Possible to sync dynamic list across a cluster?

[carpenox]

Hey this may be a question for Matt or Kumba, but is there a way to sync the dynamic list across an entire cluster without having to login to each dynportal individually?

[williamconley]

Each server checks the dynamic list over time and will open for authorized IPs. It's just not instant, as it relies on the script running at one-minute intervals to grab new IPs when they are added.

This can be altered to force all machines to allow a new IP immediately, but that's custom and not needed in most cases.

[carpenox]

Thx bill, i also wrote an article on how to do it using rsync

https://dialer.one/how-to-use-one-dynam ... e-cluster/

[williamconley]

Thx bill, i also wrote an article on how to do it using rsync

https://cyburdial.net/how-to-use-one-dy ... e-cluster/

syncing to a file in /tmp/? Is that an instant access solution?

DGG used a device file (ie: not really a file, but treated like a file by the OS so you can add an IP directly to the firewall in the OS). In that case rsync would be instant. But does the DynPortal actually directly use a file in/tmp/ that can be synced? I don't remember that.

[carpenox]

yes the dynportal uses files in /tmp

[williamconley]

yes the dynportal uses files in /tmp

Directly? LIVE? As in "a file in /tmp/ is directly in the firewall"?

NOT that /tmp/ is just where the firewall looks to "load" into IPTABLES? But ... already IN the firewall?

Whoa.

DGG uses files created in /proc/net/xt_recent/ which is a network device which belongs to the "recent" iptables module.

That freaks me out a little.