text:
Despite what some
doomsayers predicted when the OpenBSD project abandoned
ipf (see the
famous CVS log entry), the new
packet filter is doing its job very well and is steadily growing in
functionality. A lot has changed since its official appearance in OpenBSD
3.0, and it is high time to have another look at what Daniel Hartmeier and
others have been working on.
has undergone numerous changes since I last wrote about it. It is now
easier to use and has a greater range of available filtering options. If
you have never used
before, you'll be delighted to know that it does packet filtering, network
address translation (NAT), load
balancing, protects against spam (coming in OpenBSD 3.3), and
provides--after the merger with
ALTQ--resource-sharing and quality of service control (QoS). In its
current shape,
can be used to secure networks, connect multiple hosts to an external
network through a single network interface, balance load between multiple
servers, manage bandwidth, and keep logs of its activity. Because of
is quickly becoming an advanced tool for network management and security
Related Reading
TCP/IP Network Administration
This article assumes that you are using OpenBSD 3.2 with all of the latest security patches applied. (If you still don't know how to keep your system up to date, here are some hints to get you started.) The examples presented use the DMZ network configuration described earlier in this series. (Additional sources of information on DMZ design can be found in [Zwicky, Cooper, and Chapman 2000] and [Bishop 2003].) I will also answer some recent reader questions. Because there is so much new ground to cover, this article is split into four parts: (1) network address translation, (2) packet filtering (including transparent filtering), (3) ALTQ, and (4) load balancing and a preview of what's coming in OpenBSD 3.3. For the last installment you'll need to be running OpenBSD-current, as not all of the features I will be writing about are available in OpenBSD 3.2.
It also advisable (but by no means required) that you keep a copy of a good book on the workings of TCP/IP at hand while you are reading this. When I get stuck, I usually look things up in [Hunt 2002] or [Stevens 1994]. If these don't answer my questions, I dig through man pages and RFCs. (Browsing through their book catalog, I noticed that O'Reilly & Associates have a book on Internet protocols [Hall 2000], which could be helpful, but I have not read it. Another good book is [McKusick 1996], which focuses on the design of 4.4BSD and includes a lot of information about TCP/IP itself).
A firewall does not need expensive hardware to run, just a reasonably fast machine capable of running OpenBSD 3.2, with two or more network interfaces. (Depending on the internal network topology, it could even be just one interface; for example, the DMZ design described in one of my earlier articles uses three network interfaces on the firewall.) An old Pentium or Pentium II PC should be enough to cope with traffic up to 10Mbps even with packet logging enabled. As for the system memory, 32MB of RAM is quite enough although 64MB of RAM gives the operating system more breathing space. External storage is a more important consideration when the firewall is logging large amounts of traffic. This issue was discussed earlier, but I will return to it later in this series. Finally, on the hardware side, make sure that the firewall's network interfaces are capable of working at the speeds of their connected networks, i.e. a 100Mbps card connected to a network working at speeds up to 100Mbps, not a 10Mbps card when the network is working at 100Mbps. In most cases, a 10/100Mbps card solves this problem rather well, but if you want more information about Ethernet, read [Spurgeon 2000].
Related Reading
Ethernet: The Definitive Guide
Remember not to run any network services and not to store any tools
beyond what's needed to run the firewall and the intrusion detection
software. The basic set of archives (
base32 and
etc32) should be enough in most cases. If you need the C/C++
compiler and other software development tools (
comp32), run
them on a workstation machine and transfer the binaries you create on it
to the firewall via
scp(1). Similarly,
xserv32, and
xshare32 archives can be left uninstalled, as they only take
up valuable storage space (not to mention the fact that, in case of a
break-in, they can be used by the intruder for potential attacks).
Start the OpenBSD packet filter with
its control tool:
$ sudo pfctl -e -f /etc/pf.conf
To start
automatically on every system reboot, edit
/etc/rc.conf, the
"system daemon configuration database", with
or any other plain text editor:
$ sudo vi /etc/rc.conf
After you open
/etc/rc.conf, change the following line:
pf=NO # Packet filter / NAT
pf=YES # Packet filter / NAT
This file contains two more variables file related to
pf(4). First
is the rule file location variable:
pf_rules=/etc/pf.conf # Packet filter rules file
Here you can change the location of the rule file from the default
/etc/pf.conf to whatever you like, but it's probably best to
leave it unchanged. Another variable of interest is:
pflogd_flags= # add more flags, ie. "-s 256"
This variable lists options for the
packet filter logging daemon. We'll look at it more closely a little
stores its filtering rules in
/etc/pf.conf, a plain ASCII
file that you can edit with
or other plain text editor. Every rule is a single, continuous line that
begins with a special keyword. Keywords define a macro, set some global
variable, or describe an action to take for packets that match a rule.
These keywords are
Note that
/etc/pf.conf contains all rules for
both NAT and filtering. (They were previously stored in two separate
files.) The rule file is divided into five sections: macro definitions,
options, scrub, NAT, and filter. Any of these sections may be missing,
but the order of sections must be maintained, as in the following:
# macro definitions
# options: "set"
# scrub rules: "scrub"
# NAT rules: "rdr", "nat", "binat"
# filtering rules: "antispoof", "block", "pass"
When you think about it, this grouping is quite practical: later sections rely on the previous ones, so it is natural to use the order that simplifies the work of the firewall administrator. The order of the rules inside each section is a different story. It depends on your packet filtering policy and will be the subject of interest throughout this series.
Here are a few basic
operations that you should memorize, as you'll use them often while
designing your own rules:
$ sudo pfctl -e
and load rule file:
$ sudo pfctl -e -f /etc/pf.conf
only load
rule file (no need to disable the packet filter):
$ sudo pfctl -f /etc/pf.conf
parse rules, but do not load them:
$ sudo pfctl -n -f /etc/pf.conf
$ sudo pfctl -d
NAT and filter rules can quickly become complex, so it is very
convenient to define macros to use in place of real names of network
interfaces, addresses, protocols, ports, and other repetitive information
found in filter rules. Life is much simpler with macros; they make it
easier to adapt existing rule sets to changes in hardware configuration.
For example, the only necessary change after modifying the external
interface on the firewall machine is to edit the macro definition. Macro
names must start with a letter from the
a-zA-Z range of the
lower part of the
set and may contain letters from the same range, digits, and underscores.
The string that the macro expands to must be enclosed in a pair of double
quotes (
"). Macros are not expanded recursively for
simplicity and security. When you're referring to a macro, precede its
name with a dollar sign (
$), as in:
# macro definitions
ext_if = "ne1"
dmz1_if = "ne2"
dmz2_if = "ne3"
# options: "set"
# scrub rules: "scrub"
scrub in on $ext_if all
scrub in on $dmz1_if all
scrub in on $dmz2_if all
The early release of
included with OpenBSD 3.0 (and 3.1) used the
command-line option to specify the algorithm for filter rules
optimization. Because the new version of
included with OpenBSD 3.2 allows more influence over the filtering engine
behavior, these options have moved to the rules file. It is simply more
convenient this way.
There are four categories of options that you may define in your packet filter rules file:
-O option is still available, but its purpose has
changed. It tells
to load only the options section from the rules file, as in
$ sudo pfctl -f /etc/pf.conf -O
The already loaded NAT or filter rules will not be modified. Remember that if you disable or remove an option that was defined before, that option will be reset to its default value.
limit frags n and the
limit states
m options set hard limits on the number of memory pools
used by the packet filter. They tell
how much memory it can use to store packet fragments (fragments are stored
in memory before reassembly and are reassembled when you use
scrub rules) and state table entries (for stateful filtering;
enable it with the
keep state rules in the filter section).
If you set this option,
will store only
n fragments or
m state table entries. Administrators use this
option to avoid performance hits and to prevent attacks from overwhelming
the firewall's resources. Both limits are independent. You may set either
or both, or you may combine both in a single rule:
# macro definitions
# options: "set"
# ex. 1: limit the number of fragments kept in memory to 30000
set limit frags 30000
# ex. 2: limit the number of state table entries to 25000
set limit states 25000
# ex. 3: combine
set limit { frags 30000, states 25000 }
You can check the current limits:
$ sudo pfctl -s memory
states hard limit 25000
frags hard limit 30000
If a limit is unset, you'll see output similar to this one:
$ sudo pfctl -s memory
states unlimited
frags unlimited
Note that there is no way to unset these limits in OpenBSD 3.2. You
can change the values of limits, if you can change and reload
$ sudo vi /etc/pf.conf
$ sudo pfctl -f /etc/pf.conf
To reset limits to their unlimited state, you have to comment out or
set limit ... rules in
/etc/pf.conf, and
reboot your firewall:
$ sudo vi /etc/pf.conf
$ sudo reboot
This behavior has been fixed in the -current branch and is expected to appear in OpenBSD 3.3.
For more information about packet fragmentation and reassembly, including the issue of timeouts, consult RFC815 [Clark 1982]. If that doesn't answer your questions, read [Stevens 1994, 2:275-300].
The new
loginterface ifname option specifies the
name of the network interface on which
will collect statistics. These statistics are
The following example shows how to activate this option:
# macro definitions
ext_if = "ne1"
# options: "set"
# ex. 1: collect statistics on ne1
set loginterface $ext_if
can display these statistics:
$ sudo pfctl -s info
Interface Stats for ne1 IPv4 IPv6
Bytes In 760 0
Bytes Out 696 0
Packets In
Passed 10 0
Blocked 0 0
Packets Out
Passed 6 0
Blocked 0 0
You can collect statistics for only one interface, even if you use
set loginterface rules. This snippet
set loginterface ne1
set loginterface ne2
will only collect statistics on
ne2 because it was the
loginterface rule. To switch it off, you must add the
set interface none rule (as the last
loginterface rule) to
/etc/pf.conf and reload the
options with
$ sudo pfctl -O -f /etc/pf.conf
This rule controls the packet filter engine optimization options. The
old optimization options
-O found in earlier version of have
been replaced with the
optimization algorithm rule.
There are six values of the
algorithm argument:
default: as its name says, it's the default optimization
normal: same as
high-latency: used for high-latency links, such as satellite
satellite: same as
aggressive: expires idle connections earlier than
default; using less memory and CPU time while possibly dropping
some legitimate connections
conservative: tries to avoid dropping any legitimate
connections at the expense of increased memory usage and CPU utilization
Don't forget to reload the new options after changing the optimization algorithm:
$ sudo pfctl -O -f /etc/pf.conf
Before you rush to enable these optimization rules, you should know that these algorithms make a difference in special cases like high-latency connections, or very busy corporate, government, or education networks. Small networks and networks with low traffic will see no noticeable performance improvements.
optimization rule is a shortcut for setting a bunch of
timeout rules quickly. If none of them seem to work in your
particular setup, consider adjusting the
timeout values
yourself, as described below.
timeout option rule adjusts the expiration time of
stateful connections. These rules only apply to packets matching stateful
connections (established with the
keep state keyword in
pass filter rules). The general syntax of this rule is
set timeout protocol.connectionstate timeout, for
# options: "set"
# ex. 1 sets timeout of the stateful connection to 20 seconds
# after receiving the first packet from the host initializing
# this connection.
set timeout tcp.first 20
# ex. 2 sets timeout of the stateful connection to 20 seconds
# after receiving the first packet from the host initializing
# this connection, then, if the connection is established,
# every packet that matches the established state of a TCP
# connection resets the timeout of the TCP connection it is a
# part of to 10 seconds. This is very aggressive, and will result
# in a high percentage of lost valid connections on slow links.
set timeout tcp.first 20
set timeout tcp.established 10
# ex. 3 same as ex. 2, but both rules have been combined on a
# single line (the order of protocol.state rules is not relevant)
set timeout { tcp.first 20, tcp.established 10 }
Example 1 above sets a very aggressive rule. If the connection is not established in 20 seconds, it will be dropped. In example 2, the connection will be dropped if the firewall does not receive a packet that is a part of the established TCP connection in 10 seconds. This is a very aggressive setting.
protocol.connectionstate can be one of these
All of the above values match various states of a TCP connection cycle. (To learn more about the TCP connection state transition cycle, consult RFC761 [Postel 1980], and if you are still looking for more information, read [Stevens 1994, 1:240-242, 2:805-807].)
You can check global timeout settings with
$ sudo pfctl -s timeouts
tcp.first 120s
tcp.opening 30s
tcp.established 86400s
tcp.closing 900s
tcp.finwait 45s
tcp.closed 90s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
As you can see, it is possible to control other protocols, like UDP, or
ICMP, but the number of
protocol.state matches is more
other is a catch-all category for protocols which are neither
TCP, UDP, nor ICMP.
The last two timeouts (
interval and
specify the interval between flushing expired states and fragments and the
time before unassembled fragments are flushed.
# options: "set"
# this connection.
set timeout interval 20
set timeout frags 20
optimization rules reset various
timeout settings, you should always list
optimization rules before your
rules; otherwise your
timeout settings will be overwritten
the values introduced by
optimization rules.
Not all IP packets sent over the Internet are well-formed, which may cause problems to hosts or routers running IP stacks that cannot properly handle packet fragmentation and reassembly. Improperly formed packets may be sent by poorly written software running on some external or internal machines, or, quite frequently, by attackers trying to compromise your network.
You can scrub incoming or outgoing packets. There are two schools of
thought. One claims that it is enough to scrub only the packets arriving
