Tag Info

New answers tagged

3

Notice the line in your netstat output ... tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 18843/nodejs Specifically the local address of 127.0.0.1:8080. That means that nodejs is only listening on the localhost address and so only will accept connections from the same machine. I don't know (off the top of my head) how to ...


0

Finally I solved my specific case with running nginx as reverse proxy, available from localhost only, using proxy_bind directive. From my scripts I should make queries to something like http://localhost/nginx-proxy-ip-N/https://api.example.com/?q=123


2

There are several protocols that Git can use, which are documented here - the most common of which is SSH, which is used on GitHub (both public and Enterprise flavours) as well as Gitosis and Gitolite. To use Git over SSH, you will need to open port 22 outbound, and to use the much rarer Git protocol, you'll need to open port 9418, which you already have, ...


0

I think it all depens on how your iptables rules are set before you do the flushing. I mean the default polices of your chains INPUT, OUTPUT and FORWARD. So to be sure you won't get locked out when you flush your iptables rules, first make sure the default policies of your chains are completely open. Like so: iptables -P INPUT ACCEPT iptables -P FORWARD ...


0

The behavior of netstat -ntu is such that it just prints any TCP or UDP connections registered in the connection table. It does not differentiate based on state. If you want to check for only established connections, you may want to start the command with: netstat -ntu | grep "ESTABLISHED" | awk .....yaddayadda You may also want TIME_WAIT connections, ...


0

You can use a GeoIP service to obtain the list of known China IP, and then forbid their connection with iptables. Have a look here GeoLite2 Free Downloadable Databases and download the CSV file. From the file GeoLite2-Country-Locations-en.csv you can find that China has a geoname id of 1814991. You then use that value to filter ...


-1

Well, get the IP range of all public IPs in China, add them to iptables with DROP. Stupid idea though, you should be using some DDOS-avoiding options (for apache for example: mod_evasive or mod_security) or even plain old limits in iptables like: iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ...


4

If you're trying to mitigate DDOS attacks, then you need to have your ISP block the bad actors at their level. Once the DDOS traffic has hit your router/firewall/server, it's already eating up your bandwidth.


2

Formal answer: go to VPS management panel, get local access (virtual KVM) somehow or call them. Explanation of steps/rules to prevent falling for it again: There are ip, routing and firewall rule changes that may go bad and block your access. and it applies to dedicated network device configuration too, not to VPSes only So unless you are 100% sure that ...


1

I found this answer on the forum: In order to get FTPS (secure FTP over SSL) to work, I had to create two packet filter rules (Network Security -> Packet filter) Internal Network -> Any (Service: FTP, port 21) and Internal Network -> Any (or the IP of the FTP server) (Service: FTPS data port range, 9000-9015, or whatever your server ...


2

A general way to fix a broken instance is to shut it down and attach the root volume to a working instance. You can then mount the volume there and view logs or edit configuration files. You can then detach the volume and start it up in its own instance.


1

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces. firewall-cmd --new-zone=special firewall-cmd --zone=special --add-source=192.0.2.4/32 firewall-cmd --zone=special --add-port=4567/tcp Add --permanent of course to make them permanent.


29

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


42

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


53

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


1

The name of the munin plugin is a bit unfortunate, because it doesn't really measure anything directly related to firewalling; it shows how many packets are received by the system on any interface, and how many packets are forwarded through the system. Hence it doesn't matter how many firewall rules (if any!) you have. It examines the file /proc/net/snmp and ...


3

Try this command firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" \ source address="1.2.3.4/32" \ port protocol="tcp" port="4567" accept" Check the zone file later to inspect the XML configuration cat /etc/firewalld/zones/public.xml


0

Thanks Matt! I figured it would be something easy like this. So I need to use the FORWARD rule, not the OUTPUT! I don't have to worry about IP address changing, since this server also provides DHCP and I assign them to appliances based on MAC address. But I see how your suggestion would work in a different scenario. As to the routing comments...I am a cut ...


