15 February 2012

65. LaTeX for 2013 ARC proposals

If you're in the limbo where you're not quite expert enough with LaTeX, but have happily said goodbye to MS Office, and you're an Australia scientist who annually has to fight the endless bureaucracy of the Australian Research Council (seriously -- 10 page limit about the science, followed by 70 pages about personal qualities?) you may find that you're in for a lot of grief.

If you collaborate with other people you will have to settle for a file format everyone can deal with ('everyone' except linux users), which is likely to be Word run in a virtual environment. If you're writing by yourself or together with more computer-savvy colleagues you will get away with using LaTeX for a fair number of the sections, while using gEdit for others.

I'm presuming that you will create a separate .tex file for each section.

The rules (http://www.arc.gov.au/ncgp/dp/dp_instructions.htm) says that you need

  • Black type
  • Single column
  • A4
  • 0.5 cm margin on all sides (top, bottom, right, left)
  • A 'highly legible font', preferably 12 pt Times New Roman


Also, reading between the lines, you shouldn't/needn't include page numbers since this will be generated by the RMS.

\usepackage{nopageno}

with \pagestyle{plain} just after \begin{document} may do the trick.


Black type and single column are defaults in LaTeX, so need no action. Everything below goes into the preamble.

For A4 and 12 point font, set that in the documentclass

\documentclass[12pt,a4paper]{article}\usepackage[latin1]{inputenc}\usepackage{amsmath}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{mhchem}


For 0.5 cm margins on all sides 

\usepackage[margin=0.5cm]{geometry}
Additional for all sections:

\setlength\parindent{0pt} %no indent on first paragraph \usepackage{fullpage} % an alternative if you don't need 0.5 cm margins \author{} %we don't want author\date{} %we don't want date\begin{document}

Part C, section C1 Here you have several sections, such as AIMS AND BACKGROUND, RESEARCH PROJECT etc. To make sure that these DO NOT get numbered, use
\seccounter{secnumbdepth}{0}

Since the references are a separate document, set
\documentclass[10pt,a4paper]{article}
Part D is filled out online.

Part E, while a pain to write, uses regular 12 pt Times New Roman. If you don't want section numbering, use {secnumbdepth}{0}. If you want your sections to look like this
E1. Justification....
E2. Details of non-ARC contributions

Use
\seccounter{secnumbdepth}{1}\def\thesection{E\arabic{section}.}
As usual, this goes into the preamble, not the body. You should -- ideally -- never have to change the way you write. All changes should go into the documentclass style file or preamble.


Part F. Oh how we curse you.

F13.1 should be easy enough -- you can even skip sections and just use \title{F13.1. Justification} together with a \maketitle right after \begin{document}. Or you can use
\def\thesection{F13.\arabic{section.}


F14.2 offers potential for fun:
\setcounter{secnumdepth}{4}
\def\thesection{F14.2.\arabic{section}.}
\def\thesubsection{\alph{subsection})}
\title{F14.2 Recent significant publications (since 2007)}


This way if you put the following in the body:
\maketitle
\section{Research publications}
\subsection{Scholarly books}
\subsection{Scholarly book chapters}

you get
F14.2 Recent significant publications (since 2007) F14.2.1. Research publications a) Scholarly books b) Scholarly book chapters

For your reference list you may use 
25.* Blow, Joe; Doe, John; \textbf{Hill, Vera}. \emph{One page derivation of the GUT}, Phys. Rev., \textbf{2012}, \emph{108(3)}, 234-235 \\
For F14.3 use
\def\thesection{F\arabic{section}.} \def\thesubsection{14.\arabic{subsection}}
without \maketitle but with 
\subsection{Ten career-best publications}
in the body
G1 is difficult in latex if you want to do it properly. I gave up and used libreoffice for this one since I couldn't figure out how 
Put this in the preamble
\usepackage{rotating} %rotate text in narrow tables...\usepackage{array} % for vertical centering in tables...hacky...
and this in the body:
\section{Research support for Vera Hill}
\begin{table}[h]
 \begin{tabular}{b{4cm} p{0.5cm} p{0.5cm} l c  c c c c}
\textbf{ Description} & \begin{sideways}Same Research area \end{sideways}  &  \begin{sideways}Support type \end{sideways}& ARC Project ID & 2010 (k\$) & 2011 (k\$) & 2012 (k\$) & 2013 (k\$) & 2014 (k\$) \\
 \hline
 "Unifying general relativity with quantum mechanics" & N & C  & DP100202921 & 120 & 190 & 180 & 170 & 120 \\
 \hline
 \end{tabular}
\end{table}

It doesn't look quite right. You may also want to try e.g. m{0.5cm} for the rotated header captions The remaining sections should be fairly straightforward, formatting-wise. Ultimately, the ARC application process is one of the most ridiculous one I've had the misfortune to be subjected to.