at the external interface from the outside. The other claims that all
packets that match
in rules on all interfaces (packets sent
from the outside and destined to the inside of your network, and packets
sent from your network to outside hosts) ought to be scrubbed. While a
paranoid mind gravitates toward the second solution, remember that every
rule costs CPU cycles and memory. Also, there are times when scrubbing
may interfere with network intrusion detection systems (NIDS) because
packet normalization may not detect rogue traffic which would be detected
if no scrubbing were done. Of course, it is possible to log such packets
and set your NIDS to take appropriate action. As you can see, there is no
one-size-fits-all solution.
# macro definitions
ext_if = "ne1"
# options: "set"
# scrub rules: "scrub"
# ex. 1: scrub all incoming packets on all interfaces
scrub in all
# ex. 2: scrub all incoming packets on the external interface
scrub in on $ext_if all
The process of packet normalization with the
scrub rules
can be refined with these keywords:
fragment reassemble: reassemble fragmented packets. This
is the default behavior. Fragments are held in memory until all fragments
of the original packet have been collected. You can set a limit on the
number of fragments with the
set frags option.
fragment crop: do not reassemble fragmented packets, but
pass them on. Track fragments, drop duplicate fragments, and crop
fragment drop-ovl: similar to
crop, but drops all duplicate and overlapping fragments and their
corresponding fragments.
Note that only the
fragment reassemble modifier works when
NAT rules are used at the same time. The
fragment crop and
fragment drop-ovl do not work with NAT in OpenBSD 3.2.
It is also possible to set some options:
no-df: clear the don't-fragment bit in the IP flags.
This lets datagrams be fragmented by other routers.
min-ttl n: sets the minimum Time-To-Live for the
matching packets to
n hops. The longer the TTL, the longer
the packet will circulate in the network. This modifier is only useful
for finetuning tune your network's performance.
max-mss m: sets the Maximum Segment Size for a
fragment to
m bytes. Generally, the larger the MMS, the better
the network performance. Again, you'll only need to worry about this option
when there is a performance problem.
The above options are of interest to administrators of large networks. Their use and the way they affect performance of networks is best described in [Stevens 1994].
scrub modifiers are listed at the end of the rule:
# macro definitions
ext_if = "ne1"
ext_ad = "any"
prv_ad = "f.f.f.f/24"
# options: "set"
# scrub rules: "scrub"
scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment reassemble
scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment crop
scrub in on $ext_if from $ext_ad to $prv_ad no-df min-ttl
100 max-mss 1440 fragment drop-ovl
Only IPv4 fragments can be processed in this way. IPv6 fragments are blocked.
For more information on packet normalization, read the
RFC815 [Clark 1982],
and this interesting
paper [Handley and Paxson 2001].
Network address translation (NAT) is a technique for connecting hosts hidden behind firewalls to the Internet. It can be used to redirect traffic between external and internal hosts as a proxy. It's also often used to increase the number of hosts connected to the Internet.
In the early days of the Internet, every host (or, more precisely, every network interface connecting that host to other hosts on the Internet) needed a unique IP number. The dynamic expansion of the number of hosts connected to the Internet during the last decade made it obvious that the old pool of IP numbers will soon end. Of course, the best answer for that is IPv6, but before the world switches to it, NAT will see much use as a technique for better utilization of the existing pool of IPv4 numbers, as well as for some useful security setups.
Figure 1. A general outline of the network described in this article.
By definition, if a host has no public IP address assigned to it, it cannot be reached from the outside, even if you plug it into the connector that your Internet provider gave you, which is good from the point of view of security. It gets even better when you put a firewall between the internal network and the outside network, as shown in Figure 1 above. Then you can carefully log and screen all incoming and outgoing traffic to ensure maximum security. If you split your internal network into two or more segments, then your network becomes even more secure. However, since your internal networks use a private address space (read RFC1918 [Rekhter, Moskowitz, Karrenberg, de Groot, and Lear 1996]), they are unreachable from the outside and they cannot reach outside hosts. Such a setup is secure, but not very functional, which is why we need NAT.
If you want to run NAT, you must enable IP routing before you load NAT rules. This is done with
$ sudo sysctl -w net.inet.ip.forwarding=1
net.inet.ip.forwarding: 0 -> 1
To turn IP routing off, use this command:
$ sudo sysctl -w net.inet.ip.forwarding=0
net.inet.ip.forwarding: 1 -> 0
When you're unsure if IP routing is on or off, you can check it with
$ sudo sysctl net.inet.ip.forwarding
net.inet.ip.forwarding = 0
To make changes permanent and always enable IP routing at system startup,
/etc/sysctl.conf and change this line:
#net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of packets
net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of packets
There are three kinds of NAT rules:
rdr: port redirection
nat: translation between groups of internal addresses and a
single external address
binat: bidirectional translation between one internal
address and one external address
While experimenting with your NAT setup, the following commands will make your life a little easier:
load only NAT rules:
$ sudo pfctl -N -f /etc/pf.conf
show loaded NAT rules:
$ sudo pfctl -s nat
flush NAT rules:
$ sudo pfctl -F nat
rdr rules redirect traffic from one port to another.
A classic example of using traffic redirection is the case of an HTTP
server hidden in a DMZ, yet accessible to hosts outside your network.
Ordinarily, such a server must listen on a privileged port 80, and the
machine it runs on must be directly accessible to external hosts. This
setup is not very safe, so you might consider moving the server behind a
firewall, into a DMZ network segment. However, if you do that, the server
is inaccessible, because it is the firewall which receives requests for
the HTTP server. The firewall must now redirect these packets to the web
server residing inside the DMZ network segment. This is accomplished with
the following rule:
# macro definitions
ext_if = "ne2"
ext_ad = "f.f.f.f/32"
dmz_ad = "w.w.w.w/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $ext_if proto tcp from any to $ext_ad port 80 ->
$dmz_ad port 8080
The above rule redirects all TCP (
proto tcp) packets
arriving at the firewall's external address (
on $ext_if),
originating from any source address (
from any) and destined
to the HTTP server, listening on port 80 (
to $ext_ad port 80)
to the network interface located in the DMZ (
-> $dmz_ad).
The server listens on port 8080 (
port 8080). That port is
unprivileged, and the attacker has less chance of breaking things, should
the server be compromised.
As you will soon discover, this rule works for connections made from the outside to your web server, but not from your private network. This is solved by adding another rule:
# macro definitions
ext_if = "ne2"
prv_if = "ne1"
ext_ad = "f.f.f.f/32"
prv_ad = "f.f.f.f/24"
dmz_ad = "w.w.w.w/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $ext_if proto tcp from any to $ext_ad port 80 ->
$dmz_ad port 8080
rdr on $prv_if proto tcp from $prv_ad to $ext_ad port 80 ->
$dmz_ad port 8080
You can rewrite it in the following way (notice that I put interface names and addresses in curly braces):
# macro definitions
rdr_ifs = "{ ne2, ne1 }"
rdr_ads = "{ any, p.p.p.p/24 }"
ext_ad = "f.f.f.f/32"
dmz_ad = "w.w.w.w/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $rdr_ifs proto tcp from $rdr_ads to $ext_ad port 80
-> $dmz_ad port 8080
You can use curly braces to list interface names, protocol names, and
addresses in
rdr rules. You can also replace port numbers
with their names, e.g.
port www and
port 80 are
equivalent. These names and numbers can be found in
The above rule could be tightened a little. For example, if you want
to redirect only IPv4 packets, add the
inet keyword:
# macro definitions
rdr_ifs = "{ ne2, ne1 }"
rdr_ads = "{ any, p.p.p.p/24 }"
ext_ad = "f.f.f.f/32"
dmz_ad = "w.w.w.w/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $rdr_ifs inet proto tcp from $rdr_ads to $ext_ad port 80
-> $dmz_ad port 8080
Similarly, to redirect only IPv6 packets, use the
What if you wanted to redirect all queries to port 80 on all addresses to a web cache? Return to an earlier setup with two separate rules and change the second rule:
# macro definitions
ext_if = "ne2"
prv_if = "ne1"
ext_ad = "f.f.f.f/32"
prv_ad = "f.f.f.f/24"
www_ad = "w.w.w.w/32"
cch_ad = "c.c.c.c/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $ext_if proto tcp from any to $ext_ad port 80
-> $www_ad port 8080
rdr on $prv_if proto tcp from $prv_ad to any port 80
-> $cch_ad port 1080
In the example above, the web cache listens on port 1080. Note that this technique of forcing everyone on the internal network to connect to the Web through the cache server is controversial, and you must not impose it on your users without careful thought. For more information consult [Wessels 2001].
Related Reading
What if you want to bypass the cache yourself? Use the
modifier, as in:
# macro definitions
ext_if = "ne2"
prv_if = "ne1"
ext_ad = "f.f.f.f/32"
prv_ad = "p.p.p.p/24"
bos_ad = "p.p.p.b/24"
www_ad = "w.w.w.w/32"
cch_ad = "c.c.c.c/32"
# NAT rules: "rdr", "nat", "binat"
rdr on $ext_if proto tcp from any to $ext_ad port 80 -> $www_ad port 8080
rdr on $prv_if proto tcp from $prv_ad to any port 80 -> $cch_ad port 1080
no rdr on $prv_if proto tcp from $bos_ad to any port 80
As you can see, the
no modifier makes the
-> ...
part of the rule unnecessary (and such rules do not parse, as they
do not make sense).
Another modifier is
!, which negates the values (interface
names, source and target addresses) it precedes:
rdr on ! ne1 inet proto tcp from ! s.s.s.s/32 to !
e.e.e.e/32 port 80 -> d.d.d.d/32 port 8080
The above rule redirects all IPv4 TCP packets arriving on any interface
ne1 from any address except
s.s.s.s/32 and
destined to any address except
rdr rules are very handy because they can be used to
configure proxies, redirect traffic from a dead host to a backup host. and
so on. Recently,
rdr rules have been used to fight spam. If
a suspicious host tries to connect to the
smtp port on your
firewall, its request will be directed to a special program that keeps it
waiting forever for a connection confirmation; then, just when the
spammer's MTA thinks it will be able to send mail it receives an error
message and the connection closes. Such delays of several minutes
seriously slow spammers and are a good way to make their life harder.
OpenBSD 3.3 is supposed to include some interesting tools for fighting
NAT rules perform network address translation for groups of internal hosts, with private addresses hidden behind a firewall, which access the outside world through a single interface with one public IP. (The external interface could have more IP addresses assigned to it, but let's focus on the most severe case.) This not only solves the problem of connecting more than one host through a single interface, but it also hides details of your internal network's layout, the number of hosts, and other information that an intruder may find useful.
The magic is possible because the firewall keeps a record of who sent
what and where, so it can send replies to the right host. To do that it
must keep a table of sorts and mark packets it sends to the Internet.
This marking allows attackers to deduct how many hosts are hidden behind
the firewall and gives them an idea of what might be hiding behind your
firewall, provided they can capture that traffic. It is also used by
companies selling DSL access to the Internet to find out who's breaching
their contracts. (Some DSL access providers forbid their customers to use
NAT, and impose penalties on those who use it. If your provider does this,
consider switching to another.) The latest versions of
can fool these detection systems, but you need to be running
OpenBSD-current, which is still experimental. We'll look at what -current
has to offer in part 4.
How do you connect your private network to the outside world? It's quite simple, actually:
# macro definitions
ext_if = "ne1"
ext_ad = "f.f.f.f/32"
prv_ads = "p.p.p.p/24"
nat_p = "{tcp, udp, icmp}"
# NAT rules: "rdr", "nat", "binat"
nat on $ext_if proto $nat_p from $prv_ads to any -> $ext_ad
When it is time to add a new network segment, modify the macros:
# macro definitions
ext_if = "ne1"
ext_ad = "f.f.f.f/32"
prv_ads = "{ p.p.p.p/24, d.d.d.d/24 }"
nat_p = "{tcp, udp, icmp}"
# NAT rules: "rdr", "nat", "binat"
nat on $ext_if proto $nat_p from $prv_ads to any -> $ext_ad
Shouldn't we use the names of the interfaces that connect our private networks to the firewall? No, address translation is done on the external interface.
Just like
rdr rules,
nat rules allow us to
use the
no and
! modifiers before interface
names and private host addresses. It is also possible to limit their
scope to IPv4 or IPv6 packets (
inet and
respectively). The
man page has more detailed information about using intricate modifiers
like binary or unary operators.
The last of the three NAT rules are
binat rules, which
bind an external public address to an internal private address. VPN
setups use this bidirectional translation, and it can provide additional
security for hosts exposing public services. These rules are similar to
rdr rule, but they do not allow such fine degrees of
control. While the following rule set works with
rdr rules,
it is not possible with
binat rules.
rdr on $ext_if proto tcp from any to $ext_ad port 22 -> 192.168.1.1 port 1022
rdr on $ext_if proto tcp from any to $ext_ad port 25 -> 192.168.1.2 port 1025
rdr on $ext_if proto tcp from any to $ext_ad port 53 -> 192.168.1.3 port 1053
rdr on $ext_if proto tcp from any to $ext_ad port 80 -> 192.168.1.4 port 8080
Compare it with
binat rules:
binat on $ext_if proto tcp from 192.168.1.37 to any -> $ext_ad_1
binat on $ext_if proto tcp from 192.168.1.38 to any -> $ext_ad_2
binat on $ext_if proto tcp from 192.168.1.54 to any -> $ext_ad_3
As you can see, every internal address must have its own equivalent external address. They can all be bound to the same external interface, though. If you want to know more, consult the ifconfig(8) man page (look for information about aliases).
no and
! modifiers are allowed, as are
address class modifiers (
inet and
Always remember that NAT rules do not filter traffic. They redirect
it. There must be another rule that filters out traffic redirected to
another interface or port. The sender of the original packet does not
know anything about what goes on behind the firewall. All it knows is
that the packet has reached its destination at
$ext_ad. The
next installment of this series will cover filtering.
Jacek Artymiak started his adventure with computers in 1986 with Sinclair ZX Spectrum. He's been using various commercial and Open Source Unix systems since 1991. Today, Jacek runs devGuide.net, writes and teaches about Open Source software and security, and tries to make things happen.
Read more Securing Small Networks with OpenBSD columns.
Return to the BSD DevCenter.
Copyright © 2009 O'Reilly Media, Inc.


