New answers tagged

0

Turn-off your Firewall. If you can access Facebook when it's off, the the problem is in your Firewall. If not, then look somewhere else in the network where you made restrictions. You might have duplicate policies. If it did work after you turned the Firewall off, then the issue is there. The Firewall rule was either configured incorrectly or the Firewall ...


1

SSH uses TCP, not UDP. You use nc -u so you send UDP packets. Just try nc -vz <ip> <port> If you want to test your iptables rules that way, you should set the policy for the INPUT chain to DROP or REJECT. Take care that you allow tcp packets to port 22 from your source before. You can allow it from the IP of the specific machine, the whole ...


0

There are 2 parts to your problem: Part 1 - Networking Configuration The first thing is that you are using 3 subnets. I am presuming you are using them all as /24's: 10.160.10.0/24, 172.10.0.0/24, and 192.168.10.0/24 VM-A is configured for 10.160.10.0/24 and 172.10.0.0/24. VM-B is configured for 192.168.10.0/24 VM-C is configured for 172.10.0.0/24. ...


0

Ok so after running PortQueryUI I found several ports to be filtered, despite the fact that I had allow all rules between those two hosts. I went ahead and tcpdump-d everything, and found that one firewall had a malformed rule, which caused some ports to be filtered. After fixing this rule, the dcpromo went along fine. Thanks a lot to everyone who ...


1

These aren't all required AD ports. TCP and UDP 389 TCP 636 TCP 3268 TCP 3269 TCP and UDP 88 TCP and UDP 53 TCP and UDP 445 TCP 25 TCP 135 TCP Dynamic TCP 5722 UDP 123 TCP and UDP 464 UDP Dynamic UDP 138 TCP 9389 I got that list here; there's a table explaining what AD uses each port for. A different article I found suggested these ports just for ...


0

it's the firewall, the dynamci port is blocked try this: netsh int ipv4 set dynamicport tcp 49152 16383 persistent this opens all of the FTP dynamic ports


0

I had the same issue on a VM - IP address conflict, coming from the Mac address of the firewall it was connected to. I ended up adding a new NIC and removing the old one, which solved the issue.


0

I work for WatchGuard. The SYN check is just to ensure that a TCP handshake has taken place before allowing other traffic. Even if this is turned off, we still ensure TCP handshakes that we do observe complete correctly, and does not impact our TCP SYN Flood protection. It is safe to turn off. It will often trigger due to TCP timeouts on the WatchGuard ...


0

sorry, this is not an answer but my reputation is to low to add a comment on your post. Please post your OpenVPN server config and all your iptables rules. (iptables -L -v and iptables -L -v -t nat) My first guess would be that you have to add a SNAT or MASQUERADE in your iptables POSTROUTING chain. Example: (10.8.0.0/24 is your VPN network, eth0 is your ...


0

You can try "dnsmasq" software in order to get what you want: you need to define the list of IPs to be provided (https://sfxpt.wordpress.com/2013/11/30/dnsmasq-installation-configuration-5/#static) with MAC binding, and then tell dnsmasq to ignore all "unknown" clients (http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq.conf.example option "dhcp-ignore")


0

I think you may have an issue with your design. If your network security group protecting your traffic to the Internet then your traffic to your azure storage should work just fine for your hard disks in Azure storage. That connection doesn't run over the internet. Take another look at your design.


0

Edit the file /etc/sysctl.conf net.ipv4.ip_forward = 0 reload sysctl -p /etc/sysctl.conf masquerade your private IP as your public when you go out to the internet (whichever interface owns the public IP) iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Nat imcoming requests back to you VM and port - presumably a bridge or tap device. iptables -t ...


1

Uhhh, I might just be misreading your question but your comment: "IF I run ss -tnlp I just see listening on ports for SSH and VNC" explains why can't connect to ports 80 and/or 443: there is simply nothing there to accept an incoming connection... Either start a webserver or enable a simple listener with [sudo] nc -l -p 80 or openssl s_server ...


-2

The 'raw' way is: :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -p udp --dport 53 -m state --state NEW -j ACCEPT -A INPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT -A INPUT -p icmp -m ...


