Tag Info

New answers tagged

0

You can't. You can get a list of groups you're in at http://169.254.169.254/latest/meta-data/security-groups but it won't give you the rules themselves.


0

Apparently there is no other firewall solution on Linux that doesn't in fact use iptables/netfilter. Also a simple SYN test is the proper way to check if your traffic is filtered by a firewall. You are right that looking for an "upstream" firewall, a Security Group of this EC2 instance in this example, is the only reasonable way to resolve this. Thank you ...


0

Did you have app-armor installed and running? Try also wireshark for see blocked packets or something bad on network traffic


0

It might be that the hosting provider have a firewall service defaulting to only permit ssh traffic to the server. The purpose of such a default could be to limit exposure of the server until you have had time to install all security updates, harden your configuration, and in general ensure your server is ready to go live. If such a service happens to be in ...


1

YES, Usually corporate networks are behind proxy. Try to find your git repo server public IP (google it), ping it. If it isn't working you are probably behind a proxy server. If you are behind proxy use: git config --global http.proxy http://proxy_address:proxy_port git clone http://.../.. You can find proxy address in internet explorer ...


1

I often use an external, browser based, dns/ip lookup tool, like GetIP, to get the ip address of a server I'm trying to connect to. Then you can use the address for git, svn, etc as long as it's not explicitly blocked by your corporate firewall or proxy.


1

The suggested solution is lacking (or smart) in the sense that it does not save IPTABLES so the changes made to IPTABLES will be lost on next boot. You should save your blocked IPs by committing them: /sbin/service iptables save CHANGE done /sbin/service iptables save rm .ips On the other hand, since the system is an automation, maybe it is wise to only ...


0

Maybe you can use libvirt's hook script. You script a shell script that libvirt will execute as soon as your VM is started. Create the file /etc/libvirt/hooks/qemu with this inside: #!/bin/bash if [ "${1}" = "<the name of your vm>" ] ; then VM_NAME=${1} VM_IP=172.16.20.10 if [ "${2}" = "prepare" ] ; then iptables -t ...


3

You have a number of options: Run the SSH server on port 80 or 443. Run a tunnel on the SSH server to listen on port 443 or 80 and forward it to 22. Run a VPN on port 80/443. Essentially, something on the server you're trying to connect to needs to be listening on port 443/80 in order for you to connect to it. The other solution is to talk to the ...


6

IIRC iptables rules are order dependent: if the first rule matches, it won't parse any more. Reverse the order and you should achieve what you're trying to do. Extension: it is not always so, some rules (f.e. -j LOG) allows the packet processing to go further. But the common ACCEPT, REJECT, etc. rules aren't. Best if you see iptables as if it were a ...


0

I have seen this before. I fixed it the hard way. There was a problem with the NIC driver binding to the IP stack. I booted the system without a NIC. Installed a loopback adapter. Set an IP to the adapter. Configured and it worked. I then installed an Intel NIC (the NIC I was using was not very desirable, won't name manufacturer) and everything was fine. ...


-1

As far as I can tell you just want a transparent http proxy? http://www.tldp.org/HOWTO/TransparentProxy-6.html


0

You simply can't do this with a iptables alone and a http proxy like squid, because most network protocols simply were not designed with transparent proxy as a feature. They must be explicitly configured to use a proxy. The closest you can get is to use a socks proxy like Redsocks


1

According to your output the application is only listening on lo (127.0.0.1) This is what you're aiming for david@theta:~$ lsof -ni tcp:9292 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ruby 2406 david 13u IPv4 1579461398 0t0 TCP *:9292 (LISTEN) You most likely need to amend the configuration of whatever it is you're trying to ...


3

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. ...


0

Personally I would rate limit only for specific TCP packets (syn flood, scans of various types, etc) with iptables and use nginx to rate limit HTTP requests per time interval behind this. Keep in mind that browsers open multiple TCP connections for a single actual user so rate limiting to 50 connections per minute once the burst is reached is dramatically ...


