New answers tagged

0

It could be done using a bridging firewall. I had to do that at an old workcenter where our department wasn't allowed to create a private network, so I put up a bridging firewall (linux iptables and bridging software) between the link outside our network, and everything inside. You have to do some extra tricks to do it but it works. Here is one link that ...


1

Public vs private doesn't really matter here, you can use either one. However, I think you'll find that it's very tricky to implement what you're looking for without placing your existing servers into a dedicated subnet, private or public, for which the new server/FW acts as a gateway, because that's the most natural way to get traffic to flow systematically ...


1

If all the devices you want to access are behind a proper firewall, and you have a full infrastructure behind each one to support it, I'd go for Citrix VDI, and put a virtual desktop at each location so you could remotely connect for management and maintenance. In terms of monitoring, PRTG can do what you want. You can have remote probe devices ...


1

Your config is correct to send 993 destined to your WAN IP to 10.0.1.2 port 993. Go through the troubleshooting steps. You can eliminate at least common problems 1, 6, 7, and 10-14 and probably more than that. https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting First I'd filter Diag>States for :993 when trying to connect from the Internet, and ...


1

This is the document you are looking for: Active Directory and Active Directory Domain Services Port Requirements Default dynamic port range In a domain that consists of Windows Server® 2003–based domain controllers, the default dynamic port range is 1025 through 5000. Windows Server 2008 R2 and Windows Server 2008, in compliance with Internet ...


0

Unfortunately you can't use UNC paths to refer to locations on FTP. UNC paths imply SMB/local Windows paths. An alternative would be to mount a FTP site as a local drive, and then pass that local path to your tool. See e.g. http://www.thewindowsclub.com/map-an-ftp-drive-windows


0

Your setup looks good. You should look over iptables-persistent to make your firewall start up automatically after VPS reboot. It works really well (it is just a service which start in boot time and modify firewall with saved ruleset).


4

When you set your default policy to DROP and ACCEPT only what you need, this is clearly more secure than allowing everything by default and selectively DROP unwanted traffic types. This at least saves you from securing the services that are not meant to be accessed remotely (from outside your machine or your LAN). Your system is more secure when you expose ...


0

Many people don't care about %SystemRoot%\system32\inetsrv\inetinfo.exe While creating the FTP server on Windows Machine. The application must be white listed before you access the connection from your sub-net or the internet. First you allow these ports: 80, 20, 21 for both HTTP and FTP. Then add exception for "inetinfo.exe"


0

You can do this my configuring iptables to 'mark' the messages e.g. iptables -A INPUT -s 192.0.2.0/24 -j LOG --log-prefix='[iptables] ' Which will cause a log message that is prefixed with the text [iptables] Now you can configure your rsyslog to send these messages to a particular log file by adding a suitable entry to it's configuration e.g. ...


0

there is a way to log packets in IPTables. first you need to create new chain to logging packets. iptables -N LOGGING then you need to append which packets you are gonna log using following commands. iptables -A INPUT -j LOGGING iptables -A OUTPUT -j LOGGING now you can log the packets to the syslogs using this. iptables -A LOGGING -m limit --limit ...


1

Your firewall is missing major part. The first packet go to outside correctely (as the OUTPUT policy is ACCEPT). The fist incoming packet is rejected as there is nothing allow in INPUT rule. You should have a iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT to allow the connection tracking to allow the packet to come. The second packet will ...


1

You need to allow incoming packets, related to your outgoing connections. iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT If that doesn't work: iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Differences are discussed here: ...


2

Running things via VPN is essentially slower due to the additional network hops and encryption. If you must use a VPN, consider where the VPN is located (latency purposes) and the speed your getting from the connection.


0

First of all, inside LAN your traffic won't be routed through the router, when you are accessing the server with it's LAN IP address. This is a traffic inside the LAN, and you will be connected directly without port forwarding need. Secondly, bot ftp client, but ftp server runs on port 21. So if you want to connect to the FTP server, then there should ...


1

Rackspace now has Security Groups! Before this, though, it would certainly be possible to use a Linux box as a firewall. The Vyatta server image is designed just for this purpose—though it's not a "cheap server" at $6.24/d, it is a cheap firewall.