text:
Your shopping cart is empty!
Arsenal Dri-FIT Core Hat in red colors.Dri-FIT fabric to wick sweat away and help keep you dry and comfortable,Features:Embroidered team print in front,and embroidered eyelets for breathability.Velcro fastener back closure with embroidered Nike swoosh on it.
Team screen-print at right underbill. Inside the hat says:Victory through harmony.58% cotton/42% polyester.
Soccerplus first opened in 1994. We were one of the first soccer websites to hit the webView more
Address: 1640 E. Washington Blvd.
Pasadena, Ca 91104, USA
Phone: 1-800-945-7291
Get Direct

subset: commoncrawl


text:
Time runs out for Warren
COLUMBUS The St. Vincent-St. Mary Fighting Irish held true to their reputation Thursday night.
The six-time state champions used athleticism and a sizzling 25-for-42 (59.5 percent) shooting performance to eliminate the Warren Warriors 70-51 in a Division II state semifinal contest at Value City Arena.
With eight players on their roster listed at 6-foot-3 or taller, the Irish held a big advantage on the boards, outrebounding Warren 32-22.
"They're strong," said Warren head coach Blane Maddox. "They've got good hops."
Nick Wells, a 6-6 senior, poured in 18 points on 7-for-8 shooting and recorded a game-high seven rebounds while 6-7 freshman V.J. King added 14 points and six boards. Jalen Hudson, a 6-6 junior, also reached double figures with 12 points.
Warren junior Reece Patton led everyone with 21 points and added six rebounds. Sophomore Michael Hall contributed 15 markers and five counters.
Junior Evan French, who played exceptionally well all throughout the postseason, got into foul trouble early and was never able to get into a rhythm. French finished with five points, fouling out late in the fourth quarter.
"I thought we executed our game plan pretty good," said Irish boss Dru Joyce. "We got French into foul trouble early which was big.
"We wanted to make sure that if (French) got some (points), he had to work hard for it and earn it."
St. Vincent-St. Mary opened the game on a 6-1 run, but 3-pointers by Patton and senior Dylan Leffingwell cut it to 9-7.
After a basket by St. Mary's Jordan Hargrove, Patton hit another trey to make it 11-10. Wells countered with a 3-point play before Warren took its only lead of the game on five straight points from Hall to make it 15-14.
Wells then poured in five straight of his own before Hall nailed a jumper to make it 19-17 after one quarter.
"I'm really proud of the way we came out and battled," Maddox said. "We hit some big shots early to stay in it. We played really tough."
Jalen Hudson recorded a steal and turned it into a slam dunk to open the second period. Later, Patton scored five straight points for the Warriors to make the score 24-21, but a runner by Hudson and a bucket by Hargrove extended it to 28-22.
Patton nailed his third triple of the game to bring it to 30-26, but the Fighting Irish went on a 9-1 run to close out the half up 39-27.
The lead increased to 18 points for the Irish after the third quarter. A 3-pointer by French and a basket by Patton brought it to a 12-point game midway through the third, but that was as close as the Warriors would get.
In the final minutes of the game, senior Matt Drayer and juniors Corey Newlon and Andrew Drayer all hit baskets, but it was not enough as St. Vincent-St. Mary held on for the 19-point victory to claim a spot in the state championship.
The Warriors finished the 2012-13 campaign with a 26-2 record.
With the deepest postseason run in school history, the Warriors certainly have a lot to be proud of.
"It's the most fulfilling feeling I've ever had," Patton said. "Just being here on the big stage. It's never been done before at our school. It's just something special and I'm proud of our guys."
Hall added "It's special to be here. We've gotta come back next year and work even harder."


