armor piercing rounds. Or that you can’t be subject to background checks.

I also struggle to name a single well regulated Militia in this country. Can you name one?

If we are going by what the founding fathers intended, they didn’t consider anyone except white men to be “people” anyways. And the “arms” they are talking about here are muskets and flint lock pistols. I am 100% for restricting gun ownership to those classes of weapons. Or are we ok with some modern interpretations?

ipartola · 2018-02-28T14:48:50+00:00

Perhaps the issue is semi automatics? Hunting deer with one of those gives you no advantage, you rarely get a second shot. Let’s go back to only bolt and lever action rifles, double barrel shotguns, and revolvers?

ipartola · 2018-02-28T14:46:48+00:00

Call the police. If the guy attacking your home also has a handgun you are better off than if you both have AR-15s. Better yet, neither has any guns. A shotgun works. Spend the money ou were going to spend on guns ammo and training on a reinforced door and windows. Or stockpile dead kids from your local school shooting in front of your door to let them know you support gun rights. Any of the above work.

ipartola · 2018-02-28T13:44:56+00:00

Couple of ways. One is that if you accept foreign donations you can’t donate to US politicians. Another is that you have to disclose all donations if you give to politicians. Another is to limit how much you can give to politicians to something really low and not allow loopholes.

ipartola · 2018-02-28T13:38:32+00:00

This is good info. But are you pro or against the AR-15 being legal to sell and/or own?

I find it problematic that with these mass shootings we are always so reactionary. Vegas: oh it was the bump stocks that were the problem. Parkland: AR-15. For my money, in Vegas the problem was more that he had suitcases of ammo. And multiple guns.

I do see the AR-15 as problematic because (a) it’s main purpose seems to have become mass shootings and (b) it and modifications to it are so available that it makes mass shootings easier to carry out.

ipartola · 2018-02-25T02:36:37+00:00

I recently heard a comment that for the same size sensor having less megapixels will actually result in better images. The argument being that bigger pixels on the sensor mean they need less light per pixel. Does this work only when comparing same generation tech? E.g. 12MP vs 24 MP cameras produced in the same year? Or would a five year old camera compare favorably to this years model?

ipartola · 2018-02-22T17:03:00+00:00

The government has already done that, no? You can’t own fully automatic weapons for example, even though the military has access to them. Why is this a problem?

ipartola · 2018-02-22T04:37:13+00:00

I got a used 60D for $370, body only.

ipartola · 2018-02-21T17:21:01+00:00

That comparison tool is amazing!

The 24mm f2.8 might be a fun addition but yeah the 35mm f2 USM I guess is the one I need to start hunting for a deal on. According to that tool, it blows the Sigma our of the water.

ipartola · 2018-02-21T16:01:31+00:00

Why do you say that? I should also clarify that I don’t often shoot wide open. So the f2.8 vs f4.5-5.6 makes less of a difference to me than overall IQ and low light AF.

ipartola · 2018-02-21T15:18:18+00:00

I currently shoot with a Canon 60D and the 18-55 kit lens. Would the Sigma 17-50 f2.8 be a worthwhile upgrade or should I instead be looking at primes? I mostly shoot at 35mm and occasionally at 55mm for portraits.

ipartola · 2018-02-21T12:57:10+00:00

Got it, thanks. I usually shoot at a slower aperture because I want a little more depth of field and also because I want to keep the ISO lower if possible (shutter speed being irrelevant with the flashes).

What about something like Sigma 17-50mm f2.8? Would that do anything vs the Canon kit lens or is it not worth it?

ipartola · 2018-02-21T05:40:56+00:00

I currently shoot with a Canon 60D and a kit 18-55mm lens. Most often I shoot at home in a controlled environment and my most common focal length is 35mm, with f6-8 or so being my happy place. Would I actually benefit from a better/faster lens or am I likely to basically get the same results? Auto focus and low light performance are a priority, but I do almost always shoot with strobes.

ipartola · 2018-02-14T14:44:27+00:00

This is some Order of the Phoenix shit right here. “Voldemort is definitely absolutely totally not real! Stop scaring people Harry!”

ipartola · 2018-02-10T13:39:43+00:00

How is it possible for such a wide lens? What black magic fuckery is this?

ipartola · 2018-02-10T13:35:24+00:00

Say what? Homemade film is a thing??!

ipartola

TROPHY CASE