13 February 2012

64. Two network cards on the same network, splitting traffic

Some thoughts on using two LAN network cards: While it sounds instinctively neat, the main issue here is to decide how it should actually work i.e. where is what traffic going.

One idea is send traffic to one subset (e.g. 192.168.1.1-100) of IP addresses via one card, and another subset (e.g. 192.168.1.101-255) to another.

This isn't a job for a firewall (other than to restrict/allow traffic) but a situation where you use routing.

Some background
To see your routing table, run
sudo route 
(or sudo route -n if you want to resolve names)

Here's the routing table of the gateway in this post where eth0 is connected to the Outside World, and eth1 is connected (and acting as the gateway of) a subnet of 192.168.0.-255:

Kernel IP routing table
Destination     Gateway            Genmask   Flags Metric Ref    Use Iface
default             xxx.xxx.xx7.254    0.0.0.0           UG     0        0        0    eth0
xxx.xxx.xx0.0     *                      255.255.248.0   U     0         0        0    eth0
link-local            *                      255.255.0.0       U     1000   0        0    eth1
192.168.1.0       *                      255.255.255.0   U     0         0        0    eth1

It says:
Route everything by default to the gw at xxx.xxx.xx7.254,
unless the target is in network xxx.xxx.xx0.0-255 or
unless the target is in 169.254.0.0 - 169.254.255.255 (link-local is 169.254.0.0) or
unless the target is in 192.168.1.0-255

Here's the routing table of a box with a single card attached to the LAN:

Kernel IP routing table
Destination     Gateway              Genmask   lags Metric Ref    Use Iface
default          192.168.1.1             0.0.0.0          UG    0      0        0 eth0
192.168.1.0     *                    255.255.255.0      U     0      0       0 eth0

Finally, here's the routing table of a box with two cards connected to different LANs:

Kernel IP routing table
Destination     Gateway             Genmask         Flags Metric Ref    Use Iface
default         192.168.2.1            0.0.0.0         UG     0      0        0 eth3
default         192.168.1.1            0.0.0.0         UG     0      0        0 eth2
192.168.1.0     *                     255.255.255.0   U     0      0        0 eth2
192.168.2.0     *                     255.255.255.0   U     0      0        0 eth3
Default and * both equal 0.0.0.0 using sudo route -n.


SOLUTIONS
1. Two cards on the same network using /etc/network/interfaces -- very simple:
Yup, I talked about route before, but this is a less granular method using /etc/network/interfaces:

auto eth2
iface eth2 inet static
address 192.168.1.105
netmask 255.255.255.0
gateway 192.168.1.1
auto eth3
iface eth3 inet static
address 192.168.1.130
netmask 255.255.255.128
gateway 192.168.1.1


This configuration gives the following sudo route -n:

Kernel IP routing table
Destination         Gateway         Genmask      Flags Metric    Ref    Use   Iface
0.0.0.0                192.168.1.1           0.0.0.0           UG       0         0        0      eth2
192.168.1.0           0.0.0.0        255.255.255.0     U        0         0        0      eth2
192.168.1.128        0.0.0.0       255.255.255.128     U        0         0        0      eth3

Which is exactly what we wanted.


Solution 1.b using network-manager
In gnome 3/gnome-shell, go to system settings/network/select your interface (e.g. eth1), click on Configure (bottom right corner), and select the IP v4 tab and change the address and netmask as shown in solution 2. Or hit 'Routes...' in the lower left corner and do your configuration there...




Solution 2. Two cards on the same network and another card connected to 'internet'

eth0 is connected to the outside world, eth1 acts as the gateway for 192.168.1.0-127, and eth2 acts as the gateway for 192.168.1.128-255

I configured this in network-manager by setting:
eth0 to dhcp
eth1 to 192.168.1.1, mask 255.255.255.0, gw 192.168.1.1
eth2 to 192.168.1.129, mask 255.255.255.128, gw 192.168.1.129
I didn't edit route settings.

The corresponding /etc/network/interfaces settings would probably be:
auto eth0
iface eth0 inet dhcp
auto eth1
iface eth1 inet static
address 192.168.1.1
netmask 255.255.255.0
gateway 192.168.1.1
auto eth2
iface eth2 inet static
address 192.168.1.129
netmask 255.255.255.128
gateway 192.168.1.129



Anyway, here's the sudo route -n:
Kernel IP routing table
Destination        Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0            130.194.167.254 0.0.0.0          UG    0         0        0 eth0
130.194.160.0   0.0.0.0         255.255.248.0     U     0         0        0 eth0
169.254.0.0       0.0.0.0         255.255.0.0         U     1000   0        0 eth1
192.168.1.0       0.0.0.0         255.255.255.0     U     0         0        0 eth1
192.168.1.128   0.0.0.0         255.255.255.128 U     0         0        0 eth2