text:
Alan Wake ReviewBy Abbie Heppe - Posted May 04, 2010
Alan Wake is the story of a once famous writer who descends into the eerie realm of his own novels when he takes a trip to the Pacific Northwest town of Bright Falls. With solid gameplay and beautiful lighting and sound that build tension from start to finish, Wake is a welcome entrant into the annals of suspense/horror games.
The Pros
- Fantastic atmosphere created with aesthetics and sound
- Running away is just as satisfying as fighting
- Intriguing characters, story and location
The Cons
- Wake can control clumsily at points
- Some pointless achievement based collecting
- Some major plot moments lack a strong payoff
For over six years, Remedy has been tinkering away at Alan Wake, the Finnish developers' follow-up to Max Payne 2, resurfacing intermittently at different E3s over the years. For such a lengthy development period and ambitious subject matter, is Alan Wake worth the wait? Undoubtedly. It's a game that effectively uses strong narrative, detailed visuals and art design, and subtly sublime audio to create one of the most eerie atmospheres seen in some time.
Stephen King-esque Alan Wake is a famous novelist who can't get a handle on his next book, his relationship or himself. Fearing the worst, his wife Alice plans a trip to the remote Pacific Northwest town of Bright Falls for a relaxing getaway only to find that it's the ideal setting for a real life horror novel. Alice disappears from the lake cabin they've rented, and it's up to Alan to discover what happened.
Alan Wake quickly establishes itself as pseudo-linear survival horror game. It's not quite the open-world experience Remedy initially hinted at (and then subsequently denied), but it's loaded with large areas to explore and extremely satisfying third-person combat. Wake's tension comes from the way that you must dispatch The Taken, light-sensitive entities that have taken over the bodies of townspeople. You're armed with a flashlight in one hand, which dissolves their protective shield until you can shoot them with the gun you tote in your other hand. He's also armed with other luminous projectiles, like flares and flash grenades, both often the best weapons in your arsenal. The combo flashlight/gun mechanic relies heavily on auto-targeting and works exceptionally well. That doesn't mean the game is shooting for you, but it'd be insanely difficult to play with a more complicated system. The camera often pulls out into a wider shot to avoid overwhelming the player with shadowed and terrifying enemies looming in from all sides.
Since darkness is the core of Alan Wake's horror, the game finds the balance between daylight hours and the impending terror of nightfall through the pairing of great art design, dramatic tension, and great visuals. Daytime represents safety and normalcy, but Alan Wake truly shines in the dark. The ever-shifting shadows that shroud the nighttime scenes are spectacular, creating an environment that seems to live and breathe on its own. Light is used impeccably; shadows play all the correct tricks on the eye and the lamps that beckon the player towards safety are always just far enough away to induce panic.
On par with the quality of light, the sound effects and original music complement the visual splendor as the camera pans out over the sweeping mountainsides and as the encroaching darkness fills the forests with shifting fog. It's a game that truly runs a good surround sound system through its paces. Every creaking piece of wood, tingle of a wind chime or lurking enemy is audible, yet none betray the next scare or let the player escape the persistent tension. Licensed tracks theme each episode and tie the game together. They all make for pleasant surprises.
Citation Needed
Remedy's greatest challenge on display is the creation of a horror game that envelops almost every cliché of the genre without being completely cliché itself, not to mention writing a game about a writer. There are many nods to Stephen King, the game quotes him, incorporates music and poetry as his novels often do, follows the oft-formulaic horror staples of uncertainty, dream states, subjugation of the experience and sublimely transplants the foggy and desolate corners of the Northeast into their Northwest counterparts. However, it never fails to deliver its own distinctive experience. Though early comparisons to Twin Peaks were made, it's better compared to The X-Files, seeing as flashlights are the weapon du jour, the content is episodic and is neatly tied up into one package that will prompt questions as to what did or did not happen. All in all, every referential comparison is acknowledged in the game, though it seldom feels like Alan Wake is ripping any one off. Despite an rough introduction to the character himself, Alan Wake can be light-hearted, much more than the heavy-handed Max Payne games. It's most apparent through the comic relief character Barry, Alan's agent, but also in some of Alan's dialogue, elements of the setting, commentary about video games and the members of Remedy that show up in live-action TV segments in the game.
Table of Contents
It's the impeccable pacing in the game allows the player to take in the scope of what Bright Falls has to offer. While it sometimes feels like Alan Wake is built on the now-trimmed foundations of a game far greater in scope, there is still quite a large area to explore with benefits and consequences in doing so. There are ample lures to pull you off safe paths, from hidden caches of weapons and ammo to signs that speak to the town's history, opportunities to briefly listen to the local radio station and TVs that play episodes of Night Springs, a comically ridiculous Twilight Zone-inspired show. The game is also littered with collectibles, ranging from trite Achievement bait like coffee thermoses to the far more intriguing pages of manuscript from the book Alan can't remember writing; the manuscript narrative is a great device that speaks to past, current and future events.
Falling Action
With such great attention to details in world-building, presentation, and tense ambience, it's a shame that Alan is so clunky to maneuver at times. As fluid as the combat is, he controls somewhat clumsily, stumbling where he shouldn't and continuing to move after you've let off the left stick. It's mainly problematic in places where Wake is asked to jump, traverse narrow walkways or pick up items. It can lead to accidental (and inconvenient) deaths. For a game that has been in development for so long, it's a shame to see such an unpolished element.
There's also a sequence in the game that betrays the lengthy production time as it's something seen in two of 2009's major releases. Granted each game is different, but had neither come out last year (I'm not revealing them, lest it become obvious), Alan Wake would have better for it. Sadly it renders a great set piece cliché.
Alan Wake isn't a long game -- clocking in at around 10 hours -- but it's the perfect length, well paced and high in replay value. Certain manuscript pages are only attainable in Nightmare difficulty, but don't let the name frighten you; enemies are a bit stronger but ammo is generous and the mode is completely feasible for anyone who's already beaten the game on normal. In fact, it's arguably a better experience, as the game seems more willing to punish you for straying and heighten the sense of desperation and fear. More often than not, and even in normal difficulty, you'll have to decide whether to fight or flee, with the latter being the more promising option. Kudos to a horror game that forces you to just run like hell from time to time.
After an exceptionally long wait, Alan Wake is many things it promised to be. It's a well-written horror game that builds tension instead of cheap jump-out scares, and one that leans on today's technology to provide the genre with a lively and eerie environment. Its flaws are evident the longer you play – the titular hero's a bit unwieldy and a shocking moment would've been more shocking had the game shipped on schedule -- but its presentation and ambience are rivaled by few. For gamers who like to play alone with the lights out, Alan Wake hits the sweet spot.


text:
Sporting events have one thing in common with concerts: A few douchebag fans can ruin everything. They're running onto the field, they're blowing some kind of plastic horn in your ear, they're throwing shit down onto the playing surface.
It kind of makes you stop and wonder, who the hell started this? And why did other people decide to copy it? Well, we know the answer to the first one ...
5Michael O'Brien Was the First to Run Onto the Field Naked
The Idiocy:
If you're an American, you might be saying, "WHAT? I've never seen a naked man run onto the field of a sporting event I was watching!" That's because TV networks have a policy of not showing them -- they just cut to the sidelines or have the announcers in the booth banter while the guy is apprehended. So a naked man running onto the field looks like this if you're there (NSFW) ...
... but becomes this in the TV broadcast:
This "run naked onto the field" fad has been going on for almost 40 years now, and we can thank ...
The Man:
In February 1974, England was battling France in a crucial rugby match at Twickenham Stadium in London. Over 53,000 fans were at the game, including many British royals, and all of them were treated to a healthy dose of flopping genitals. 25-year-old Australian Michael O'Brien had just taken a bet from a friend to run across the field naked and became the first known streaker at a sporting event.
The crowd all looks like they've seen better.
Up to that point, streaking was relegated to college courtyards, but no one had considered running naked in front of thousands of spectators, some of whom would no doubt have cameras. The police chasing him were baffled as to why anyone would willingly do it and were just as amused as the audience.
In fact, after assessing a fine, they actually let O'Brien go right back to his seat for the second half of the match. During his moment of arrest, however, one policeman had the decency to cover up the offensive bits with his hat, which immediately became an iconic photo worldwide.
The Age
The policeman would immediately file paperwork for a new hat.
And that was that; the photo triggered a wave of copycat offenders at sporting events all over England, and then the rest of Europe and finally America. For the next four decades.
It turns out people everywhere were just looking for an excuse to get naked in front of packed stadiums, and now they had one. Naturally, the once-spontaneous event lost its charm pretty quickly for sports fans and particularly for police. They clearly didn't anticipate how awful it would be to tackle naked people at every other game, and on one occasion, the Academy Awards.
4"Krazy" George Henderson Invented "The Wave"
The Idiocy:
Of all the horrific ways that mob mentality can manifest, the wave is easily one of the gentlest. Fans attending sporting events from Little League baseball games to the World Series have all realized how gratifying it can be to just stand up and sit down at an opportune moment. The result of several people doing it in succession is a massive wave that ripples across a stadium, or in the case of Little League games, a small set of bleachers.
It's considered so annoying and disruptive to the game that some stadiums have banned it, and coaches have personally pleaded with fans to stop.
"What is the appeal here?"
Whose idea was this?
The Man:
In 1979, George Henderson was a professional cheerleader for the San Jose Earthquakes and the Oakland Seals. Now, when we say cheerleader, you are probably picturing a peppy, strong young kid with sweatbands doing some flips, but what you ought to be picturing is this:
Krazy George, Professional Cheerleader
The jean shorts are crucial.
George Henderson didn't match the mold for the standard cheerleader, but he was still phenomenal at riling up crowds. So good, in fact, that he was hired by professional teams across all sports to hype up spectators.
In 1980, while leading cheers at an NHL game in Edmonton, Henderson discovered the wave by accident. He was encouraging fans to all jump up and shout at the same time, but with an arena full of drunk Canadians, many of the fans were slow to respond. So, the cheer rippled helplessly across the group before dying out. What probably seemed like a failure at the time gave Henderson the vision for a cheer no one had ever considered before.
Krazy George, Professional Cheerleader
His previous hit, the Farting Mountie, was beginning to wear thin.
He saved it until an American League championship game between the Oakland Athletics and the New York Yankees in 1981. He tried to incite the fans into doing the wave, but like puppies learning a new trick, they all collectively cocked their heads and stared. But after realizing the crazy guy with the drum might be on to something, the fans gradually learned to do it. Again. Again. And again. All during the game. Since then, it has become an institution at games everywhere. Whether you want to or not, if you're at a sporting event, you are obligated to participate in the wave. All thanks to Krazy George.
"Thanks" may be a strong word.
Within the last decade, however, George Henderson's claim to have started the wave has been challenged by the University of Washington. A graduate named Rob Weller argues that he started the wave during a football game against Stanford, also in 1981. Chronology, however, suggests that he's wrong, because that game happened on October 31 and the final game of the American League Championship was on October 15. For now, Krazy George is still credited as the creator of the wave, or as some people know it, "That damn cheer you have to do at every game that distracts everyone from what's going on down on the field."
Krazy George, Professional Cheerleader
Hey, it beats baseball.


