Tag Info

New answers tagged

2

Cassandra uses Thrift internally for RPC and gossips which works at 7199 protocol. If your 9160 port is opened on security groups and your cassandra is a cluster instead of single machine, then there is a chance that some internal dependent ports are not opened


0

to do something like this you should setup static nat on a host in the middle. Setup a static nat rule sending their ip address to the ip address of the server you'd like their traffic to go to - I'm assuming you have access to their firewall or something like that. Make sure the site you want the request going to is setup to answer requests for ...


1

I don't know if this fits in your plan, but on an apache webserver a .htaccess file could do this redirection also for you place a .htaccess file with the following line in the webserver documentroot of www.sometargeturl.com Redirect / http://www.newdestination.com/


3

If you reject the packet, you reply to the incoming SYN with a RST packet, so the scanner knows the port is closed (via reject, or because no service is running on that port). If you drop the packets, the scanner waits, and after some time (timeout), it assumes the packets have been dropped (although, they may be lost in transit, or the machine on the far ...


1

Assuming you control the print server code then, sure, you can have the print server connect out to your servers obviating the need to worry about NAT in the remote networks. This is, for example, how "GoToMyPC" and "LogMeIn" work-- making persistent connections outbound through the firewall to servers. There are protocols that can allow you to "punch ...


1

Yes, this is possible. This can be automated easily with UPnP port forwarding, if enabled on the NAT host/device, if security is not a consideration. If you do not want to use UPnP, for example, because security is a consideration, you can achieve this using another API to access your NAT devices. UPnP is very common in home routers. You may wish to use ...


1

No, the Cisco ASA 5505 only provides 100Mbps interface ports. I would suggest purchasing a dedicated Gigabit switch rather than relying on your firewall's interfaces.


1

OK, the main issue is that right now your firewall is doing precisely nothing. The INPUT chain contains exactly one rule, which sends your traffic to a chain called acctboth. That chain contains a bunch of rules, none of which has a dispositive target, so all packets will fall through it and go back to the default policy, which on that chain (as all other ...


0

This is the dump of a generic iptables ruleset I use for web servers. Note I have an SSH war dialing detection ruleset in place named SSH_CHECK that may not be applicable to your issue, but wanted to set it here anyway as part of my complete ruleset. # Generated by iptables-save v1.4.12 on Sun Apr 6 11:50:24 2014 *nat :PREROUTING ACCEPT [0:0] :INPUT ...


1

Firstly, private ip addresses don't change after reboots; they change after an instance is stopped and then started again. Different things. You can create an AMI from any EBS backed instance. Look for "Create Image" under the actions menu. If you can do this, redploy the AMI in a dedicated Security Group, and then use that Security Group ID as the source ...


0

You may add both instances to one security group and specify this group as a source, or specify this particular instanсes's security group. As stated in AWS documentation: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html One or the following options for the source (inbound rules) or destination (outbound rules): [skip] ...


7

Danger! Please please do not just turn off your firewall here and think it's a solution. You were on the right track, except you turned a debugging step into a solution. What should we do instead? How do I truly fix this? Well you were right that you were only accepting everything from the lo interface. So we just need to allow this port to be accessed ...


-7

For some reason, this command fixed it. iptables --delete INPUT 5 I think I understand why now even though line 1 and 3 already accepts all. With -v I see lo for the in column, and lo is the name of the interface in ifconfig which is only for local connections. So no ports were open except 22, SSH.


2

You only have port 22 open in the system firewall. Run system-config-firewall-tui to either disable the firewall, or open port 10000.


5

First one has to ask whether the packet actually originated from your host in the first place. Source IP spoofing happens all the time, and without context that log entry says nothing about the authenticity of the source IP. Next question is if you are running a DNS server on that host. If there is no DNS server on that host, then the packet they logged is ...


