Tag Info

Hot answers tagged

58

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


47

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


30

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


18

Since the release of RedHat/CentOS 7, the previous firewall system has been replaced with firewalld. At the time of writing there is no curses-like console interface similar to system-config-firewall. If you don't mind using a GUI you could use firewall-config instead. If you need something for the console you will have to use firewall-cmd instead. For ...


11

What mfinni said, except that we forward three ports to a behind-the-firewall all-in-one Exchange box: 25: SMTP 80: HTTP (redirect to OWA HTTPS) 443: HTTPS This works fine for people with Androids, iPhones, etc. Generally, people at home use OWA or their phone, anyway. Edit: Since you asked for a Microsoft source, this is a link to a TechNet ...


10

Yes, of course. The job of a monitoring system is to ensure that the business requirements are currently being met by the IT infrastructure, whatever those requirements are. My gut feeling is that there's no easy limit (well, 65535) to the number of ports you're monitoring to ensure that they don't suddenly become open, and that the best way to achieve ...


9

I wouldn't trust that machine anymore, and would reinstall and probably scan for rootkits (some rootkits even survive formatting of a drive). If you care about security, my personal advice would be to restart fresh.


9

That looks mostly correct for a wide-open all-protocols implementation. Some suggestions: Unless you have mail clients, with a business justification, that require all that, limit it to just 25, 80, 443. Don't allow POP access, that's a plaintext password. Don't allow client SMTP access, that's a plaintext password. (Of course, to accept mail from the ...


9

This is what the nmap docs say about the filtered state filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software... The only way to find out what is doing the filtering is to know ...


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


7

The problem is that you can't refer multiple IP ranges in a single iptables rule, but using multiple rules indirectly leads to a disjunction (logical OR): connections will be logged if they match your first, OR your second rule. What you want, is a conjunctive behavior (logical AND): new connections coming out of 10.51.0.0/16, AND also out of ...


7

According to the Manual 8 0 "Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with later settings overriding earlier ones. Thus, a .local file doesn't have to include everything in the corresponding .conf file, only those settings that you wish to override. Modifications should take place in the .local ...


6

Incoming connections are always going to match one of those rules aren't they? A connection from 10.51.0.1 for example won't get logged by the first rule but will hit the second one. Don't you need the equivalent of !10.51.0.0/16 && !192.168.0.0/16 (probably not valid syntax but correct logically).


5

You can't do this at the firewall layer (well, you can - but it won't accomplish what you think it will, nor what you want). The second packet (which you desire) is part of the same TCP stream as the first packet (which you don't want), and TCP is a reliable delivery mechanism. That means that the OS knows if a packet in the middle of the stream has gone ...


5

Short answer - No, there is no way that you can see it. Longer answer: From: https://nmap.org/book/man-port-scanning-basics.html "filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall ...


5

Nmap provides several ways to get more information about what is causing the filtering: The --reason option will show the type of response that caused the "filtered" port state. This could be "no-response" or "admin-prohibited" or something else. The TTL of response packets is reported in the XML output as the reason_ttl attribute of the state element for ...


5

Status code 304 means the cached copy is still up to date, and no data was sent to the client. You'll see that the byte count is small for all the requests with status code 304 and about the size of the file for all the requests with status code 200. But transferring 200KB of static data should only take a fraction of a second, if you have a decent ...


5

IIRC iptables rules are order dependent: if the first rule matches, it won't parse any more. Reverse the order and you should achieve what you're trying to do. Extension: it is not always so, some rules (f.e. -j LOG) allows the packet processing to go further. But the common ACCEPT, REJECT, etc. rules aren't. Best if you see iptables as if it were a ...


5

You mean e.g. iptables -F INPUT iptables -I INPUT 1 -j RETURN From man iptables: If [...] a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet. The chain policy is set with iptables -P, and can be found at the beginning of the output of iptables -L -n -v, eg: Chain ...


4

Here are some commands with descriptions below that I came across and were helpful firewall-cmd --state view status of firewalld service (systemctl status firewalld) firewall-cmd --zone=public --list-all gets all info for the “public” zone firewall-cmd --list-all-zones shows all info for all zones firewall-cmd --zone=public --add-port=80/tcp ...


4

The website-based login screen is called a captive portal. It usually needs to be set up on the gateway/firewall that provides internet access.


4

Ping uses the ICMP protocol, not TCP. Routing tables are not involved in intra-subnet communication, unless you meant security groups.


4

Is there any damn documentation and where is it hiding? There are examples on the netfilter site which help explain the functionality. Here is a function I wrote in my own code that sets up the netfilter NFLOG. Here are the examples they provide: http://www.netfilter.org/projects/libnetfilter_log/doxygen/files.html void setup_netlogger_loop( int ...


4

An iptables DROP policy is equivalent to iptables -A INPUT -j DROP (DROP rule) at the end of the chain. But this rule must stay at the end of the chain, any rule after it will never get touched by any packet. If you use the DROP rule, you cannot anymore use iptables -A (append), you can only use iptables -I nr (insert, nr is the number of the last rule) and ...


4

I used chain which logs everything with limits so it won't spam your syslog $IPT -N DUMP > /dev/null $IPT -F DUMP $IPT -A DUMP -p tcp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "TCP DUMP: " $IPT -A DUMP -p udp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "UDP DUMP: " $IPT -A DUMP -p tcp -j REJECT --reject-with ...


4

If you're trying to mitigate DDOS attacks, then you need to have your ISP block the bad actors at their level. Once the DDOS traffic has hit your router/firewall/server, it's already eating up your bandwidth.


4

Notice the line in your netstat output ... tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 18843/nodejs Specifically the local address of 127.0.0.1:8080. That means that nodejs is only listening on the localhost address and so only will accept connections from the same machine. I don't know (off the top of my head) how to ...


4

Well, first off, relying on MAC addresses as identifying information is not a good idea - they can be trivially changed by the user. Regarding SLAAC, as you've found out, it's very much not suited for an environment that you need control over. As such, consider switching to DHCPv6. Once you've switched to DHCP, the solution to your MAC address problem is ...


4

If you want to connect via SSH to a computer behind the firewall, then you will need to add a port forward (DNAT) rule to the firewall mapping port 22 (or whatever port you decide to use) to the SSH port on the internal server. TeamViewer is able to get through by using techniques such as NAT Traversal and UDP hole punching to establish a connection through ...


4

There is no charge for the Google Compute Engine ingress traffic. Take a look at GCE network pricing. If you've been charged for the ingress traffic, you can contact the Cloud billing team to clarify and fix the charge. Regarding the requests to port 11, as far as this port is blocked in your GCE network's firewall your VM instances should be safe and the ...



Only top voted, non community-wiki answers of a minimum length are eligible