text:
University News
Hulse is a Girl for All Seasons: Volleyball, Lacrosse, Wildfire
Hannah Hulse '19 measures her life in seasons: volleyball season, lacrosse season, and fire season.
Doing It All: Academics, Student Goverment & Sports Keep Hiefield Busy
Mallory Hiefield '17 switched sports in the middle of her college years, finding herself on a conference championship team. In the meantime, she has pursued a rigorous academic path and been elected Undergraduate Student Sentate president.
Storybook Experience: Writer Pursues Diverse College Life
Pacific basketball player Charli Elliott '19 completed her first novel during freshman year.
Weli Alamillo '18: 'I Instantly Knew I Could Live Here'
Weli Alamillo '18 was excited for the chance to play soccer at the collegiate level. The chance to delve into scientific research, though, was even more exciting.
Tennis Player Wininger '17 Finds Unexpected Interest in Voyages
Clark Wininger '17 came to Pacific University to play tennis. But through Voyages and the Anthropology/Sociology Department, he's found a lot more.
Genevieve Ludwig, Ed.D, AT/L, ATC joins Athletic Training program faculty
Dr. Genevieve Ludwig has accepted a faculty position with the Athletic Training Program. Dr. Ludwig comes to us from Southern Utah University, where she served as the clinical coordinator. Prior to that she served in a similar position at University of Minnesota – Duluth. Dr. Ludwig received her Doctorate of Education from Walden University.
Professor Nancy Neudauer Receives Simons Foundation Award
Dr. Neudauer awarded $35,000 to support collaborative research project "Matroids in an International Research Community: generating new researchers."
Two Pacific Students Awarded US Department of State's Benjamin A. Gilman International Scholarship To Study Abroad
Passina Abe and Meriya Sanchez will study in Japan and India, respectively, this fall. They are among just 1,150 undergraduate students nationally to receive the scholarship.
Pacific University Welcomes Five New Members to Board of Trustees
Julia Brim-Edwards (Nike), Sheri Garboden '76 (Flir Systems) and Norman Scott '63 (Ret. US Navy) began their terms on July 1 along with faculty representative Graham Erickson (College of Optometry) and graduate student representative Katie Ohene (Clinical Psychology). Longtime trustee Gerald Yoshida '73 elected as board chair.
Prospective Students Invited to Pacific University During Oregon Private College Week, July 25-29
Pacific is among 12 private colleges and universities in the state participating. Students who register in advance and visit at least four institutions during the week will receive application fee waivers, and may use the waivers to apply to any Oregon Alliance of Independent Colleges and Universities member institution.


text:
On this day: July 24
Published On: Jul 24 2012 12:23:07 AM CDT Updated On: Jul 24 2016 01:00:00 AM CDT
An aviation pioneer is born, a lost city is rediscovered, a famous comedy duo performs together for the first time, George Brett flips out, and Apollo 11 splashes down, all on this day.
The views expressed are not those of this company or its affiliated companies. Please note by clicking on "Post" you acknowledge that you have read the Terms Of Service and the comment you are posting is in compliance with such terms.


text:
Man jailed on assault chargeJanuary 30,2014Man jailed on
assault charge
A Rutland man is behind bars after allegedly beating a woman during a domestic incident on Grove Street.
Joshua E. Koch, 25, pleaded innocent in Rutland criminal court Wednesday to a felony charge of aggravated assault in the first degree and a misdemeanor charge of cruelty to a child. Judge Cortland Corsones set bail at $10,000 for Koch who remained in jail Wednesday evening.
Koch was arrested Tuesday night after an incident at 92 Grove St. where a woman told city police Koch punched her and kicked her with steel-toed boots in front of a toddler.MORE IN This Just InMONTPELIER A new report from a commission that studied the cost, availability and quality of... Full StoryVermont fish hatchery changes focus, looks inland
BETHEL, Vt. Full StoryHONOLULU (AP) A group of Hawaii musicians and a Hawaiian Airlines flight attendant provided... Full Story
- Most Popular
- Most Emailed


text:
ReSource' store hosts celebration Saturday
BARRE Five years and $1.7 million later, the ReSOURCE Store will end its Barre Social Enterprise Expansion Capital Campaign on Saturday with a celebration at its store at 30 Granite St. in Barre.
The store sells recycled household goods, as well retail and building materials, while using the materials it doesnt sell to support its various community-based programs.
The organization said its mission is to meet community and individual needs through education and job skills training, environmental stewardship, and economic opportunities. The campaign was an effort by ReSOURCE to raise money for its Barre branch, after the organization expanded there from Burlington in 2009. During the campaign, the store received support from over 325 donors, including 54 from Vermont.
The celebration will kick off at 4 p.m. with a family concert by the Re-BOPs. Starting at 5 p.m., there will be food and drink from local vendors including Citizen Cider, Lost Nation Brewery, Cabot Creamery, and Ben & Jerrys. At 5:30 there will be a series of speakers, including U.S. Sen. Patrick Leahy, Mayor Thomas Lauzon, and ReSOURCE Executive Director Tom Longstreth.
Following the speeches, Kat Wright and the Indomitable Soul Band will cap off the event with an early evening concert. Event organizers expect the celebration to conclude around 7:30 or 8 p.m.
The events at the celebration will all take place on ReSOURCEs Flying Stage.
ReSOURCE, which also has a location in Morrisville, came to Barre in 2009. Ostler said the decision to expand to the Granite City was the result of a couple of different factors.
It was partly a need for our services. We heard from people in Barre that they would like to have a retail store. There was also another retail store in the central Vermont area whose roof had caved in. We offered to help fix their roof and they asked us if we could take over their program, he said.
The organization purchased the Beck & Beck No. 1 Granite Shed in downtown Barre in 2009, and students and instructors in ReSOURCEs Youth Build program spent the next four years working with local contractors to renovate and weatherize the building, while ReSOURCE officials raised money through the capital campaign.
The Youth Build program is one of the organizations most valuable community initiatives, according to Ostler. The program helps high school dropouts across the nation earn their diplomas through a combination of classes and work on construction sites. The local program lasts 10 weeks and is open to those 16 to 24 years old. Ostler said ReSOURCE has about 32 participants per year in central Vermont.
Weve always identified the need for the Youth Build program, he said. The idea was that you had high school dropouts with no prospects to make a living. A group decided that if we get them the opportunity to earn a high school diploma while learning job skills in construction, that could give them a boost.
The program is mostly made up of men, but the organization is trying to get more young women involved, according to Ostler.
In addition to the Youth Build program, ReSOURCE also provides services in poverty relief, environmental stewardship, and job skills training.
For more information about the ReSOURCE and the celebration on Saturday, call 917-4950.MORE IN This Just InMONTPELIER A new report from a commission that studied the cost, availability and quality of... Full StoryVermont fish hatchery changes focus, looks inland
BETHEL, Vt. Full StoryHONOLULU (AP) A group of Hawaii musicians and a Hawaiian Airlines flight attendant provided... Full Story
- Most Popular
- Most Emailed


text:
My Madison
Published On: Feb 14 2013 11:52:59 AM CST Updated On: Sep 26 2016 07:23:40 AM CDT
Share a picture that shows us why you love Madison.
The views expressed are not those of this company or its affiliated companies. By posting your comments you agree to our Terms of Use.


text:
SalomonNo Reviews Available | post a review
Ogden, UT US
(800) 654-2668 / (800) 225-6850
Store Website
About Salomon
|Salomon is a company committed to Mountain Sports, and manufactures and sells a wide variety of product used for mountain sports. The company has evolved from a pure hardgoods brand, offering Alpine Skis, Boots, and Bindings, to a diverse Brand that offers product ranging from Softgoods to Hardgoods, involving Alpine Ski, Snowboard, Footwear, and Apparel. Salomon is a Brand in the Amer Sports Group of Brands.
Salomon began operations in 1947
Bad info? Tell us
Salomon Contact Information
Salomon Website
New Gear From Salomon This Season
|Falcon Custom Shell Pro Boot, Ghost Boot
Rocker, Czar, Lord, Lady skis are new to the Freeski line
Dumont, Suspect, Mai Tai freestyle skis with a new sidewall construction
Tornado Ti all mountain ski
STH 14 Binding
Where to Buy Salomon Online
Al's Ski Equipment Barn
Pro Peak Sports
Service and Selection Beyond Expectation
Ski N See - Sandy
Free Shipping on orders over $100
New gear and closeouts at great prices
Salomon - Their Specialties
|Salomon is the most committed brand in freeskiing. We continually develop and improve products that drive freeskiing in the park and for big mountain skiing. From the launch of the 1080 ski 10 years ago, to the 08/09 line of Salomon skis, we have developed athlete driven products that progress freeskiing.
Salomon Service
|Salomon Jib Academy- 3 US stops, plus International Final in Mammoth CA. New this year, 5 wildcard spots open based on online submissions.
Salomon Products
Alpine Skiing
Alpine Skis
Alpine Boots
Alpine Bindings
Alpine Skiing Accessories
Men's Alpine Apparel
Women's Alpine Apparel
Children's Alpine Apparel
Nordic Skiing
Nordic Skis
Nordic Boots
Nordic Bindings
Nordic Ski Poles
Men's Nordic Skiing Apparel
Women's Nordic Skiing Apparel
Other Nordic Skiing Softgoods
Snowboard Boots
Snowboard Bindings
Snowboard Accessories
Men's Snowboard Apparel
Women's Snowboard Apparel
Children's Snowboard Apparel
Men's Snowboard Jackets/Pants
Women's Snowboard Jackets/Pants
Children's Snowboard Jackets/Pants
Other Snowboarding Softgoods
Hydration Packs


text:
Freedom Newspapers
Was it only two weeks ago that the United States killed Abu Musab al-Zarqawi, the leader of al-Qaida in Iraq, the Iraqi government finally got all its ministers in place, and things seemed to be looking up? It is hardly a surprise that al-Qaida or other insurgents would unleash a wave of violence in reprisal for the Zarqawi killing, but things seem particularly grim in Iraq just now.
The recovery of the bodies of two American soldiers, apparently tortured and mutilated beyond recognition, highlights the cruelty and brutality of the enemies of U.S. occupation and the newly formed Iraqi government.
Wednesday, one of Saddam Hussein's defense lawyers was slain, a car bomb killed at least three people and wounded eight in Sadr City, 85 Iraqi workers were abducted as they left work at an industrial plant near Baghdad, and militants vowed to kill four Russians they abducted June 3.
A sad background to all this is a cable from the U.S. Embassy in Baghdad to Washington, sent about the same time President Bush made his surprise visit to Baghdad, and reprinted Sunday in the
Washington Post. It told of poor living conditions and increasing tension among Iraqi employees of the Embassy. Women are harassed about the way they dress. Most employees get only an hour of electric power at home for six hours without. Of nine employees only four had even told their families they worked at the U.S. Embassy for fear of their lives. The Embassy now shreds documents that show the surnames of Iraqi staff members.
Ethnic tensions, according to the cable, are increasing, to the point that "(a)n Arab newspaper editor told us he is preparing an extensive survey of ethnic cleansing, which he said is taking place in almost every Iraqi province, as political parties and their militias are seemingly engaged in tit-for-tat reprisals all over Iraq." Iraqi employees report that informers are commonplace "as Iraqi security forces fail to gain public confidence."
Furthermore, "The central government, our staff says, is not relevant; even local mukhtars have been displaced or co-opted by militias. People no longer trust most neighbors."
That's a raw view from the ground, and it may be colored by the fears and hostilities that Embassy employees, being targets, can't help but notice. But Embassy employees, with a job with a steady paycheck, are probably better off than most Iraqis. It is hard to imagine what daily life is like in besieged cities like Ramadi, which are too dangerous for reporters to cover regularly.
Not all the news from Iraq is bad. Some areas are relatively peaceful, the government is beginning to function, and Iraqi security forces are being trained and gradually becoming more effective. Electricity availability is near pre-Saddam levels, but demand is even higher. Oil production and revenue are rising, accelerated by higher gas prices. But the challenges are immense, and, ultimately, they will have to be met by the Iraqi people.
It would be neither healthy nor even possible for the United States to maintain primary responsibility for Iraq's safety for a prolonged period.