3

The source IP is you, the source port is 53 (DNS). Looks like you have a DNS server, which is open for queries from outside. This can be intended use like to provide DNS for your own subdomains, but it also can be a misconfigured DNS server which can be used for DNS amplification attacks, which then can be used in (D)DOS attacks against other hosts. So ...


-3

Not sure if this helps but I noticed that there is not a UDP service for "test". You would have to add that to the inbound/outbound rules.


2

Have you tried upgrading the firmware? We've had DHCP problems with 4.0 MR3 firmware and that was fixed with a firmware upgrade. Also, we have a DHCP server on the fortigate just for IPsec clients and it works normally.


1

host all all 0.0.0.0/24 md5 Um, what? That only matches 0.0.0.* which surely isn't what you want. Did you mean 0.0.0.0/0, i.e all IP addresses? Or 192.168.0.0/16, i.e "everything on my LAN, including the firewall and NATed traffic coming through it" ? You're using NAT, so PostgreSQL will never see the external IPs. Connections through the firewall ...


0

I have been using xen for quite a while. I think you go with multiple public ip address so you can quickly monitor each service that those vms run. Also a note: I have virtualized a production mail server and it turned out bad and sluggish.


1

-A INPUT -j DROP is dropping all incoming traffic, including replies from google in your example. Change that rule to -A INPUT -p tcp --dport 80 -j DROP so that it blocks incoming requests to your web server (you may need to add https port 443 and other services that you don't want exposed), while allowing you to receive traffic back from connections that ...


0

Definitely better to use HA w/CARP in that case. That gives you redundancy that you can't get at the hypervisor level, like not going down when doing upgrades.


3

I'm using SonicOS Enhanced 5.9.0.3-117o and the docs say to do: address-object ipv4 "Mail Server" host 192.168.168.33 zone DMZ Your missing the ipv4 before the name of the object. This is because you can enter one of three address-object types. fqdn FQDN Address Object. ipv4 IPV4 Address Object. mac MAC Address Object.


1

An ASA will do everything the PIX did and then some, so it the replacement. You can pretty much drop a PIX config onto an ASA and it will run, so there's no way I'd buy a PIX today.


2

It depends what you want to do. PIX is still good.515e and 535 even the old 506e . As I said before it depends on your requirements of design.I still use and deploy them. Configure them good and they are solid. Devices and age ,old or new is not the problem. It is the person configuring them and whether it supports what you want to do. People think ...


5

You can use the ssh ProxyCommand functionality for this. Assume serverA is your jump host, and serverB is the ultimate server you want to connect to. Add the following to your ~/.ssh/config file: Host serverB Hostname serverB.example.com User jimbob ProxyCommand ssh serverA.example.com nc %h %p 2> /dev/null Then from your workstation, just ...


0

Alternatively instead of blocking the connections and un-blocking when needed (that's what it seems you want to do) you can stop the server and start it only when you need it, looks like a 'cleaner' option.


3

SMTP involves a conversation between two SMTP servers on port 25. I'm going to copy and paste a sample conversation from this website, which is demonstrating testing SMTP with telnet: telnet: > telnet mx1.example.com smtp telnet: Trying 192.0.2.2... telnet: Connected to mx1.example.com. telnet: Escape character is '^]'. server: 220 mx1.example.com ESMTP ...


2

Yes, if you block the port #. There will be no successful communication which is needed for that service to work.


2

I definitely think CARP is better suited for this task, as when a Virtualization host is going down, pfSense would need to be restarted on another machine first. (I don't know exactly how VMWare FT works, but I think it has some limitations on it's own) What we actually do is, we have 2 virtual pfSense appliances going with CARP, each on a separate ...


0

The following will necessarily have some redundant steps. They're there just to be extra sure ie. wear belt and suspenders. # enable ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # create a port redirection rule iptables -t nat -A PREROUTING -p tcp --dport 27017 \ -j DNAT --to-destination 192.168.0.69:27015 # create a masquerade rule in order ...



Top 50 recent answers are included