Tag Info

Hot answers tagged

53

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


42

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


29

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


4

If you're trying to mitigate DDOS attacks, then you need to have your ISP block the bad actors at their level. Once the DDOS traffic has hit your router/firewall/server, it's already eating up your bandwidth.


4

Notice the line in your netstat output ... tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 18843/nodejs Specifically the local address of 127.0.0.1:8080. That means that nodejs is only listening on the localhost address and so only will accept connections from the same machine. I don't know (off the top of my head) how to ...


3

Try this command firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \ source address="1.2.3.4/32" \ port protocol="tcp" port="4567" accept" Check the zone file later to inspect the XML configuration cat /etc/firewalld/zones/public.xml


2

A general way to fix a broken instance is to shut it down and attach the root volume to a working instance. You can then mount the volume there and view logs or edit configuration files. You can then detach the volume and start it up in its own instance.


2

Formal answer: go to VPS management panel, get local access (virtual KVM) somehow or call them. Explanation of steps/rules to prevent falling for it again: There are ip, routing and firewall rule changes that may go bad and block your access. and it applies to dedicated network device configuration too, not to VPSes only So unless you are 100% sure that ...


2

Portspoof is a tool which will allow you to emulate a lot of services listening on a large number of ports. Its primary use is to confuse port scan attempts, but it may also fill your needs.


2

There are several protocols that Git can use, which are documented here - the most common of which is SSH, which is used on GitHub (both public and Enterprise flavours) as well as Gitosis and Gitolite. To use Git over SSH, you will need to open port 22 outbound, and to use the much rarer Git protocol, you'll need to open port 9418, which you already have, ...


1

I found this answer on the forum: In order to get FTPS (secure FTP over SSL) to work, I had to create two packet filter rules (Network Security -> Packet filter) Internal Network -> Any (Service: FTP, port 21) and Internal Network -> Any (or the IP of the FTP server) (Service: FTPS data port range, 9000-9015, or whatever your server ...


1

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces. firewall-cmd --new-zone=special firewall-cmd --zone=special --add-source=192.0.2.4/32 firewall-cmd --zone=special --add-port=4567/tcp Add --permanent of course to make them permanent.


1

The name of the munin plugin is a bit unfortunate, because it doesn't really measure anything directly related to firewalling; it shows how many packets are received by the system on any interface, and how many packets are forwarded through the system. Hence it doesn't matter how many firewall rules (if any!) you have. It examines the file /proc/net/snmp and ...


1

All you configuration looks fine and I can see that you have only allowed desired traffic to your servers using ACL. If you would like to anyone to be able to ping your server on public IP interface, you will need to add below ACL: access-list OutsideToInside extended permit icmp any any Or you can choose the servers instead of allowing ping to all/any.


1

I have found the solution! Indeed I had to extend my access-list on my outside interface!!! I have succeeded using ASDM. First I created a NEW network object for each of my servers. When you create a new object you will be asked for the internal IP address and "this is where the magic happens" you have to set the NAT IP address (the external address) !!! ...



Only top voted, non community-wiki answers of a minimum length are eligible