text:
March 31, 2014 —
The court case about the legitimacy of more than 100 voters in the March election in Bloomingburg got off to an surprising start, with an attorney for one of the candidates asking the judge to recuse himself because of the judge's wife's social media activities.
The judge, Stephan Schick, is married to Donna Schick, who is a secretary and committee person in the Sullivan County Democratic Committee.
The attorney, John Ciampoli, said that Donna Schick had made some social media entries that seemed to endorse a DVD that portrayed members of the Jewish community in a negative light. (This case is about members of the Hasidic community and whether they improperly registered to vote before the election, but the discussion did not reveal whether the DVD in question targeted the Hasidic Community.)
Ciampoli argued that knowing that Mrs. Schick left these posts, which the judge described as one-word reactions to the DVD, would make a "reasonable person" question the court's impartiality in this case and thus result in the appearance of a conflict.
The judge disagreed; he said that Ciampoli, who was interpreting the matter in a way that would benefit his client, was not a "reasonable person" in this instance.
He also said that he himself does not use social media, but this is the 21st century, and women and wives have the right to express themselves on social media. He said that if any judge with a relative who ever posted something negative on social media had to recuse himself, then no judge would be able to hear a trial. The judge denied the motion.
The main purpose of the day's proceedings was to have the Sullivan County Board of Elections (BOE) enter their determinations as to which registrations would stand and which would not. More than 100 voter registrations have been challenged, and it's clear that if those votes are included in the tally, the Bloomingburg Strong candidates for mayor and trustee positions, who support developer Shalom Lamm and his 396-unit townhouse development will win, and if those votes are blocked, the Rural Heritage candidates, who opposed the development will win. The Rural Heritage candidates issued a statement on social media that the BOE had ruled in their favor.
Judge Schick has said he wants to make a decision in the case before April 7, when the new village officials take office, but Ciampoli asked the judge to dismiss the case, because, he argued repeatedly, the BOE improperly made their determination about the voter registrations after the vote, and that was not allowed.
The attorney for one of the Rural Party candidates responded strongly to that notion. He said, "They got 150 people on the roll with no opportunity to challenge." He alleged that their thinking in terms of timing was, "If they do the lining up just right, they'll get their people across the finish line… and no one will have a right to prevent them from stealing an election."
There was a considerable amount of discussion about whether the BOE determination of the registrations, should be entered into evidence. All four lawyers representing the Bloomingburg Strong candidates and the developer were opposed to allowing it, and two of them formally objected, which prompted the judge to schedule a hearing on the matter.
Several technical arguments were brought up against the determinations, including that there be a separate determination required for each voter, and they could not all be handled at once.
But the lawyer for the BOE, Tom Cawley, called all of the arguments trying to block the BOE's determinations "spurious," and he said he had heard no good arguments why the determination should not be entered.
The judge agreed. The hearing was scheduled for April 2.


text:
ThereŌĆÖs a dozen candidates in all: 10 vying for the town board and two for mayor seat.
The field of candidates is varied, too ŌĆö from a former newspaper editor to an architect to a stay-at-home mom. They range in age from 27 to 77.
At a candidate forum last week, each took a chance to sound off on the reasons behind their candidacy. While the answers were varied, economic development was a recurring theme ŌĆö although candidates have different ideas of how to get there.
Angela Hubbs Moore, 32, wants to lower taxes and reduce town spending.
ŌĆ£Economic development is best served by reducing the amount of taxes,ŌĆØ she said at the forum.
Thomas Ritter, an architect in town, painted a bleak picture of the state of Franklin. He proposed investing in Angel Medical Center and making Franklin more attractive to job seekers as one way to remediate a sluggish local economy.
ŌĆ£ThereŌĆÖs not a business in town thatŌĆÖs thriving,ŌĆØ Ritter said.
The candidate participation in this NovemberŌĆÖs Franklin election comes as a bit of a surprise in comparison to the town election two years ago, when only the incumbents ran and voter turnout was low.
Part of the attraction for candidates this year is the promise of open seats. Long-time Mayor Joe Collins isnŌĆÖt running for re-election, prompting two of the current aldermen to forsake their seats on the town board and run for mayor instead ŌĆö namely Bob Scott and Sissy Pattillo. That made the race wide-open, with newcomers guaranteed to take as least two seats on the town board. A third alderman seat is also up for election, currently held by Billy Mashburn, who is running to keep his seat.
Town Alderman Farrell Jamison, whose seat is not up for election, speculated that the two open seats might have been enticing for candidates on the fence about whether to run.
ŌĆ£Since two of the aldermen decided to run for mayor, that would open vacant slots for somebody to run,ŌĆØ Jamison said. ŌĆ£The last several elections, there have not been that many candidates run.ŌĆØ
But the issues run deeper than just an opportunity to win an up-for-grabs alderman seat, according to Matt Bateman, one of the organizers of the candidate forum and a founder of the community action group Venture Local. Though fiscal responsibility and the townŌĆÖs water and sewer infrastructure are concerns of many residents, he characterized the newfound political interest in town as something bigger.
ŌĆ£ItŌĆÖs just time for change in leadership in Franklin,ŌĆØ he said. ŌĆ£And folks in Franklin are just starting to get that.ŌĆØ
The variety of candidates is a welcome aspect of the town election, and much better for voters than the limited participation and options they had two years ago, he added.
ŌĆ£IŌĆÖve been pushing and encouraging people to try to vote and run for the board,ŌĆØ he said. ŌĆ£ItŌĆÖs only going to make for a more healthy, diverse election.ŌĆØ
At last weekŌĆÖs forum, candidates accused current town government of making poor property purchases, overspending on a ŌĆ£lavishŌĆØ new town hall renovation, allowing imprudent development that threatens the environment and not promoting itself as a tourist destination or fostering a healthy small business climate.
ŌĆ£People go to Asheville, Sylva, Waynesville ŌĆö we need to make sure we create that for Franklin,ŌĆØ said Adam Kimsey, the youngest candidate at 27 years old. ŌĆ£WeŌĆÖre not those towns, but we can look at them and take some of those ideas.ŌĆØ
At least two candidates said aldermen needed to cooperate better amongst themselves and with other entities like Macon County. Emmanuel Carrion, a local business owner running for alderman, mentioned the incident surrounding the Nikwasi Mound and discord between county commissioners and town aldermen.
ŌĆ£Collaboration is the key,ŌĆØ Carrion said. ŌĆ£Instead of two bubbles, it needs to be one bubble.ŌĆØ
Mashburn, who is fighting to retain his seat, defended the boardŌĆÖs record at the forum. He said the county and the town have regular meetings and consistently collaborate on a host of issues, like lobbying for or against state legislation.
ŌĆ£The town board has always tried to work with the county when we could,ŌĆØ he said, though his primary reason for running is to improve the townŌĆÖs infrastructure.
Alderman Verlin Curtis, while not running for re-election, defended the townŌĆÖs current direction as well. He said some of the criticism dished out by candidates at the forum was uncalled for. He alleged that candidates who were quick to take jabs at town government were nowhere to be seen when the issues were being debated at town meetings.
ŌĆ£There are some folks who feel like they can do a better job,ŌĆØ Curtis said. ŌĆ£After I listened at the forum, I realized that some of them didnŌĆÖt much know what they were getting into.ŌĆØ
ItŌĆÖs hard to peg whether the election will swing the board one way or another. With so many candidates to choose from, the top three vote-getters could easily be comprised of several different combinations of political ideologies and backgrounds.
That outlook was intriguing to Kristina Moe, a member of the countyŌĆÖs League of Women Voters, a co-organizer of the forum. Moe noted that there are three candidates in their 20s or 30s, several candidates who own businesses and have never been in political office before.
ŌĆ£What impressed me was that there were so many young people running and so many people that hadnŌĆÖt been involved in politics before,ŌĆØ she said.
Mayoral race
Though the alderman races may have a mix of candidates, young and old, the mayoral race is a match up between two of the townŌĆÖs political veterans.
Candidates Sissy Pattillo and Bob Scott have served collectively for nearly two decades as aldermen. Both are 72 years old.
During that time, Scott, retired from a career in law enforcement and journalism, has earned a name for himself as an independent, willing to go against the grain. At a candidateŌĆÖs forum in Franklin last week, Scott touted that record as a reason why heŌĆÖd make a good mayor and leader of the town.
ŌĆ£IŌĆÖve been the lone vote against several issues,ŌĆØ Scott said. ŌĆ£I do not believe in groupthink.ŌĆØ
Though the mayor in Franklin only votes in tiebreakers, they play an important role in setting the tone of meetings and guiding the board members.
ŌĆ£The mayorŌĆÖs jobs is to inspire and motivate,ŌĆØ Scott said.
Pattillo has her own ideas of what it means to lead and shared those with attendees at last weekŌĆÖs forum.
ŌĆ£I also feel like the mayor creates the atmosphere for the town,ŌĆØ Pattillo said.
Tracing her lineage back three generations in Macon County, she believe she would do a good job looking ahead while also acknowledging the townŌĆÖs past. She sees herself as a unifier for Franklin, being able to foster collaboration for the betterment of the community.
ŌĆ£I feel it is very important for people to work together,ŌĆØ Pattillo said. ŌĆ£With collaboration, with all of us working together, we can move our town forward.ŌĆØ
Election forum for mayor candidates
The Macon County League of Women Voters will host a forum for mayoral candidates for the town of Franklin at noon Thursday, Oct. 10, at Tartan Hall.
Longtime mayor Joe Collins is stepping down, and two candidates, Sissy Pattillo and Bob Scott, have decided to run for the position. Both currently serve as aldermen on the town board. By focusing just on the mayoral candidates, the forum will provide for more in-depth discussion by Scott and Pattillo. All are invited, and attendees are welcome to bring a bag lunch.
The League of Women Voters is a nationwide non-partisan organization that focuses on voter education, voter rights, and citizen participation in government and community.
Meet the candidates
Adam Kimsey ŌĆö 27, entrepreneur
ŌĆ£People go to Asheville, Sylva, Waynesville ŌĆö we need to make sure we create that for Franklin. WeŌĆÖre not those towns, but we can look at them and take some of those ideas.ŌĆØ
Emmanuel Carrion ŌĆö 34, business owner
Carrion said he would like to improve the local economy to encourage youth to stay in Franklin and perhaps start their own business. ŌĆ£Without supporting the local businesses, youŌĆÖre not even giving those kids a chance.ŌĆØ
Thomas Ritter ŌĆö 52, architect
Ritter said he would like to see the town invest in improving Angel Medical Center, for economic and health reasons.
ŌĆ£What a frightening thought that I might lose a hour and half of critical time because I have to go to Asheville.ŌĆØ
Barbara McRae ŌĆö 70, retired newspaper editor
ŌĆ£I would like to explore expanding parks and recreation places in town, closer to more people,ŌĆØ like the Franklin greenway, she said. ŌĆ£ItŌĆÖs such a tremendous asset for the town.ŌĆØ
Angela Hubbs Moore ŌĆö 32, stay-at-home mom
ŌĆ£Economic development is best served by reducing the amount of taxes. The free market as a whole will always make better economic decisions than the government.ŌĆØ
Billy Mashburn ŌĆö 61
ŌĆ£I would like to retain my seat specifically because of all the water and sewer issues coming up in the future.ŌĆØ
Patti Halyburton Abel ŌĆö 41, business owner
ŌĆ£Tourism and second homes make up a large part of our local revenue. People come here for natural beauty ŌĆö we need to work with the county to preserve it.ŌĆØ
Mack Brogden ŌĆö 62, retired
Brogden said town leaders need to work to attract new businesses and promote economic growth to maintain a vibrant community. ŌĆ£What I want to see is jobs. You canŌĆÖt thrive on just a retirement community.ŌĆØ
W.H. Derrick ŌĆö 77, retired
ŌĆ£Roads, the infrastructure ŌĆö thatŌĆÖs the biggest. The roads and infrastructure in this town are terrible.ŌĆØ
Marshall Henson ŌĆö 73, retired retail sales
ŌĆ£Something that is not right IŌĆÖm going to be against that ŌĆö spending is the biggest thing, waste. I think we spend a lot of money foolishly.ŌĆØ


