NZ Tik

The following was tested on Ubuntu 11.10. This is completely insecure, make sure it is confined to a LAN environment, i.e. not publicly accessibly.  apt-get install tftpd-hpa mkdir /tftp chmod 777 /tftp nano /etc/default/tftpd-hpa # /etc/default/tftpd-hpa TFTP_USERNAME="tftp" TFTP_DIRECTORY="/tftp" TFTP_ADDRESS="0.0.0.0:69" TFTP_OPTIONS="--secure --create -v" service tftpd-hpa restart  --create is needed to allow client to create new file. Otherwise you will get error stating 'File does not exist' or similar. --secure is so that the client does not need to specify an absolute path such as /tftp/file. The root of the tftp server becomes TFTP_DIRECTORY. -v is for verbose logging in /var/syslog culv-lns1#copy run tftp Address or name of remote host []? 10.2.2.40 Destination filename [culv-lns1-confg]? !! 1446 bytes copied in 0.168 secs (8607 bytes/sec) _________________________________________________ ...

Cisco PBR ( Policy Based Routing ) uses route-maps applied to the ingress interface. Suppose you have 2 ISPs,   s0/0 and s0/1. You want traffic from the LAN interface (fa4) to be routed out each gateway depending on traffic type. Here is how you would achieve that. ip access-list extended s0_traffic  permit tcp any any eq www ftp 22  end ! ip access-list extended s1_traffic  permit ip any any  end ! route-map fa4_in permit 10  match ip address s0_traffic  set ip next-hop s0/0  ! route-map fa4_in permit 20  match ip address s1_traffic  set ip next-hop s0/1 ! int fa4 ip policy route-map fa4_in Traffic that doesn't match a route map statement will use the global routing table so you could also just configure the s0/0 ACL and route map, and set up a default route for s0/1.

Cisco reflexive acls is a poor mans stateful firewall. If you don't have the luxury of the Advanced Security feature-set, then configuring these are your best bet. Take the above simple example. A name server behind your router is doing a recursive lookup to another name server. By looking at that, you need to allow UDP port 53 in interface e0, as well as the return traffic on port 2033. Unfortunately that port is dynamic, so you could either allow any udp traffic in e0, or use reflexive ACLs. ip access-list extended inbound permit icmp any any evaluate mytraffic ip access-list extended outbound permit udp any any reflect mytraffic interface e0 ip access-group inbound in ip access-group outbound out -------- verification... show access-list mytraffic  permit udp host 111.111.111.111 eq 53 host 192.168.1.100 eq 2033(1 match) (time left 299)