0

How can I prevent this from happening? you can rate limit: iptables -I INPUT -p tcp --dport 445 -i eth0 -m state --state NEW -m recent --set iptables -I INPUT -p tcp --dport 445 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP or just drop altogether / filter on your subnet on incoming tcp/445 if you need ...


0

Found the right way... You have to set in the local.ini your local ip which you can get with ipconfig on windows or ifconfig in linux. Then in the nat menu from your router add a routing entry to your local ip. Now when you enter in the browser your public ip 211.121.x.x it goes to the router and then the router knows oh i have to forward this request to ...


-3

Yup, Mem is totally right. Dual Stack and only on the public side of the network is a mandatory first step...that is the real holdup. That is to say nothing of ALSO being ready to just abandon IPv4. NAT devices will do what they have always done. IPv6 provides private address space but there is no way to guarantee that it is globally unique...so we still ...


0

Old topic, but if you got custom DHCP option defined the SSG5 got problem handling those, thus lead to strange error. Please update the firmware in worst case.


-5

Yes, of course you can. In fact that is the wisest thing to do. Don't believe people who say "Oh....you will HAVE to change your entire network to Ipv6 eventually, so dont delay" Utter nonsense. I have been through this at the carrier-grade level. IPv4 is here to stay. It works just fine for the vast majority of organizations, because of RFC1918. If ...


0

You're on the right track. You need two NICs, mainly because your Linux firewall is sending outbound packets in a round-robin fashion when it comes to select a route as they both have the same metric. Having two NICs will just do round-robin per NIC and not per route, keeping each TCP connection on the same NIC. Keep in mind this could still cause you ...


-2

In addition to ports required for endpoints(usually 5022,5023), UDP 137 is also needed to be open at both side of mirror. This port is used for network discovery and netbios which is the essential part of mirroring endpoints to be able to talk to each other. Hope this helps.


1

you can control the traffic of your containers in your host using iptables, i don't see the need for use openbsd in this case


2

The firewall won't block already established VPN connections because you have the following rule near the top: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT That means, connections already in the ESTABLISHED state (from the point of view of the conntrack module of netfilter) will keep passing through. Plus, most likely your INPUT chain has a ...


1

miniBill is right: you have indeed mixed up sport and dport. When you write: iptables -A INPUT -i eth0 -p tcp --sport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT Your INPUT ssh traffic is to your server, so that should have destination port 2222, not source ...


3

As I understand your problem, you have currently one or more incoming MX:es. When a server outside of your system connects to those MX:es, and the email it's trying to send contains either a From:-header, or an envelope sender, within your domain - then your MX server don't accept it. UUCP is one way, yes, and I've actually seen it used over TCP/IP, but ...


2

Rather than disabling logging, which only fixes the symptom, you should investigate the cause of the firewall triggering. In your case, your router is sending IGMP packets, which are necessary for IPv4 multicast to work (even if you don't have any multicast routing in your network, firewalling IGMP will break link-local multicast if you have any snooping ...


2

Yes. For rsyslog, you can use a filter such as: :msg, contains, "MAC=01:00:5e:00:00:01:40:5a:9b:5c:9c:fd:08:00 SRC=192.168.1.1 D ST=224.0.0.1" ~ If you put it before other configuration rules, it will prevent the messages from being logged. You can see a full example of a configuration file here. Note that the text “must be an exact match, ...


4

An iptables DROP policy is equivalent to iptables -A INPUT -j DROP (DROP rule) at the end of the chain. But this rule must stay at the end of the chain, any rule after it will never get touched by any packet. If you use the DROP rule, you cannot anymore use iptables -A (append), you can only use iptables -I nr (insert, nr is the number of the last rule) and ...


0

A quicker way of disabling firewalld is the following. systemctl disable firewalld this removes the .service so you should get something similar to rm '/etc/systemd/system/basic.target.wants/firewalld.service' rm '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'



Top 50 recent answers are included