Using this configuration you should probably set the gateway for eth3 in solution 1 to 192.168.1.128 -- that way you split all the traffic and in effect create two subnets (so technically, the 'same LAN' isn't really true)

Don't forget to open up your firewall to allow broadcasting from both 192.168.1.127 and 192.168.1.255

09 February 2012

63. Iptables for LAN with one internet connected gateway; sharing internet connection using iptables

Here I show how to share an internet connection with clients on a LAN. It's based in part on the iptables which firestarter generates when setting up connection sharing -- I think one could probably get away with dropping the INBOUND/OUTBOUND sections for the gateway server.

You will probably find that you need to open more ports, depending on your network services. Hopefully it's obvious from the instructions below how to do that. As always, use what you find below as a starting point and expand and correct it as you fool around with it.

While it's easier to use a gui like gufw or firestarter (see previous post), it's easier to get an absolute overview of your firewall configuration if you define each rule using iptables. It's also not that difficult and with a bit of trial and error you can work it out.

The usual caveats apply -- a good 2/3 of my posts are written as I'm teaching myself, while the remainder describe easy, useful, but not always obvious, things and programmes which makes life easier. This lands in the former category.

--- START HERE ---

My network:
One computer has two cards. eth0 is connected to the outside world, eth1 is connected to a switch making up a LAN. Each client is connected to the switch and has static IP (set in /etc/network/interfaces)

The clients are the easiest, so we'll start with them

Client:
create /etc/firewall-rules.sh (e.g. sudo vim /etc/firewall-rules.sh) and put the following in it:

sudo iptables -F #FLUSH

#INPUT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT #network access
sudo iptables -A INPUT -i lo -j ACCEPT                        #127.0.0.1
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT -s 192.168.1.0/24 #ssh
sudo iptables -A INPUT -p tcp --dport www -j ACCEPT -s 192.168.1.0/24 #web server
sudo iptables -A INPUT -p tcp --dport nfs -j ACCEPT -s 192.168.1.0/24 #needed for nfs
sudo iptables -A INPUT -p udp --dport nfs -j ACCEPT -s 192.168.1.0/24 #needed for nfs
sudo iptables -A INPUT -p tcp --dport sunrpc -j ACCEPT -s 192.168.1.0/24 #needed for nfs 
sudo iptables -A INPUT -p udp --dport sunrpc -j ACCEPT -s 192.168.1.0/24 #needed for nfs 
sudo iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT -s 192.168.1.0/24 #ping
sudo iptables -A INPUT -p udp --dport 60003 -j ACCEPT -s 192.168.1.0/24 #sinfo/d
sudo iptables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix " Dropped by firewall "
sudo iptables -A INPUT -j DROP                          #drop all else

#OUTPUT
sudo iptables -A OUTPUT -o lo -j ACCEPT #127.0.0.1
sudo iptables -A OUTPUT -j ACCEPT          #all outgoing ok

#FORWARD
sudo iptables -A FORWARD -p icmp --icmp-type 8 -j ACCEPT

#Default behaviour
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP 
sudo iptables -P FORWARD DROP
Next, change ownership and permission

sudo chown root firewall-rules.sh
sudo chmod 700 firewall-rules.sh

Finally, edit /etc/network/interfaces and put
post-up sh /etc/firewall-rules.sh
as the last line. If you use post-up routing rules as well you can put those before or after.

Done!


The Gateway:
We need to allow the local network access to the services of the gateway, such as apt-cache. We also need to pass through traffic to the outside world.

Here's the gateway's /etc/firewall-rules.sh:

sudo iptables -F #FLUSH
# T1 -> eth0 --> inet, eth1 --> LAN (192.168.0/24)

#table nat
sudo iptables -t nat -P PREROUTING ACCEPT
sudo iptables -t nat -P INPUT ACCEPT
sudo iptables -t nat -P OUTPUT ACCEPT
sudo iptables -t nat -P POSTROUTING ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

#table mangle
sudo iptables -t mangle -P PREROUTING ACCEPT
sudo iptables -t mangle -P INPUT ACCEPT
sudo iptables -t mangle -P FORWARD ACCEPT
sudo iptables -t mangle -P OUTPUT ACCEPT
sudo iptables -t mangle -P POSTROUTING ACCEPT 