0

I tested your issue with Packet Tracer simulator and everything work perfect. I have ping from 192.168.30.11 to 192.168.10.117 and etc.. Here is asa running config : Saved : ASA Version 8.4(2) ! hostname ciscoasa names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport access vlan 1 ! interface Ethernet0/2 switchport ...


0

The only workable path is to enable firewall to work with domains, and to then open it to: my-sharename.file.core.windows.net (For the appro share name / storage entity)


0

Yes, you need to connect a console cable to the Zywall's DB-9 port in order to gain access via CLI. I would disable the firewall with no firewall activate Then quickly log in via browser to add a rule allowing yourself (LAN) access to the device (Zywall) before reenabling the firewall itself. Been there, done that.


0

Removing all DHE ciphers from our server finally solved the connection problem.


3

Your setup will probably do what you want, once you have a service listening on the concerned port(s). Iptables is a packet filter, not a connection endpoint.


0

I believe I've found the problem. My guess is that the IPs are being rotated out prematurely due to DENY_TEMP_IP_LIMIT. Once we have more than 100 IPs in our temporary ban list (which we definitely do), the oldest IPs will be rotated out in order to make room for new IPs.


0

It is best to run it on different port. However if you have good reason not to there are protocol multiplexers available.For port 443 there is http://www.rutschle.net/tech/sslh.shtml This service listens on port 443 (as only one process can listen at one port) and when it receives connection depending on first few bits sent by client determines the protocol ...


-1

If your ISP is routing both of those scopes to your current firewall, you should be able to set up your desired config with no additional software, depending on your Watchguard model. Watchguard is real good at handling these sorts of issues. It sounds like you may have a bad configuration with regard to the 192 or 203 network, at least in terms of using it ...


0

Probably you have an intermediate router between your test computer and the server. In such a case it's the router who confuses nmap by sending fake replies, maybe as a nuance of NAT implementation. If I'm correct, you will get similar results if you scan any random IP from the computer.


0

You need to block any access to port 7000, then allow access to port 7000 to only the servers in your network. That way you effectively block the Web UI from being accessed unless you're accessing it from a server inside your network. HTTP is a protocol (P in HTTP) and runs on port 80. UFW can't block it based on it being a web page or not since it only ...


0

Unfortunately, there is no other way today than opening your firewall with these ranges of IP address (you found the right document). If you want to restrict more communications you can do a double copy : 1- From your datacenter to an Azure VM (you will open only the VM IP address on your datacenter firewall) in the same region than the storage account. ...


0

You can block this via .htaacess file. In .htaccess fle you need to allow application only via your public IP address and deny all other IP address. Below i have shared the content which needs to be entered in .htaccess file. Order deny,allow allow from 1.2.3.4 #Your Public IP, only this IP is accessible to application. deny from all This will sort ...


1

If i understood your question correctly, you have multiple ways to block access to your application from outside the server. You can set your application to work only with a 127.0.0.1/8 IP address. You can block it via iptables. My best practice is the first option.


1

NETSTAT will tell you if the port is listening but it will not tell you if the port is open to the outside world. What I mean by this is that NETSTAT may show that the 0.0.0.0 is LISTENING on port 3306 but a firewall may still be blocking that port which is preventing outside connections; so it isn't sufficient to rely on NETSTAT alone. The best way to ...


6

Remember that localhost (127.0.0.1) is the loopback interface on the system. If someone can snoop traffic on that interface, they are already on your system so you have worse problems to deal with.


0

-A appends the rule to the end of the list of rules. So if a previous rule drops the packet, the packet is not going to be accepted. Use -I instead of -A. Also, check if a rule in other tables or in chain PREROUTING drops the packet.


0

how can your ISP route the 203.0.113.88/29 within your network? Somehow I doubt that's the case. If you are not fully using your 192.0.2.144/29 (or the 203.0.113.88/29) network, you should be able to put an interface on your switch with on of the ip address on that range. I would recommend using 2 IP addresses (if available) - So for example: Switch1: ...


3

I think your best bet is going to be to contact your ISP and clarify exactly what they are giving you with the 203.0.113.88/29 block. There is no reason for things to be complicated by the uncertainty about these IP addresses. The most ideal scenario is for you to connect a second firewall to that switch and give it one of the IPs on the 203.0.113.88/29 ...



Top 50 recent answers are included