Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I get 'Server Connectivity' error at google webmaster tool. I suspect it is because of iptables rules that I've set to counter some DDoS attacks, thugh I'm not sure which rules could be relevant. This may also help to know that I use Varnish/nginx combo as webserver and a standard robots.txt.

Here are the iptables rules

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh

DROP       udp  --  anywhere             anywhere            udp dpt:fsp
DROP       tcp  --  anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP       all  -f  anywhere             anywhere           
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
DROP       udp  --  anywhere             anywhere            udp dpt:54243 
DROP       udp  --  anywhere             anywhere            udp dpt:53331
DROP       udp  --  anywhere             anywhere            udp dpt:19147
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:11211

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I appreciate your hints to resolve this.

share|improve this question
add comment

1 Answer 1

You're really letting the whole world access your memcached?! And for that matter practically everything else, since you're only dropping traffic on a few ports.

I would suggest you drop that entire configuration and generate a fresh one using a tool such as system-config-firewall-tui (CentOS 6) or shorewall (any distribution).

share|improve this answer
    
Thanks for raising the red flag. However it goes offtopic, but how can I limit the access assuming that my IP is 11.22.33.44? –  alfish Jul 24 '12 at 1:02
    
Your IP doesn't really matter. What you do is to decide what services need to be accessible, permit those, and deny everything else. –  Michael Hampton Jul 24 '12 at 1:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.