text:
I need ideas.
I did give scambled eggs w/ cheese
turkey meat loaf
little pieces of chicken and beef
grapes cut up small
she needs some veggies but spits everything out
anything else thats quick and easy??
she is done with baby food I think.... she wants to feed herself so that what we have started to do


text:
Detail Images
Current Color
Free 2-Day shipping on orders over $50*
Select your style & size:Select options
4 Reviews
The more the merrier.
With Yakima's spacious Sky Box Pro 21 Cargo Box, there's no need to leave anything (or anyone) behind on your next trip. Yakima's largest roof carrier is ideal for hauling gear for up to five campers and works great for large equipment up to 215cm. The Sky Box's quick-release mounting hardware fits most roof bars to provide easy, tool-free installation. Yakima includes an interior cargo pad and gear-management net to help you secure and organize your stuff, and the SuperLatch security ensures the lid stays put and your equipment stays safe. The Sky Box opens on both sides to offer quick and easy access, and the rear of the cargo box is tapered for improved hatch clearance. The Sky Box's new aerodynamic design is 50% stiffer for enhanced handling and reduced drag.
- Aerodynamic design
- Tool-free, quick-release mounts fit most roof bars
- SuperLatch security
- Dual-sided opening
- Interior cargo pad and gear-management net
- Item #YAK0265
Tech Specs
Tech Specs
- Reviews
What do you think about this product?
Have questions about this product?
All of the things!
- Familiarity: I've put it through the wringer
Do you need to transport an adolescent walrus? Maybe bring along an extra vehicle for the road trip? Need a place to crash for a couple nights? Well, the Sky Box 21 won't help you with those things, but there is A LOT of space in this thing. 21 cubic feet, oddly enough.
With two kids and a wife who loves to over-pack, combined with a love of the outdoors, even the SUVest of SUVs can struggle to accommodate. From bike races, to ski and camping trips, being able to pop this on the family car at a moment's notice has turned many stressful incidents into smooth weekends.
It's easy to install/remove, rides quietly on top of the car, and won't let a drop of water in even during the rowdiest of rainstorms.
Contact me at 801.204.4556 or email@example.com to discuss the Yakima product with best fit and configuration for your vehicle and activity needs.
Yakima Skybox
Yakima Skybox install video
This is a great option for more room while traveling with our growing family. It has lots of space and easily survived a road trip from TX to IA and back again without any issues at all. It was easy to install and fit right out of the box on my toyota sienna 2012 xle.
Skybox Video
yakima sky box pro 21
I purchased this box last year. The arm broke inside the box 2 times. The locks are also flimsy and hard to deal with. I'm not sure they should label this box as pro....
It's like an attic for your car
I've been using this box for a few years now. I figure it has about 25K miles on it by now. From Florida to Washington and everywhere in between. I've crammed enough for a family of 3 plus my 2 70lb dogs toys and food. We put a lot of miles on the road with camping and road trips and this thing has never disappointed.
I have this on my Honda Element on factory aero bars and have really put it through some testing. It seems to perform great in windy conditions and I for sure don't take it easy on the gas pedal when we're on the highway. I think it's safe to say you can clamp it down and forget about it.
Some things that might be interesting: Skis up to 182 fit without any problem for me in addition to 3 other snowboards. I think 1 pair of skis and 3 snow boards are probably just about maxed out but I think another pair of skis could be fit if you are a Tetris rock star (which I am, of course)
I'm not incredibly tall, strong or clever and I seem to have no problem putting this on the top of my Elemen without any help, so if you're concerned about it being a pain in the butt to get on and off, it's definitely not.
Is this going to be too big for a VW Tiguan?...
Is this going to be too big for a VW Tiguan?
Using the fit configurator on Yakima, it seems that this box should fit your Tiguan, but it will depend on year, and the type of crossbars you have and such. You can always check out http://yakima.com/fit/Information to fit your car, or ask one of our trusty gearheads.
Will this fit onto a 2005 Ford Expedition...
Will this fit onto a 2005 Ford Expedition out of the box or will I have to get a custom mounting kit? Mine has the fixed side rails and the adjustable (spacing) cross rails.
Hey DaveOntario,
I checked with Yakima and here is what I found:
With Crossbars: Through Yakima, they did not have any Cargo Boxes that would fit the crossbars of a 2005 Ford Expedition with custom modification.
Without Crossbars: If you can take your crossbars off (I have a 2008 Ford Explorer and I can remove them on that vehicle), you open up a few base rack options to get a cargo box up there.
The short answer to your question is if you want to keep the current crossbars, then yes, a custom mounting kit is needed. If not, then you could go with a base rack/crossbar system from Yakima along with the Yakima Sky Box Pro 21 Cargo Box. If you are interested in going with the custom kit, I would contact Yakima directly. If not, please use the fit guide on the Yakima website to pick out exactly what you would want for a base rack/crossbar system.
I received my skybox 21 and it fit (out of the box) onto my 2005 Expedition. I haven't driven with it on the highway but it seems solid.
What it the difference between the Yakima...
What it the difference between the Yakima Sky Box Pro 21 and the Yakima Sky Box 21? I don't see any difference except maybe the colors
Hey Dave,
The finishes used on the two boxes is where they differentiate. The finish that is used on the Pro series is a higher quality, automotive type finish that includes a better scratch-resistant protective coating. Also, the Pro comes with an integrated gear management system along with the cargo net.
I'm getting one of these but can't decide if the Pro features are worth an extra $120 - can anyone provide thoughts on that and why?
I have a 2010 GMC Yukon XL with a manufactured...
I have a 2010 GMC Yukon XL with a manufactured sun roof, satellite antenna and manufactured roof rack. Can you provide as much information for the model that we could get the most for my family of 7.
If by "get the most for" you mean size, then you will probably want to go with either the one above or the Thule Atlantis 2100 XT. They're both 21 square feet, which will add a lot of space! Personally, I usually prefer Thule, which is the one on sale in this case. The Yakima one does have a lifetime warranty as opposed to the 1 year warranty from Thule. The Yakima one has a new, more aerodynamic design to reduce the drag you feel from it being on top of your car. Essentially, they will do about the same thing, so it comes down to preference and price.
We have a chevy tahoe. Would it be possible...
We have a chevy tahoe. Would it be possible to mount two of these side by side? I swear I have seen it before.
It is technically possible, but it depends on your exact configuration and isn't generally recommend, so I'll give you some things to consider.
The width of this box is 36", plus you'll need some room between the two to allow for easy opening. The classic Rocket Box is only 24" wide, and might be the box you saw doubled up in the past.
Depending on the type of towers/mounts you have for your crossbars, you should be able to mount the box so one side of it sits outside of the side rails of your tahoe. This means you'll need long enough bars, and it will overhang the side of the vehicle.
Another problem with two boxes is weight. Most base racks are rated for about 150lbs. The Sky Box 21 weights 62lbs, so with two you are already at 124lbs which doesn't leave much for cargo.
Without knowing your exact situation, if you aren't using your hitch for anything, I would recommend looking at a hitch mounted cargo box (Thule makes a couple) or other type of hitch carrier instead of the second box. It may be time to get a trailer instead.
What is the difference, aside from the...
What is the difference, aside from the price between the Yakima Sky Box 21 and the Yakima Sky Box Pro 21?
Besides price and the name of Pro, you get some other great features with the Pro Model that you do not get with the Regular Sky Box. Though both are great products, the Pro includes a Pad on the inside to keep things quiet and riding smoothly in side the box and also a Cargo Net to keep everything in place. You move, but your gear stays in one place. The other difference is that you get an automotive grade "Paintable ABS" material that you could paint to match your car, but it comes in two great silver or Platinum colors that you may never want to paint it to match your car. The smooth finish also makes it easy to clean off the bugs you destroyed while out enjoying life instead of watching everyone else have the live you only dreamed of having.


