On 3 June 2014 06:25, Joschi Brauchle <joschi.brauchle(a)tum.de> wrote:
On 06/02/2014 05:39 PM, Simo Sorce wrote:
> On Mon, 2014-06-02 at 10:34 +0200, Joschi Brauchle wrote:
>
>> These are some of the details:
>> 1) The LDAP server has a local 192.168.x.x IP, which is resolvable
>> globally.
>>
>
> IPs in the 129.168 are not resolvable globally, they are private
> addresses and routing is not allowed outside private networks.
>
What I meant is that the DNS hostname of the LDAP server '
gemini.lnt.ei.tum.de' is globally resolvable to its private
'192.168.109.3' IP address. Unfortunately, this DNS setup cannot be
changed..
And neither can corporate firewalls be easily changed to return failures
instead of dropping packets. (our IPs are non-rfc1918) I know it's well
meant advice from Simo, but reality disagrees with the implementation. Also
if I read Joschi's further part of the mail correctly it might even happen
if the IP stack thinks it's unroutable.
I agree it would be nice and preferable to just adjust the environment to
fit this, but many users might not be at liberty to do so.
I have a script that adds blackholes to the routing table just to work
around this brokenness if it detects a non-corporate network. I'd rather
not roll that to the corporate landscape.
Cheers
Thomas