Tag Info

New answers tagged

0

Your Dallas default gateway device needs a static route directing the Ft. Worth SSL VPN subnet via the Ft. Worth VPN endpoint.


0

Two thoughts: 1) Do you have services running on those other ports? (netstat -an) 2) Is the server hosted somewhere, like a home ISP, that doesn't allow incoming connections on those other ports?


0

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT All that command does is add a rule allowing SSH connections over tcp port 22. You need to: -Load the state module iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -Set the default policy on a chain iptables -P INPUT DROP -Set default policy to drop iptables -P FORWARD DROP -Then ...


0

Its been awhile since I've done iptables but I think you want to have a rule that always allows established connections: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT See this post: What is "state RELATED,ESTABLISHED" in iptables?


1

Simplified explanation: The ISP routes traffic for the 82.5.167.160 network to the router, the router is connected to the 82.5.167.160 network on it's LAN interface so it accepts this traffic, it knows that the firewall is also connected to the 82.5.167.160 network (on it's WAN interface), it therefore routes traffic for the 82.5.167.160 network to the ...


0

The Watchguard has HTTPS full-content inspection in the same way by installing an SSL certificate and doing a Man-In-The-Middle (MITM) attack on all the traffic, but it can blocking domain names without resorting to that by looking at the Server Name Indicator field sent out by the browser so the server can identify which SSL certificate to answer with, and ...


0

You can't allow them through because they aren't trying to go through, they are trying to hit the Watchguard. So you could allow UDP port 8612 from Trusted to Firebox and they would stop showing up in the logs, but it wouldn't do anything because the firewall isn't going to answer Canon printer software discovery messages.


0

Just use the Windows Firewall. In Windows 7 you can use netsh to configure it. Put your netsh commands in various batch files and then use Windows Task Scheduler to run them at desired times.


0

I would first confirm the request are being serviced by the web server you expect. Enable verbose logging for that web instance in IIS. Start-Control Panel - Admin Tools-IIS Manager. Review log settings and verify path. Examine log; verify fields that are enabled. Execute a call from a client that has success to the site/page; then do the same test ...


1

Without knowing the specific equipment I cannot provide concise instructions. You can configure your sonicwall to use 1 IP for the default gateway and a separate IP for your VPN connections. You also should implement QOS on your network http://help.mysonicwall.com/sw/eng/216/ui2/29/config/qos.html If you tag and prioritize your traffic you can set critical ...


1

It may seem counter-intuitive but only packets that conntrack doesn't know about go through the NAT table. This makes attempting to use string matching problematic for NATing: by the time the string appears in a packet the connection is already established. Usually using iptables string matching is ill-advised and you should do something at a higher layer ...


0

This is in the comments, but posting out as the answer I've not used that firewall before but on netgears there is normally a screen for outbound rules. You need to make an outbound rule . Lan User (LAN IP of mailserver) Wan User (Any) NAT IP (Enter the 118 address). Effectively what has been done is to create an outbound Nat on the firewall. So ...


0

You are using the recent module to dynamically maintain a list of IP addresses for each connection attemp to port 22 and refuse IPs trying to connect more than 4 times in a minute or using changing TTLs (note: this last check could cause trouble to legitimate connections too in some cases). However, you are doing it wrong because you are not adding them ...


0

There is no reason why you would need to use both devices as routers, and I would strongly advise against running DD-WRT or any custom firmware in a work environment. You need to pick one or the other and use that as your router, so assuming you use the ZyWall device: Your Comcat WAN would connect to WAN1 Your switch would connecto to LAN1 Your PCs would ...


0

After some discovery and reading my conclusion is that you must be a very brave man to attempt this and this setup should be avoided at all circumstances (we did)


0

As you said, you have the default chain policy set to DROP. So, you need to have explicitly ACCEPT rule for each type of traffic you want to allow. The following rule will allow traffic passing through your box coming from lan0 interface and going out of interface wan0. iptables -I FORWARD -i lan0 -o wan0 -j ACCEPT Also, it is a good idea to allow other ...


0

I just went through this same issue. The fastest possible solution would be to avoid downloading the entire source and uploading it again. First step is to make note of the affected VM's OS disk name and the name of your VM. Then create a recovery VM, it must be created inside the existing cloud service. Once that has been completed, delete the ...


1

The correct syntax, as described in the firewalld.richlanguage(5) manpage, is: # firewall-cmd --zone="FedoraWorkstation" \ --add-rich-rule='rule family=ipv4 source address=1.2.3.4 service name=smtp reject' success # iptables-save | grep 1.2.3.4 -A IN_FedoraWorkstation_deny -s 1.2.3.4/32 -p tcp -m tcp --dport 25 -m conntrack --ctstate NEW -j REJECT ...


