Tag Info

New answers tagged

2

You can't do this at the firewall layer (well, you can - but it won't accomplish what you think it will, nor what you want). The second packet (which you desire) is part of the same TCP stream as the first packet (which you don't want), and TCP is a reliable delivery mechanism. That means that the OS knows if a packet in the middle of the stream has gone ...


0

from 'outside' of AWS you may find that the majority of your ports are fire-walled off from any EC2 instances. you need to go into your EC2 Security settings and enable access to those TCP ports ( from any IP addresses that you wish to have access to them.


2

I have finally solved this, runnning the commands manually from the configuration showed that it needed the full path to APF. Once this was added it started to work!


0

You should be setting the default policy to DROP just in case your last catch-all rule is accidentally removed; like this : *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [1:44135] Now, on the second server. -A INPUT -d 192.168.1.1/32 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT This rule ...


4

I used chain which logs everything with limits so it won't spam your syslog $IPT -N DUMP > /dev/null $IPT -F DUMP $IPT -A DUMP -p tcp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "TCP DUMP: " $IPT -A DUMP -p udp -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "UDP DUMP: " $IPT -A DUMP -p tcp -j REJECT --reject-with ...


1

Firewall cannot block individual downloads/uploads with SFTP. The connection is encrypted. The firewall cannot see that's going on between the client and the server, let only intervene anyhow. All the firewall can do is to block whole connection, but not individual operations. But the SFTP server can block the downloads/uploads based on client IP address. ...


0

if you want Intrusion Prevention System[IPS] features try simplewall UTM. it can run under monowall too under bridged mode.


0

You nees to connect the RPi to the Router and set a static IP. The need to forward all incoming connections from eth1 (LAN) to eth0 (Router), you can use iptables. You need to set up the RPi as gateway on the DHCP server of the router. You can plug a switch to the eth1 interfaces or forward al incoming connections to eth0.


1

Your port-group ManagementPorts configuration should specify the internal port number (443), rather than the external port number (8642). The NAT translation rules are applied before the firewall rules, so by the time it gets to your firewall rule, it's requesting access on port 443. That's why adding 443 fixed things.


1

I agree that VPN is a more secure solution. However, what you're asking can still be done. If you go with the solution you're suggesting, I'd highly recommend that you also replace the HTTPS cert with a valid cert, that has been signed by a root CA. Otherwise you're at risk of a man-in-the-middle attack, because the self-signed cert that ships with the ...


0

Open System Preferences > Security & Privacy > Firewall, switch to superuser by unlocking it, select Firewall Options..., click on the +, select your application server, and click on the Add button to create a new firewall entry for your server. For this new entry select on the right Block incoming connections. Check your server locally and ...


1

hi, i have a host system with 2 interfaces, eth0 and eth1. eth0 will receive packets with ip of 127.3.x.x. i want to forward these packets to go out of eth1 to a server (10.0.1). eth1 has ip of 192.168.0.100. the server needs to see the packets as if they are coming from the host (192.168.0.100). i think i can remove -m flag, but when i do, i am getting ...


0

Confirm you are receiving your IP from the DHCP on the client and it knows that 192.168.1.2 or 192.168.1.1 is the default gateway. You may have to ipconfig /release renew. Confirm on the wireless router that it does not have the DHCP server enabled, this would more than likely try to send the traffic out through it's wan port. And I assume that the wan port ...


-1

you can go for options like PAM auth or even LDAP in addition to TLS security. I can elaborate more on this if you want it , but it makes things more hard without much added flexibility. I have some other providers details so you can go for it.http://www.vpnranks.com/5-best-vpns-for-usa/


0

What is a company user doing watching Netflix anyway! But seriously, this is not the kind of question where one can give you a definite answer as it depends largely what you want to do, what you consider valuable, what improves the business, etc. However, there are a few points worth noting here that can help you make your own decisions: As pointed out ...


0

In first example you are using "--src" which is incorrect swich, you should either use --source or -s. In second example, you are creating new chain named "xchain", and you are filtering packets there. But, if you don't point packets from other chains to go traverse xchain, those filters will never get matched. Also, you've send packets from INPUT chain to ...


1

There is many solutions to record traffic or view your web traffic . transparent proxy. not transparent proxy :) router packet record dns record if the gatweway do dns proxy. And comment to add more solutions :) For transparent proxy : http://whatismyipaddress.com/proxy-check and ...


0

I had a problem with my co.'s 20Mbit conection, shared between 25 people, that sounds similar. The ISP gave us an Ethernet connection from the MPOE, which we plugged right in_to the firewall, no router. That worked great for 18 months, then suddenly not very well. The connection would slow, to as little as 100Kps, then eventually recover for a while. The ...


0

Create a few OpenVPN instances on the server, assigning them static interface names, then create interface-based firewall (iptables) rules. The instances may be listening on different ports or IPs. Every instance should have its own SSL CA to sign access certificates. If you want to avoid multiple instances, create static CN -> IP mappings with ccd or (less ...