0

This won't work. # # (6) OUTPUT rule to allow a client LAN access, but DROP internet access # I use this to prevent various home appliances from accessing the internet # iptables -A OUTPUT -s 192.168.10.110 -j DROP The reason it won't work is the OUTPUT table only filters traffic originating from your router, rather than passing through it. You want the ...


1

I have found the solution! Indeed I had to extend my access-list on my outside interface!!! I have succeeded using ASDM. First I created a NEW network object for each of my servers. When you create a new object you will be asked for the internal IP address and "this is where the magic happens" you have to set the NAT IP address (the external address) !!! ...


0

Sometimes people should really use the ASDM for their ASA firewalls. There's no shame in it. I've managed hundreds of Cisco ASA devices and use a mix of 80:20 between working in the ASDM versus the command line. The packet tracer GUI is very easy and would tell you exactly where this is happening. There's a CLI equivalent as well. Anyway, all I have for ...


1

All you configuration looks fine and I can see that you have only allowed desired traffic to your servers using ACL. If you would like to anyone to be able to ping your server on public IP interface, you will need to add below ACL: access-list OutsideToInside extended permit icmp any any Or you can choose the servers instead of allowing ping to all/any.


0

Spend some time researching "split-brain" DNS. This is a fairly common problem that plagues many organizations. In our case, we simply use the external address whether the client is internal (LAN) or external (WAN) in most cases. We have built our DNS in such a way that we can split out which addresses resolve internal and which resolve external. Either ...


0

Where is your current DNS zone being hosted for mydomain.com? Is it externally located, or hosted on your internal network? Assuming it is externally located, this is how I would normally set this up for my clients: -A record for test.mydomain.com is configured on external DNS server to resolve to 212.168.187.53 -Create a new zone called test.mydomain.com on ...


1

Let me suppose the following 3 things in your setup : you have a default policy on the INPUT table of ACCEPT (it is the default value). your packet / byte counter on the last rule -A INPUT -i all -p all -j REJECT is 0 you do not have an interface named 'all' AFAIK the -i parameter does not have a key word like all, so it is considered as an interface ...


2

The issue with Lukas's solution is HttpRewriteModule , which automatically turns everything with http(s) at the front into a 302. If you instead do the rewrite in two stages - the second one 'break' - it should work. e.g. rewrite ^(.*)$ "://registry.npmjs.org$1" break; rewrite ^(.*)$ "http$1" break; proxy_pass http://proxy.abc.lan:1234; I suspect there's ...


0

If I've understood your question correctly what you're trying to achieve is addressed by the Linux Virtual Server project - http://linuxvirtualserver.org/. At the very least it will give you pointers to the issues.


0

If it's just for permissions then maybe you can try to sudo su systemctl enable firewalld systemctl start firewalld


3

As I am a long time Munin user, I can give you few quick thoughts on using it: using a SSH tunnel (is that illegal as well?) to get behind the firewall. The obvious port forward, you mentioned. If you have SSH of the monitored machines already exposed, you can use Munin's SSH support to get to those. You can use one very light-weight node behind firewall, ...


0

You need to do this on web server. Try with a reverse proxy Original post: http://www.jamescoyle.net/how-to/116-simple-apache-reverse-proxy-example


0

I would check the output of netstat -an to see which interface the listeners are on for 8008 and 8080. It is possible they are only listening on the loopback interface, in which case the traffic would have to be initiated from localhost.


1

We found the deployment instructions and CLI and REST examples in this document: https://wiki.openstack.org/wiki/Neutron/FWaaS/HowToInstall#REST_calls_using_curl: The policy (and therefore rules) in FWaaS are all applied to all of the tenant's routers. A year after this question is asked we have LBaaS and VPNaaS in the API documentation but no sign of the ...


1

I think what you really wanted was something based around the hashlimit module.


0

It doesn't work on pure IP-level, one needs to know how DHCP does work: At first, the DHCP client does send a packet (DHCPDISCOVER) from 0.0.0.0 to 255.255.255.255 (the local broadcast address). The DHCP server will offer an IP address (DHCPOFFER); in terms of iptables, this will be a packet from the DHCP server's address and also targeted at the local ...


