Hot answers tagged

41

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it. Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the hostname gets displayed and long ones get truncated to display nice columns. Try last -a to display the hostname on the last column without truncation. or ...


11

You don't need ssh access, Digital Ocean provide console access to your system. You can use this to log in and fix your rules. To access the console click Droplets -> Name of your system, this will take you to a page with a large friendly blue button called Console Access. Click the blue button to get a console. Once you're in, you can change the rules ...


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


8

This is almost nothing to do with being on an ESXi host - it's a routing issue - you just need two separate VLAN coming from your router, both of which have external routes out and no routing between them. Then simply trunk these VLANs to your ESXi uplinks and create two VLAN tagged port groups in you vSwitch/es. It's as simple as that.


7

Example for SSH in interactive mode. type in bash: fail2ban-client -i then in interactive mode type: status ssh you'll get: Status for the jail: ssh |- Filter | |- Currently failed: 0 | |- Total failed: 6 | `- File list: /var/log/auth.log `- Actions |- Currently banned: 1 |- Total banned: 2 `- Banned IP list: 203.113.167.162 then ...


6

The -i makes 'last' show the remote hostname in dots and numbers IP address format instead of trying to display the hostname. I am not sure what the '.d' suffix is, nor can I find out anything on google. I can only guess it is trying to do a reverse lookup and is giving you part of a hostname and truncating it, although i thought you must specify -d to do ...


6

Your 'when' column is telling me that ntp last chatted with those servers at best 40 minutes ago, yet your poll interval is 1024 seconds (~17 minutes). ntp does not seem to be running properly, which makes sense given your firewall configuration. You'll need an outbound and an inbound allow rule for UDP 123. The inbound is needed since UDP is stateless. ...


6

ufw firewall, by default, denies any incoming connection (and allows any outgoing ones). You would have to connect your server to a display (since you cannot access remotely with the firewall), and follow these steps: sudo ufw disable --> Now you can access your server by ssh if you prefer sudo ufw allow from <specific ip/subnet> to any port <port ...


6

With the -p tcp option the tcp module is already loaded and therefor it is somewhat redundant and not a must to use the -m tcp option and I don't see any reason why using this option would make the rule more secure. Please see the iptables man page for a better understanding and comparison: -p, --protocol [!] protocol The protocol of the rule or ...


6

Remember that localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system so you have worse problems to deal with.


5

The answer is way more complicated than ASN 15169. First Google has more than one ASN: 15169 Google Inc. 16591 Google Fiber Inc. 36039 Google Inc. 36040 Google Inc. 36384 Google Incorporated 36492 Google, Inc. 41264 Google Switzerland GmbH Second, Google, Akamai, etc use IP ranges of their partner ASNs to host content. So ...


5

Does the order of the rules actually matter? Yes it does. Denies should be first. Example Is there a more effective way to handle spammy requests than manually fail2ban can scan logs, and add IPs to many types of filtering systems that match defined patterns.


5

Actually the ports you mentionned, 465, 995 and 993 are deprecated and should no more be used. See RFC2995 section 7 imaps and pop3s ports Separate "imaps" and "pop3s" ports were registered for use with SSL. Use of these ports is discouraged in favor of the STARTTLS or STLS commands. A number of problems have been observed with separate ...


5

See line 3, 4 and 5 in INPUT chain - those rules allows any packets for any ports comming from interfaces eth0, eth1 and lo to pass. IPTables works with first-match-rule, so when packet gets first rule which allows/deny it, it is applied. You should set only rules to exact ports and reject any other traffic.


5

Windows Server 2012 has a built-in firewall, which can be managed from either GUI (running wf.msc) or PowerShell, using Network Security Cmdlets.


5

You need to open endpoints for the services you want to make accessible from the Internet. In the old Azure portal these are listed under Endpoints. In the new portal under Inbound Security Rules.


4

You're conflating a few different things here, and I suspect it's leading you to some false conclusions. HSTS ("HTTP Strict Transport Security") is (only!) about mandating that HTTPS is used for connections to specified sites. It doesn't enforce anything about which keys, certs, etc are used to authenticate the connection. Public Key Pinning specifies ...


4

4 :INPUT ACCEPT [0:0] 5 :FORWARD ACCEPT [0:0] 6 :OUTPUT ACCEPT [0:0] (snip) 11 -A RH-Firewall-1-INPUT -s 192.168.1.114/32 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT You're using an undefined chain (RH-Firewall-1-INPUT). It seems you copy/pasted the ACCEPT rules from some website without understanding what it actually does. That's......


4

well if you use telnet command to check the port connectivity, it will show "connection timeout" if the port is blocked by the firewall "Connection refused" if the service is down/not listening on specified port, but port is reachable. "connected to server_ip" if connection is successful


4

Running things via VPN is essentially slower due to the additional network hops and encryption. If you must use a VPN, consider where the VPN is located (latency purposes) and the speed your getting from the connection.


4

When you set your default policy to DROP and ACCEPT only what you need, this is clearly more secure than allowing everything by default and selectively DROP unwanted traffic types. This at least saves you from securing the services that are not meant to be accessed remotely (from outside your machine or your LAN). Your system is more secure when you expose ...


4

Do not block all the outbound rule, it will not choose port 443 as a source to get data from other server. And I think blocking inbound rules are pretty enough to ensure your server security. Rest is all Good. You can use below rules if you want. iptables -F iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ...


4

First Step block DNS TeamViewer client using port 80 for the outbound connection, it is difficult to block using port basis. So, because TeamViewer client must be connected first to the TeamViewer server, we can use another aproach, that is blocking every dns request for the *.teamviewer.com and/or *.dyngate.com. Second Step block IP Address Range The ...


4

tcp/53 DNS tcp/88 Kerberos tcp/135 RPC tcp/445 sysvol share tcp/389 LDAP tcp/464 Kerberos password (Max/Unix clients) tcp/636 LDAP SSL (if the domain controllers have/need/use certificates) tcp/1688 KMS (if KMS is used. Not necessarily AD, but the SRV record is in AD and clients need to communicate with the KMS). tcp/3268 LDAP GC tcp/3269 ...


4

You can use IPTables for it, just set allow rules for your whitelisted IPs and reject all others.


3

The message is normal because ALTQ is not compiled into the stock FreeBSD kernel. Unless you need to use ALTQ it doesn't matter. The start up of the firewall interrupts all current connections, including your ssh session, which stops responding. Just open another terminal and log in again. The original session will eventually time out. It's a good idea to ...


3

You first need to get the name of the jail. You can get the list (in most cases it will be only ssh jail): fail2ban-client status After getting the jail name you can check which IPs are being ignored. fail2ban-client get ssh ignoreip If your IP is in ignore list, you can delete it via: fail2ban-client set ssh delignoreip your_ip_address vi /etc/hosts....


3

Get a scan triggered at a time you've got a tcpdump running on the server, watching for all packets from the whitelisted address. If there are no packets, it isn't a server problem (could be you've got an upstream firewall issue, or the scan provider's given you the wrong IP to whitelist). If you do see packets, what they're doing will give you a good ...


3

Did you issue the following commands? Enable the HTTP server for ASDM http server enable Allow the management host(s) to access ASDM http management_host_ip mask interface_name After doing the above in configuration mode, access ASDM from Firefox browser (you need to have Java JRE and Java browser plugin installed) using the URL https://<...


3

The first rule just accept RELATED and ESTABLISHED connections, not NEW ones. You have this rule probably because you're blocking everything and just allowing some services, like HTTP, DNS, etc. At the end, everything that doesn't match any previous rule will be dropped.



Only top voted, non community-wiki answers of a minimum length are eligible