text:
Directorate Of Technical Education
Maharashtra State, Mumbai
Application Procedure
Candidate Registration
Candidate Login
Institute Login
Contact Us
About DTE
Regional Offices
Search Registered Institute
List of Institute with Code
Search Application ID
Important Link's
Merit Cum Means based Scholarship (MCM) of GoI
State Govt. Scholarship (SGS) of GoM
Employment Oriented Training Programme (EOTP) of GoM
Read more...
Provision of Undo Scruitiny Option in SGS.
Undo Scruitiny Option is provided in Institute Login. If Institute has done any mistake in a Scrutiny of State Government Scholarship application form than they can correct it by using Undo Scruitiny option.
Filling of Application Form-2016-17
Institute has to Inform to all Eligible Minority Candidate for Filling the Minority Scholarship Application Form-2016-17 without waiting up to the Last date. So that the process of scholarship disbursement can be started as early as possible.
It is to inform that to get faster access to the National Scholarship Portal (www.scholarships.gov.in) kindly use Mozilla Firefox Browser instead of Google Chrome. And for State Government Minority Scholarship (www.dtemaharashtra.gov.in/scholarships) use Google Chrome or Internet Explorer.
National Scholarship Portal (www.scholarships.gov.in)-Merit cum Means Based Scholarship of Government of India-2016-17
On National Scholarship Portal, By Central Ministry ,There are two options provided under drop down for applying Scholarship. 1. Pre Metric scholarship and 2. Post Metric Scholarship. Merit cum Means option is covered under "Post Metric Scholarship " hence Candidate has to Select the Post Metric Scholarship for filling the application form of Merit cum Means based Scholarship of Government of India.
Merit cum Selection List-SGS-2015-16
Merit cum Selection List of State Government Scholarship-2015-16 is Generated.Candidate can Check Scholarship Status through their Application Id.
Aadhaar Number (UID)
Update option for Aadhaar number of candidate is given to Institute in their login.Institute has to Update the Aadhaar number of candidate and inform to the candidate for linking with their Bank account.
Disbursement of Scholarship-2014-15
MCM-Scholarship transfer directlly by Central Government in candidates valid Aadhaar /Bank details.And SGS-Scholarship is transfer through Directorate of Technical Education in candidates vaild Aadhaar/Bank details.
Helpline No.
Before calling on Helpline No.or Directorate office,Student/Institute has to refer the Online Status of his/her application Id.All details are (Selected /Rejected, Scholarship Transation succeed/failed with reason) available on website.
Use Browser
Use Internet Explorer
Minor-Major a/c in bank.
At the time of opening of the bank a/c,if the candidate is Minor(below 18 year) and now the candidate is Major(above 18 year),contact to bank for necessary changes if still a/c is minor in bank for E-transfer.
For Merit cum Means based scholarship-www.scholarships.gov.in and for StateGovt.Scholarship- www.dtemaharashtra.gov.in/scholarships
LoginID(User Name) and Website for Institute.
LoginID(User Name) and Website for both the schemes i.e.Merit cum Means based scholarship(of GoI) and State Govt.scholarship (of Maharashtra Govt.) are different and for both schemes,User name(LoginId) and password are provided to that Institute whose name is in registered Institute List.
Renewal and Fresh scholarship.
The eligible candidate who has got one type of scholarship can apply as a RENEWAL for that type of scholarship only.Other candidate can apply as a FRESH scholarship.
Types of Scholarship schemes for Tech. and Prof.courses.
Both types of Scholarship scheme i.e.Merit cum Means based scholarship and State Govt.Scholarship scheme are different one.One who has got one type of scholarship can't apply for Renewal in other scholarship,they can apply as a RENEWAL in same type of Scholarship.If want to apply in other type of scholarship, they can apply as a FRESH scholarship.
Forgot password
INSTITUTE that comes under DTE can give a password to candidate who has forgot their own password through INSTITUTE LOGIN and on clicking retrive password in a institute pannel.
IFSC Code in Bank Details
IFSC Code of bank branch is compulsory for Transferring of Scholarship Amount
In case of Joint Account
First name should be the name of the scholarship holder in bank in case of Joint account.
Opening of Bank A/C
The name on account should be match with the name as in application form submitted by the candidate for scholarship.
Address of Regional Offices of DTE
For address click on Regional Offices. Link:http://www.dtemaharashtra.gov.in/ Scholarships/frmRegionalOffices.aspx
Check Application Status
Enter Application ID:
Academic Year :
Select Academic Year
2009 - 2010
2010 - 2011
2011 - 2012
2012 - 2013
2013 - 2014
2014 - 2015
2015 - 2016
2016 - 2017
Check Application Status
© 2010 Copyright Directorate of Technical Education Maharashtra State.
Helpline No : (022) 22617969.
Use Internate Explorer only.


text:
Jonathan Groff's "friend" is C.O.G. writer-director Kyle Patrick Alvarez, a hot young filmmaker on the rise and prominent gay.
*eye roll* I guess this is important to someone somewhere.
His persistent efforts to be doing SOMEthing gay is actually starting to get on my last nerve. I usud to like him, but it's like he's becoming the "guest that won't leave". It feels like he's appropriating gay culture.
@n900mixalot: MY THOUGHTS EXACTLY!! I CAN'T STAND JAMES FRANCO!
@MikeE: What's worst, is that he thinks he is cool enough to appropriate gay culture.


text:
"I was raised Evangelical and just recently started looking, with an open mind, into the Catholic Church. You guys have been instrumental in my leaning more and more towards coming home to the Catholic Church."
~ Jacob
0 results sorted by popularity
"These are the living springs of great thoughts and great actions. Everything grows clear in the reflections from the Infinite."
~ Louis Pasteur, founder of physio-chemistry, father of bacteriology, inventor of bio-therapeuties; devout Catholic


text:
By Kevin Wilson: CNJ Staff Writer
Local agents are suggesting investors stand pat and enjoy the ride after the Dow Jones Industrial average closed Thursday at a record high for a third straight day.
Dean Turvaville of Edward Jones Investments in Clovis said the Dow's gains are the rewards for investors who put faith in high-quality American companies.
"I think the economy is poised to continue to be very strong," Turvaville said. "It still is a good time to invest. Who's to know that today's record isn't tomorrow's history? We feel (the stock market is) an excellent place to invest."
The blue chip index traded up to 11,870.06, which stands as its trading high.
A recent drop in energy prices is credited with some of the economic boom, but rising oil prices didn't smother investors' good mood.
The blue chips have gained 196.34 over the past three sessions; on Tuesday, the index shattered closing and trading highs that had stood since Jan. 24, 2000, which was toward the end of the dot-com boom.
While not all of his clients will have stocks that make up the Dow Jones Industrial Average, Clovis agent Richard Barris said many clients' stocks are going up as a result.
"We have a rising tide, it raises all boats," said Barris of H&R Block. "When the Dow goes up, most of the other stocks will go right up as well. However, you don't realize any gain or loss until they do sell those positions."
To sell or not to sell is the question for most investors. Barris said for the most part, clients are advised to stay in the market. When people are advised to sell, Barris said, it's primarily because they have a small horizon, or amount of time to build wealth for retirement purposes.
"If you're nearing retirement, selling's a good option to take immediate gains," Barris said. "If you're 25, you'd want to hang on because your horizon is so much further. Over time, the stock market has outperformed other investments."
Just where stocks are in their long recovery from their 2002-03 lows remains a topic of debate on Wall Street.
Some traders have questioned the depth of the rally, saying technical markers such as the ratio of advancers to decliners are weaker than they've hoped. And while the Dow has recovered, the S&P 500 still remains more than 11 percent off its all-time high.
Other traders say the market's biggest fears — high energy prices and additional rate hikes by the Federal Reserve — are behind it, leaving room for a greater run-up in stock prices.
The Dow Jones Industrial Average is one of several stock market indices created by Wall Street Journal editor and Dow Jones & Company founder Charles Dow. The figure is a weighted average of 30 of the largest and most widely held public companies in the United States.
Barris and Turvaville said the main impact eastern New Mexico has on the Dow Jones Index is passive, with some of the companies profiting through local consumers. Notable Dow Jones companies include Wal-Mart, McDonald's, Coca-Cola and Boeing.
The Associated Press contributed to this report.


text:
8 May 2013 22:08:56
NMM UI redesign mock ups for your considerationposted by Dark0ne Game NewsI thought I'd share with you some preliminary, non-final mock-ups that we've been working on with some professional web/graphic/software/UI designers over the past few weeks for the Nexus Mod Manager in the hopes of not only preparing you for the shock of the change but also to get some feedback.
As I've said all the way through the life-span of NMM how NMM looks is most definitely not final. Before I will stick that coveted 1.0 version number on to the software that indicates it's out of beta it will most definitely be going through a face-lift, and it's going to be a face-lift that completely changes the look of the software from a "my first .NET coding project" look to a "yeah, this might be going somewhere" look.
At the moment NMM isn't the prettiest of software but it does pay homage to the grassroots of the software and that cliched "made by modders, for modders" look to it that suggests functionality and simplicity was more important to the author than snazzy superfluous graphics. However, going hand in hand with our current focus on shifting the Nexus from supporting a handful of games to supporting all games I'd like to work closer with some developers to integrate their games better into NMM right from the get-go. Fact is, it's actually very easy for us to add support for most games in to NMM but (a) we don't have Nexus sites for the game and (b) if you show a developer NMM, on first sight, it doesn't give off the best impression. We're in the process of sorting out (a) already, and now we're in the process of sorting out (b) as well. Ergo what we really want to do is give NMM a face-lift that makes me happy, makes you happy and makes game developers happy to endorse it while, hopefully, improving the experience for everyone.
It's my hope that you'll look at these mock-ups and think "Wow, it's changed, but actually, a lot of the stuff is in the same place, it just looks different". I want you to be able to open it up and not spend minutes trying to find features you used to be able to find easily out of habit. In all honesty the current NMM design is horrible in this regard for new-comers and has heavy "mystery meat" UI elements that mean you don't have a clue what a button does until you press it and find out. Of course, you're used to where everything is in NMM now, and hopefully with this new UI you won't be doing too much (or any searching) to find the functions you use in the current UI.
I'm sharing these mock-ups with you to not only show you what we've come up with so far but also to get your opinion. Unfortunately opinions on massive changes like this can sometimes be extremely dividing and it can be very tough for me to sift through the honest, proper critiques, criticisms and feedback that I really want to pay attention to and the "haters gonna hate, being bitter about change for the sake of being bitter" category of person who's just going to dote on hate just because they're that kind of person. So if or when you provide feedback on the mock-ups please try to take that into consideration, for my sake. Are you providing valuable, useful feedback that I can use or are you just a hater with nothing worthwhile to say? Show enough hate and I will just hide your comment as it'll be unhelpful to the process and clutter up the feedback I actually want to be looking at. You can dislike it, but you've got to give good reasons why. How would you change it? What would you do when "don't change a thing" isn't an option?
We also want to try and maintain as much roll-back functionality as possible with NMM. We provide users with a large number of our previous versions that you can roll-back to at any time if you don't like what we've done. We don't stop you from doing that like most others out there, but if you stick to older versions and avoid getting used to new versions then you are going to miss out on new functionality, bug fixes and the like. That's completely your choice.
So without further ado here are the mock-ups. Remember these are preliminary, unfinished, and things like wording (and spelling mistakes) are most definitely not final.
Loading splash screen
Game detection screen
Installed mods screen
Download manager
Plugin manager
Settings window