1

Assuming you've checked the basics like ensuring that the access list is actually bound to the interface with the access-group command, if the logs are showing that the traffic is being denied, you can find out more information by simulating a packet with the packet-tracer command. That should tell you exactly why the packet is being rejected. Assuming your ...


-1

#> iptables -I INPUT -s 66.230.160.1 -j DROP #> iptables -I INPUT -s 66.230.160.15 -j DROP


0

There are at least a couple ways you could achieve that. I've seen examples of using iptables with its string/bytes-matching functionality to look for recursive queries coming from outside, and then dropping them. I've a colleague that did that on an authoritative non-recursive server for a number of years and he said it works well. I've also seen people ...


0

I've solved the problem. It was related to the reverse path filter. I had put this in my script: echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter But when I was troubleshooting the problem I realized that this value was 1 in all the interfaces (except default): $ cat /proc/sys/net/ipv4/conf/*/rp_filter 1 0 1 1 1 1 1 1 1 1 I've set the values to ...


0

At the moment I'm using the following settings. Let's assume 192.168.127.10 it's our internal server and xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy ip addresses of wan1/wan2 # iptables -t mangle -I PREROUTING -s 192.168.127.10 -m conntrack --ctorigdst xxx.xxx.xxx.xxx -j MARK --set-mark 0x3e8 # iptables -t mangle -I PREROUTING -s 192.168.127.10 -m conntrack --ctorigdst ...


0

Maybe SELINUX is blocking the Tomcat process to start listening on port 54321. To check if this is the case, issue the command setenforce 0, restart tomcat, and re-try to connect. For more information: http://wiki.centos.org/HowTos/SELinux If it not SELINUX related, try to connect to localhost issuing the command telnet 127.0.0.1 54321. If the telnet opens, ...


2

You need what's commonly called a "hairpin NAT" rule. You redirect internal users who are trying to reach the public IP back inside the network to the local IP. In the sonicwall NAT rules, you'll need a rule like this: Original Source Translated Source Original Destination Translated Destination Service Local Subnets (or ...


1

I think the security-level should be considered. You can ping from Inside to Outside, but the echo traffic must be allowed to go back to Inside.


0

I assume that you need rules for the ICMP (not IP) traffic to allow ping. First of all, you question could be duplicated to this one: How do you allow ICMP Echo Requests on a Cisco ASA 55xx Router? However, I use slightly another configuration to allow ping. From your question, I'm not sure on which interface you need to allow it, so I'll just post my ...


-2

You can use the 'deny all log' command in the ACL to see the realtime results of the 'implicit' deny all rule and go from there. It was called the 'explicit' deny all rule.. googling here it is edit: sounds like you may have already done this.


0

This is broadcast and multicast traffic. It sounds like your internal network is becoming more noisy then it once was. I know UDP 17500 is the Dropbox discovery protocol. Check your network and you may need to implement multicast and broadcast limitations on your switches.


1

Three things that concern me here. 1. As others have mentioned, your policy is set to REJECT. Not even sure that's a valid target for policy---I believe it's just a target extension but double check your manpage. The target you want is DROP. You start with something like this (make sure you are on console and not SSH since you may be disconnected and ...


1

You are actively rejecting any connections by the default policy REJECT by iptables -P INPUT REJECT. To block connections from an IP you would use DROP or REJECT instead of ACCEPT in your rule: iptables -A INPUT -i eth0 -s 180.243.22.122 -j DROP The problem you are experiencing is because you are rejecting all connections, and by using REJECT you will be ...


2

No, unless you also do source NAT in addition to the destination NAT, otherwise return packets won't go out the correct gateway and hence won't be sent to the original client.


1

old post but worth a good comment regarding "received" status in the packet monitor. I couldn't find anything on this status in Sonicwall/Dell documentation. Finally got a tech to explain it, actually got a short description... Received means that the packet was consumed by the interface. This means the packet did not make it internally on the network. ...


0

Start off by confirming that your DNS is correct from said failing office environment. "ping app.example.com" and "ping api.example.com" from your Wifi/4G and see what you get for answers. Then do the same from the failing office. If you get the same results, then you can move onto firewall specific issues. Also, it'd be very helpful to include what ...



Top 50 recent answers are included