0

Connect your Modem to the WAN port of your firewall. This will allow you to set LAN-WAN rules (for example drop all trafic where source != 192.168.1.z ). BTW. If your have connected all devices do LAN ports on your ZyWALL and it's working as a switch on those ports, then they will be able to connect regardless of your LAN-to-LAN rules. To allow to filter ...


1

As stated in the comments: Check with another computer to see if the problem appears in other computers If it is the case check the configuration of the port this computer was plugged, as probably is configured in another VLAN.


0

Is kernel module nf_conntrack exist at /lib/modules//kernel/net/netfilter/ and loaded? If exist try: modprobe nf_conntrack


0

Another way of doing this is by using reverse port forwarding in ssh: On the server do: ssh -R 2222:localhost:22 _internet_server_you_own So you will end up with ssh to your machine on port 2222 on the internet_server. I think it was covered on serverfault before.


1

I have managed to diagnose my own problem. The IPtables are fine. The problem was my understanding that I could not (as configured) test port forwarding of port 7022 on the external IP from the internal network. The issue is covered quite well in the canonical answer to "hairpin NAT" which explains how to route an internal client through the FORWARD ...


4

If you want to connect via SSH to a computer behind the firewall, then you will need to add a port forward (DNAT) rule to the firewall mapping port 22 (or whatever port you decide to use) to the SSH port on the internal server. TeamViewer is able to get through by using techniques such as NAT Traversal and UDP hole punching to establish a connection through ...


1

I am going to assume you have a firewall (of some sort) between your machine, and the DHCP server - is this the case? If so, does this firewall also route traffic? You may be required to switch on a DHCP helper (This is due to the fact DHCP uses broadcast traffic which routers will not forward on to other segments) If this is not the case, have you tried ...


1

DHCP Server UDP 67 DHCP Client UDP 68. There are other ports requirements for different things depending on the implementation, but above is standard.


0

You need to allow destination port 22 on the input chain, it's only on the forward chain.


-2

Ask this question: how does Vonage do it? If you do something for money, you better have some security in place. I'm sure they upgrade infrastructure all the time. If your not to concerned about security within the employees home, a router set up to connect to the company's VPN might be useful. Connect your IP phone to that.


-1

Same issue here but i think i got lucky and found a solution. Looked like a firewall issue here too, but when disabling it there was no change. Acces from localhost worked fine but not from same network or the internet. I have tried changing every value with no luck but finally i have tried editing feature settings of error messages (my server has own error ...


0

You could always put a hypervisor beneath it (ESXi free will definitely work with an 82574, and pfsense 2.x will work with the Intel emulations ESXi provides :). Also makes upgrade management/testing a snap...


-1

you can use something like this: firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 22 -j ACCEPT firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --dport 3306 -s 192.168.1.22 -j ACCEPT


0

The issue is with the iptables -A OUTPUT -j DROP and how ports are used. Thou you have allowed port 20, 21, and 22. You will never use these ports as your outgoing port. They will be a random number high up in the port range. Try adding someting like sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT before your iptables -A OUTPUT -j ...


0

NOTE: 192.168.1.9 is client and 14 is server and is work fine in my two server .... Client pf.conf : block all pass in on em0 inet proto { tcp udp } from 192.168.1.14 to em0 port { sunrpc nfsd-status nfsd-keepalive nfsd lockd } pass out on em0 inet proto { tcp udp } from em0 to 192.168.1.14 port { sunrpc nfsd-status nfsd-keepalive nfsd lockd } Server ...


0

Years ago I had the same problem. I was solved by simply activating promiscuous mode in vSwitch where Endian WAN NIC was connected. See: vSwitch, promiscuous mode and OpenVPN https://communities.vmware.com/thread/343119


0

1 - you need to plan name resolution. If the clients don't connect to a DNS server that does Internet names, this is expected. TMG can do that for HTTP URLs, but not random no-name stuff, unless you install the Firewall Client on the client computers. 2 - Confused question. Firewall where is on to break this? If you're using the firewall client (is that the ...


3

IPtables applies rules from the top down in the list. If there are Allow Rules before a Reject, the Allow rules will take precedent. To block a Network range it needs to be added at the beginning of the IPTables Rules. iptables -I INPUT 1 -s 172.16.0.0/16 -j REJECT Will insert a Reject rule for the network 172.16.0.0/16 as the fist line in IPtables. A ...


3

Well, first off, relying on MAC addresses as identifying information is not a good idea - they can be trivially changed by the user. Regarding SLAAC, as you've found out, it's very much not suited for an environment that you need control over. As such, consider switching to DHCPv6. Once you've switched to DHCP, the solution to your MAC address problem is ...



Top 50 recent answers are included