0

This does not look like proper regular expression syntax. Try it like this: User-Agent:.*(binlar|casper|checkprivacy|cmsworldmap|comodo|curious|diavol|doco).* That should match all User Agents that have one of those strings in them.


1

One cheap and cheerful way is to look for the second packet in the three-way handshake. It's easy to spot, as unusually it has both SYN and ACK flags set, which is generally unique to a given connection. Although it is still possible for the originator not to respond with the third and final packet, that's entirely by the grace of the originator: at this ...


1

Both options are incorrect. The right answer is : An error will occur. Because DNAT can only be used in PREROUTING or OUTPUT chains.


0

To see the packet flow through iptables check the NetFilter iptables packet flow diagram. https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg In short, the routing decision occurs after PREROUTING and before POSTROUTING. Besides, I think you cannot do DNAT on POSTROUTING anyway. iptables will throw a syntax error.


2

In the Account Editor in MDaemon you can configure users to access via POP, IMAP and the WorldClient only from LAN IP's. The settings are under Mail Services and Web Services.


0

There should be a client called Remote Administration that you can use to restrict access. If they're on Activesync, just disable it on their account. http://www.altn.com/Products/MDaemon-Email-Server-Windows/MDaemon-Remote-Administration/


1

I was able to allow iOS updates while blocking PROXY-ACCESS. I had to allow HTTP Proxy under PROXY-ACCESS.


1

The short answer: The rules you created for ufw are in the INPUT chain which does not impact network traffic originating from system running ufw. You need rules in the OUTPUT chain to manage that traffic. The longs answer: The first thing to know in a netfilter firewall (the project name for the kernel packet filter firewall) rules are checked sequentially ...


0

I doubt it. As far as I know, OpenBSD still lacks the proper SMP support, is still fighting the giant lock problem and still has PF without SMP suppport. You should take a look at FreeBSD, which has these issues solved. Though implementing 10GBe+ network and services still requires more in-depth knowledge than Cisco/Juniper equipment.


0

Helps if you turn off the right part of the firewall to test things! I have set up the correct rules in my firewall and all now works as expected.


0

This was a mistake on my end. I assumed when accessing the website through the virtual IP (the one routed through barracuda waf), it would automatically translate other links accessed through that page. I realized to assume it did something like that, it would at least need to know which urls to convert. Regardless I just pointed an entry in my hosts file ...


0

As far as I can tell, there is no such feature in the FreeBSD version of pf. Maybe the OpenBSD people have something implemented on that level?


0

I ended up figuring this out. It wasn't directly a firewall issue. I have two NICs, one for the LAN and another for the DMZ, to which the WAN IP is NAT'ed. The default route was over the LAN. When receiving packets from the internet, the server tried to respond via the default route on the LAN. Disconnecting from the LAN enabled the services to communicate ...


3

There's always some other software. If there's no such software now, you can always be sure it will appear in the future. So you really want to make sure no ports except 22 and 80 are opened - just in case. You can check what's currently listening your server's ports by vieweing the netstat -an | grep LISTEN - for TCP ports. And for UDP - by viewing the ...


2

why are my DNS servers trying to connect / send data to the google dns servers? Because someone configured them that way. Simple like that. This is not "google +". It is the google public DNS infrascturcture - which is generally assumed to be quite good and fast. My best guess is that it's just trying to update the DNS cache on both sides ...


0

My first presumption would be that someone has configured Googles DNS as the forwarders for your server. Pretty common and acceptable nowadays, in my opinion. I'd triple check the config and see what forwarders are configured.


0

OK, I found it: First of all, the issue was not JIRA-specific, but just any DNS lookup from the guest or host failed. The root cause of this was the host firewall missing rules to accept all incoming packets belonging or related to already established connections. This applies to all ports, not just 53, as port 53 is the incoming port on the DNS server, but ...


0

If you're on Windows, use SysInternals TCPView. It can tell you which program is using what port.


1

Target and source tags are only available for internal use only if no network is specified on the rule, as you mentioned in your question If both sourceRanges and sourceTags are specified, an inbound connection is allowed if either the range or the tag of the source matches sourceRanges or sourceTags. So in order to make it secure, allow your local network ...


3

-A INPUT -j REJECT --reject-with icmp-host-prohibited All packets reaching that line will be rejected. All the rules after it will be ignored. Further reading: iptables rules ordering


2

There are a variety of resources online for finding the IP blocks allocated to countries (generally for blocking purposes). Assuming you have adequate hardware router capacity or are running your routing on an adequate PC, you'd need to get the IP blocks for your country, set up a hardcoded remote access address for yourself, then set up rules to allow ...


1

Sorry for the long delay in response here... Are we talking about Smoothwall Express or our commercial offering? If it's the latter then there are a number of things you can check/test. Upload/Download limits can be modified under "Web proxy » Web proxy » Settings - Advanced - Web filter options" with options of [Allow unlimited uploads], [Block all ...


0

I had an issue with pptpd + ufw - requests to DNS were blocked even if I allow 53 port. Have you tried to open /etc/default/ufw and change the option "DEFAULT_FORWARD_POLICY" from "DROP" to "ACCEPT"? It did the trick for me.



Top 50 recent answers are included