Tuinslak

OpenVPN packet drops

Tuinslak — Mon, 08 Mar 2010 16:22:35 +0000

I recently started to notice following error messages on my openVPN server.

ovpn-server[6306]: vpn.rootspirit.com/85.234.x.y:62068 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)

This basically means that the TUN or TAP interface is making more packets than the real (TCP) interface can handle.

As I need to run OpenVPN using the TCP protocol (instead of the faster UDP protocol; as UDP is often blocked in networks I use my VPN in) I experimented by increasing the tcp-queue-limit. The default is 64, and I’ve set it to 256. So far, everything still seems to be working fine (but more packets will be queued before being dropped by OpenVPN, requiring less retransmissions).

Add this to the OpenVPN server config:

tcp-queue-limit 256

And restart the daemon.

Barcamp WiFi: the statistics – #BCA2010

Tuinslak — Sat, 06 Mar 2010 18:57:49 +0000

A total of 87 IPs have been handed out (so 87 different MAC addresses)
A total of 70 users used the (transparent) Squid proxy, so a few never logged in
There was a total of 1.3Gb of HTTP traffic (Saturday only)
There was a total of 720.91Mb upload and 2.11Gb download traffic (including Friday evening)
Total server uptime was 1 day, 1 hour and 31 minutes

Barcamp Antwerp – #BCA2010

Tuinslak — Fri, 05 Mar 2010 15:00:38 +0000

For those visiting BarCamp Antwerp tomorrow, make sure to connect to the open Userplus.org “barcamp” WiFi SSID.

Any feedback or comments about it can be mailed (yeri @ rootspirit . com) or left below.

Boston.com earthquake pictures

Tuinslak — Sat, 27 Feb 2010 19:20:23 +0000

Yet again, a bunch of “nice” pictures from Boston.com. This time about the Chile Earthquake.

*click*

Linux gateway/router + unable to access certain (HTTPS) sites

Tuinslak — Sat, 27 Feb 2010 12:56:47 +0000

I’ve had an issue for a while, being unable to access certain websites such as https://fon.com, but also certain parts of the Apple, Fortis and Microsoft site, while other (https) websites worked fine.

Running Wireshark I found that only about 5ish packets got transferred, and all other data to that website abruptly stopped.

I’m using ADSL (EDPnet), which has an MTU of 1492, however, I was able to access all websites from the router (using lynx, for example), but not from any other PC within the network.

# ifconfig ppp0
ppp0 Link encap:Point-to-Point Protocol
inet addr:85.234.196.57 P-t-P:85.234.196.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:38804442 errors:0 dropped:0 overruns:0 frame:0
TX packets:28930886 errors:0 dropped:5020 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:45941523311 (42.7 GiB) TX bytes:2887926670 (2.6 GiB)

As it had worked before without any issues, I was more thinking about a kernel problem (or a module of it), however, stripping down unnecessary modules and updating my kernel a few times didn’t resolve the issue. I even booted an old kernel I had still lying around from when I could access the websites. However, all these attempts were in vain.

Thinking it might have been a firewall issue, I flushed all my iptables rules, and started over from scratch. However, this too didn’t solve my issue.

When I VPN’ed or used my Macbook Pro directly as PPPoE device (by-passing the Gentoo router) I was able to access all the websites as well.

After being close to giving up, I found the following iptables rule:

iptables -A FORWARD -p tcp –tcp-flags SYN,RST SYN -j TCPMSS –clamp-mss-to-pmtu -t mangle

And try again.

This did solve my issue.

This is because the default 100mbit MTU is 1500, instead of 1492 for PPPoE.

http://www.edpnet.be/

Bob Ban – All Along the Jailbreak Train

Tuinslak — Tue, 23 Feb 2010 17:16:45 +0000

Source.

Click below.

MP3.

StarCraft 2: Beta

Tuinslak — Tue, 23 Feb 2010 10:47:36 +0000

Windows client only, 1,64Gb download.

Pirate vs paying customer

Tuinslak — Mon, 22 Feb 2010 23:57:27 +0000

Source & Twitter.

Brussels-Midi + iRail

Tuinslak — Sun, 21 Feb 2010 15:49:17 +0000

Apparently the NMBS/SNCB website now makes a difference between “Brussels-Midi” and “Brussels-Midi Eurostar”; same station, different track.

Due to this change, iRail was no longer able to provide any scheduling information which included Brussels-Midi.

I’ve made a quick and dirty work around (by including “+ Eurostar” in the drop down menu), solving this bug.

However, please, NMBS/SNCB, please please please provide an API or report such changes to web developers.

As it is now, if you manually fill in Brussels-Midi and do not add the Eurostar text, the iRail website will not be able to to look up the requested information.

Thanks to Stéphane for the bug report.

Public DNS server

Tuinslak — Tue, 16 Feb 2010 16:11:48 +0000

I have been running a public DNS server for private purpose (never liked my ISP’s DNS servers, and the root servers were usually located too far away (at least those with easy to remember IPs).

Anyway, been testing it since this summer, and so far it’s been working great.

the DNS server running on a Debian virtual machine, hosted by Rootspirit, near Amsterdam.

IP address: 85.12.6.171

Hostname: vm1.rootspirit.com

Might not be an easy to remember IP address (unlike 4.2.2.1), but as I use that IP pretty much every day, it’s okay for me.