0

What you think of for UNC paths \\server\share are typically for SMB/CIFS aka "Windows file shares", not FTP. You can use a free Samba server to host the files you need and they'll be accessible by a UNC path: Some links for you: https://www.samba.org https://www.samba.org/samba/docs/using_samba/ch01.html Here is Samba file server setup for Ubuntu: ...


1

First, all the rules you have listed above is added to the INPUT chain, which deals with packets destined for the local server/pc (from outside) . Second, they are either blocking incoming requests from known private ip address block ( -s for source) or to broadcast or reserved addresses (-d for destination) So, there is no apparent reason for those ...


0

Although telnet or netcat can be used to determine port reachability, nmap is the standard port scanning tool. The nmap default option (TCP SYN scan) determines if a given port is filtered or not by a firewall. nmap -sS <host> -p <port> If you want a reliable differentiation between the open, closed, and filtered states, use the -sY option ...


3

well if you use telnet command to check the port connectivity, it will show "connection timeout" if the port is blocked by the firewall "Connection refused" if the service is down/not listening on specified port, but port is reachable. "connected to server_ip" if connection is successful


2

PSExec uses RPC, which uses a randomly allocated port; for modern Windows, that is in the 49152+ range. IF you're using Windows Firewall, there's a built-in "Remote Service Management" rule that will allow those dynamic ports. There's also some registry tweaks to customize it, if you feel the need to.


1

If you have assigned Instance Level Public IP Address(ILPIP or earlier known as PIP) to your instance then you won't be able to restrict the inbound traffic unless you configure that particular instance's OS level firewall or create NSG because the sole purpose of ILPIP is to receive traffic from external sources on dynamic ports meaning anyone can send data ...


2

Your server is not listening on port 587. I accept that you think you've been able to connect to it from some other machines, but I can only surmise that they've been going through some kind of transparent proxy which has hijacked connections to mail-server-type services, and whisked you off to some local mail server. In other words, the machine that can't ...


0

If the packet come thru the WAN's port you have no choice but to activate the setting. (Enable management via WAN) If the packet is seen from a LAN's port, but only from another subnet you need to define those subnet in the sonicwall, and to make allow rule for them. See that picture for an actual example; nb. You miss a network diagram to help


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


2

Well, if your application works for your clients, it works. If it doesn't, it doesn't. That's about all there is to it, unless they have some sort of L7-aware "fuzzy" matching going on that may permit some traffic to your app and deny other traffic, in which case the network team needs to be involved. If your clients want to use your application, the onus ...


1

Instead of using an endpoint acl take a look at a Network Security Group, applied to either the Vm or the vnet check https://azure.microsoft.com/en-us/blog/network-security-groups/ and ...


0

Blocking suspicious IP's in firewall definitetly makes sense. Actually this a common measure applied by many IDS, IPS or firewall vendors for protection (Google also maintains it's own blacklist). Have a look at this wikipedia article on blackilist for some insight. There are different companies/organisations that maintain and offer blacklists for free or ...


0

If you have standard outgoing policies configured that allow ssh, http, ftp, ftps etc. from interal LAN, then you don't need to create a new rule for a specific external host ip address. You also need not to create a new SNAT rule for it. From your description, it seems the target host may got listed in Watchguard's block lists due to it's Default Packet ...


0

under the policy-map "global policy" enable http inspection also. HTTP in basic operation, i dont think require any inspection via Firewalls, though, in my personal experience I have seen this and thought that might be the case for you even. Try to make that enable and let me know the results.


1

I see lots of conflicting answers here and given this is the first article in Google with the right keywords; here is the correct explanation. It's simple: DROP does nothing at all with the packet. It does not get forwarded to a host, it does not get answered. The manpage of IPtables says it drops the packet on the floor, i.e. it does nothing with the ...


0

List of per-country IP blocks in a format that can be easily used by many firewalls (I am using PF tables on FreeBSD which can be loaded from a file): http://www.ipdeny.com/ipblocks/


0

Your IPv6 traffic does not match any of the rules, therefore matches the last rule, which is an explicit deny rule. First you need to make sure IPFW does process IPv6 traffic. This is done by enabling it using sysctl: sysctl net.inet.ip.fw.enable=1 IPFW supports various IPv6 specific keywords, like me6 instead of me. So you may want to add rules like the ...



Top 50 recent answers are included