#main table
sudo iptables -N OUTBOUND
sudo iptables -N INBOUND

#INPUT
sudo iptables -A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT #allows network access
sudo iptables -A INPUT -i lo -j ACCEPT                                                #127.0.0.1
sudo iptables -A INPUT -i eth1 -p tcp --dport ssh -j ACCEPT -s 192.168.1.0/24 #ssh
sudo iptables -A INPUT -i eth1 -p tcp --dport www -j ACCEPT -s 192.168.1.0/24 #web server
sudo iptables -A INPUT -i eth1 -p tcp --dport nfs -j ACCEPT -s 192.168.1.0/24 #needed for nfs
sudo iptables -A INPUT -i eth1 -p udp --dport nfs -j ACCEPT -s 192.168.1.0/24 #needed for nfs
sudo iptables -A INPUT -i eth1 -p tcp --dport sunrpc -j ACCEPT -s 192.168.1.0/24  #needed for nfs 
sudo iptables -A INPUT -i eth1 -p udp --dport sunrpc -j ACCEPT -s 192.168.1.0/24 #needed for nfs 
sudo iptables -A INPUT -i eth1 -p icmp --icmp-type 8 -j ACCEPT -s 192.168.1.0/24  #ping
sudo iptables -A INPUT -i eth1 -p udp --dport 60003 -j ACCEPT -s 192.168.1.0/24 #sinfo/d
sudo iptables -A INPUT -i eth1 -p tcp --dport 3142 -j ACCEPT -s 192.168.1.0/24             #apt-cache
sudo iptables -A INPUT -i eth1 -d 192.168.1.1 -j INBOUND                                                   #needed for gw -> clients
sudo iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j REJECT 
sudo iptables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix " Dropped by firewall "
sudo iptables -A INPUT -j DROP                                                       #drop all else


#OUTPUT
sudo iptables -A OUTPUT -o lo -j ACCEPT #localhost 127.0.0.1
sudo iptables -A OUTPUT -o eth0 -j ACCEPT #eth0: all outgoing ok
sudo iptables -A OUTPUT -o eth1 -j ACCEPT                               #eth1: all outgoing ok

#FORWARD
sudo iptables -A FORWARD -p icmp -j ACCEPT 
sudo iptables -A FORWARD -p tcp -s 192.168.1.0/24 -j ACCEPT     #forward everything from local LAN
sudo iptables -A FORWARD -p udp -s 192.168.1.0/24 -j ACCEPT    #forward everything from local LAN
sudo iptables -A FORWARD -i eth0 -j OUTBOUND                           #need both for pass-through
sudo iptables -A FORWARD -i eth1 -j OUTBOUND                           #need both for pass-through


#INBOUND
sudo iptables -A INBOUND -j ACCEPT -m state --state RELATED,ESTABLISHED                              
sudo iptables -A INBOUND -s beryllium -j ACCEPT
sudo iptables -A INBOUND -j ACCEPT -s 192.168.1.0/24

#OUTBOUND
sudo iptables -A OUTBOUND -j ACCEPT

#Default behaviour
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP 
sudo iptables -P FORWARD DROP

And that's about it.

To check that it loaded do

sudo iptables -L -n -v

The -n is because of this.

Keep on checking what goes into /var/log/firewall.log to see whether you should open more ports or use a more generous (or strict) firewall policy.



Edit: the following was the old way of doing it. The downside is that
1. it gets loaded very late in the boot sequence
2. it doesn't reload on sudo service networking restart

I've migrated away from network-manager, but it might require the method below. Use if the first method doesn't load the firewall rules.

edit /etc/rc.local and put 
sh /etc/firewall-rules.sh
as the second-to-last line to make the rules be added on each boot.

Remember the sudo iptables -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix " Dropped by firewall " line? It doesn't actually do anything yet.

Edit /etc/rsyslog.conf and put
kern.=debug /var/log/firewall.log
anywhere. Restart the service:

sudo service rsyslog restart

There's now a firewall.log in your  /var/log dir.



There is one caveat:

IMPORTANT: for some reason receiving large files via sftp in filezilla FROM a client to the gateway gives

Error: Incorrect MAC received on packet
Error: File transfer failed after transferring 32,768 bytes in 1 second
or
Error: Server sent disconnect message
Error: type 2 (protocol error):
Error: "Packet corrupt"
Error: File transfer failed

Transferring large files TO a client works fine from the gateway and is blazingly fast. Transferring files between clients also works fast and securely.

i.e. on a client I can easily receive files from the gateway. On the gateway I can easily put a file on a client. The opposite directions don't work, whether I do it on the client or on the gateway. It seems like there should be an obvious iptables fix. My network cards are rtl-8169 gigabit pci cards and/or intel e1000 pro

NFS works fine for filetransfer (see this post) but I'm working on figuring out the incorrect MAC problem.

I've already tried with
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Also, even a firewall consisting of nothing but (apart from flush):

sudo iptables -P INPUT ACCEPTsudo iptables -P OUTPUT ACCEPTsudo iptables -P FORWARD ACCEPT

doesn't solve it

Links to this post:
http://www.debian-srbija.iz.rs/p/kako-da.html