Tag Info

New answers tagged

0

Yes, fail2ban is a good idea. But out of Netfilter that can be quite dirty because of bad TCP reply (you should add INPUT -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT for instance) The best solution is actually in your /etc/ssh/sshd_config, limiting there your IPs : ListenAddress 70.5.1.1 ListenAddress 10.1.5.1


0

Try the following... Login to your home and work computer and execute the command below on each of them. dig +short myip.opendns.com @resolver1.opendns.com This will return the actual public IP you will be connecting from home and work respectively. These are the two IPs you need to add to your rule on your ssh server.


0

From your last comment, I believe that you problem is DNS, and not the firewall service. The prove for this theory is that when you configure the VMs with the Google Public DNS servers 8.8.8.8 they work fine, but when you configure them to use the IP address 192.168.1.254 (which I can't tell if its the IP address of the host server or your gateway), name ...


0

Try fail2ban. Most distros have it packaged and it comes with default rules for sshd. It will automatically ban all IPs (via iptables) with more then a certain amount of login failures.


0

Your rules are allowing incoming requests, but you may have a very restrictive IPTable configuration that is blocking all outgoing communications. If this is the case, then you will need to add additional rules. iptables -A OUTPUT -p tcp -d 12.34.56.78 --sport ssh -j ACCEPT iptables -A OUTPUT -p tcp -d 23.45.67.89 --sport ssh -J ACCEPT The rules above ...


0

Schematic: ssh ssh A ------> B ------> C ^ ^ using A's using B's ssh key ssh key Preconditions: A is running ssh-agent; A can access B; B can access C; A's ssh public key is present in B:~/.ssh/authorized_keys B's ssh public key is present in C:~/.ssh/authorized_keys In ~/.ssh/config on A, add Host C ...


0

It does. It works as you suspected: the policy will be applied to packages which doesn't have an explicit rule inside the chain. Since the is a specific rule to all packets, the policy will never be applied, and all packages will be accepted. What will happen to the packages in the end, however, that's an entirely another story, as it may depend on the ...


0

Whenever packets are targeted/sent to it. For example by a rule like: ip6tables -A INPUT -p tcp --dport 1:21 -j userChain1 The two rules: -A userChain1 -m limit --limit 4/sec -j REJECT --reject-with icmp6-port-unreachable -A userChain1 -j DROP Means for the first 4 packets per second a response is sent, (REJECT target) and everything past that is just ...


1

Ideally (ie pedantically) speaking, your modem is always be in bridge mode, but many "modems" also have a router built in to handle NAT etc for you. It's also common enough to have that handled in a separate device, leaving the modem to do what it does best. As you've mentioned double natting, I'm assuming you have a dedicated router. I'm also going to ...


1

Are there any side effects or problems that could come of placing a modem into bridge mode in order to allow for easier access to internal services? Well, that's probably something you should talk with your ISP about. In general, though, it's a great idea. Double-NAT is evil.


0

HTTPS uses TCP port 443 -- you will need to open that port. Also, are you sure that you haven't misspelled Reporsitory.git in your request?


1

Took me couple of hours but I found a way to do it on windows 2008 R2 (a bit complicated but can be automated): run ipconfig /all and get the interface Id you need, it should look like: Tunnel adapter isatap.{46BE0BE9-4808-4CF4-8C3B-DC543261F096} This is the registrey key needs to be changed: ...


0

You likely don't have a need to allow that. Just add a block rule on LAN, any protocol, any source, destination network 239.192.0.0/16, and don't enable logging. It has to be at the top of the list, before any other matching rules. The rule you added there for that UDP won't ever match because the rule above it matches first and first match wins. There is ...


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


0

Turns out that my ISP has provided two IP addresses to the connection (without noticing me) and that I was talking to the wrong one all along. The management-port was bound to all interfaces (therefore it was open), but the bound external port was not. Note to self: double check IPs. with shoutouts to @B.Z. for rubberducking


0

Connect your lab to the Optional interface. That should provide the separation you need. Note that you won't have direct connectivity to the Optional interface from the Trusted interface unless you allow it in your rule set, which would defeat the purpose of segregating the lab.


0

One answer, hinted at in a comment, suggested simply to maintain per-network rules in the user SSH config file. For example... Host foo@work Hostname ssh.foo.com Port 443 That would probably work where I have more control over the commands and entering the hostname, but git's push and pull commands read straight from the configured remotes. I would ...


2

I have been trying to solve this problem for a while now, and while I ultimately decided not to bind my server process to localhost (I used 0.0.0.0:PORT), for a while I was unsure of where my incoming packets were actually going given I thought I had the right NAT rule. The answer was that the kernel was intercepting them as martian packets, and discarding ...


0

Create an upstream with your proxy, a server that will do the proxy pass and reference them in your location. Done. upstream proxy_upstream { server proxy.abc.lan:1234; } server { server_name proxy.abc.lan; location / { proxy_pass http://registry.npmjs.org; } } server { listen 80; server_name classen.abc.lan; location / ...


1

If you used 'Any-External' in the SNAT rule, than you made the error here. Select the external IP address(es), that you will actually be using for this SNAT rule instead of the alias 'Any-External' and things will start working. Still you may use 'Any-External' in the filter rule. The problem is in the understanding of the alias 'Any-External'. All IP ...


2

The solution is not to deny all IPs (e.g. deny 0.0.0.0/0) but to allow only the specified static IPs or ranges. Then, the default action of CSF will be to DROP other traffic. This same principle applies to other firewalls like iptables -- as long as the default action is "DROP," then all you need is allow rules.


0

First off, an understanding of services needed should be obtained. I know this is a royal pain, but a guest ACL should only allow traffic to resources that are trusted by your organization. First, destination addresses are easily found by performing a "Arin who is" search. (American registry of internet numbers.) Second, legitimate internet resources will ...


1

From a security perspective the policy is usually "everything not allowed is to be denied" and in that regard filtering on the OUTPUT chain falls under that blanket policy. The OUTPUT chain concerns outgoing TCP/IP packets and connections originating from the device running iptables and not the packets passing through the firewall. An administrator should ...


1

Depends on how secure you want to be. Filtering outbound traffic does increase security and decrease attack vectors, etc. Personally, I only filter outbound SMTP (no clients should be connecting to external SMTP servers) and DNS (to prevent I'll effects from malware that changes users' DNS servers to earn external host). Many orgs have much more ...


2

Unfortunately, you cannot perform this task using the Set-NetFirewallRule cmdlet, as the WMI calls to enable the Firewall cmdlets are only available in 2012+. For Windows Server 2008, you can use netsh advfirewall. Example: netsh advfirewall firewall add rule name="Name" dir=in action=allow remoteip=any You can still use PowerShell to run this command on ...


1

You would need to add an outbound rule to block teamviewer. This would stop teamviewer establishing a connection with the teamviewer servers. Teamviewer connects to central servers using outbound connections the connection is established inside your firewall, so your incoming firewall rules don't make any difference.


3

Common issues with different protocols DNS: DNS uses port 53 UDP by default, but messages that won't fit in a single UDP datagram will be transmitted using TCP instead (typically zone transfers and such) requiring port 53 TCP to be opened as well when you run a name server. Email: Many consumer ISP's block SMTP traffic (or at least the default port TCP ...


4

0. In general: Viewing and modifying the firewall configuration requires administrator privileges (root) as does opening services in the restricted port number range. That means that you should either be logged in as root or alternatively use sudo to run the command as root. I'll try to mark such commands with the optional [sudo]. 1. Order matters or the ...



Top 50 recent answers are included