Tag Info

New answers tagged

1

The issue is you don't allow new connections to be established to MySQL and you inverted sport and dport : Chain INPUT (policy DROP) ... ACCEPT tcp -- 10.99.0.12 anywhere tcp dpt:mysql state NEW,ESTABLISHED ACCEPT tcp -- localhost anywhere tcp dpt:mysql state NEW,ESTABLISHED ... Chain OUTPUT (policy DROP) ... ACCEPT tcp -- anywhere ...


0

For me - to make it work - I also had to add --disable-eprt as well: curl --disable-eprt -u username:password -P - ftp://whatever/source.file


1

For starters, it doesn't take much at all to tie ip a t1.micro instance - if you want the instance to do anything meaningful, you want to be using a larger instance type. As for blocking requests - you will not be able to drop traffic using the instance's security groups, as it lets you allow traffic, not drop it. You can run a local iptables firewall on ...


0

If nothing is listening on the server already, then I usually simply start a service on the port. Modern firewalls may use packet inspection though, so it's no guarantee that what you aim to have listening on the port is going to work. You can do this with nc like (for example for TCP on port 6667) nc -l 6667 Then try telnet or nc on the sending end. If ...


1

This is difficult (if not impossible) to do depending on your access to resources. If its a Unix based server I'd run tcpdump on the server (in such a way that it only listens to the traffic on the port you are interested in), and then try and connect to it via Telnet. Telnet will, of-course fail, but at least you should see the incoming server attempt ...


0

What you are seeing from telnet is correct, you can't do what you want to do. To have an open port, you have to have something listening on the relevant IP:Port and nothing actively blocking it upstream (e.g a firewall).


1

The NAT entry you added looks correct, now you need to allow that traffic through your INBOUND ACL. Since it is an extended ACL you can edit it directly: ip access-list extended INBOUND permit tcp any host 212.9.28.216 eq 110


0

you don't have to use route-map. you have to mark your interfaces ip inside and ip outside accordingly, create a ip access-list for NAT and modify the ip nat statement.


0

I know this is an old post, but it could solve someones problem. I had the same error, and it was because I have a typo. The error that was thrown was in "COMMIT", the last line, but in fact was this one: -A RH-Firewall-1-INPUT -p tcp -m udp --dport 161 -j ACCEPT The error was that it says in the same line "tcp" and then "udp". So changing that line ...


0

I ssh into my machine. What should incoming and outgoing rules? Why? You don't need to bother with any rules on the server itself. There's no need to run a firewall locally, and if you do it will just introduce some confusion. What you want to do is create a security group for your instance and define any rules there. This is how Amazon defines ...


0

Create a new firewall rule. Select program option. Select this program path. Paste %systemroot%\system32\svchost.exe into path. Accept warning message. Allow for all connections, give name. Turn firewall off/on. Done.


0

It's not possible without connection tracking. Basically router must be able to: track incoming and outgoing connections mark them direct through different routing tables based on connection mark. Check if your router supports this. If not and you really want to load balance traffic), you can replace it Mikrotik routers (almost any model will do). It's ...


0

In order to allow SSH outbound, an explicit rule will need to be added to the configuration. The access-lists that you show above in your configuration shows something a bit odd... You may need to add: access-list acl_out permit tcp any any eq ssh Please try and report back. Edit, what troubleshooting steps have you tried? Are you attempting to ...


1

make sure your trusted ips in named.conf reflect your front end router.


1

The statement "Security Group settings do not affect internal IPs " is incorrect. You have to add the inbound traffic to the security group for the private IP, just like an external IP. I had to add entries from a specific private IP so that I could allow one instance to conenct to another using subversion, CouchDB, map a network drive, etc. However, ping ...


0

This is doable, I just did it for my kid's computers. Just create the entries below in Task Scheduler. Note that this is not super-secure, since it doesn't account for things like multiple sessions from remote desktops, etc. That said, hopefully it will help a lot of people viewing this topic. Also, note the 30-second delay in Step 2 before the firewall ...


-1

Regarding your query you can flush the iptables content using the below commands. Command to flush the IP tables sudo iptables -F Command to restore the iptables rule-set that was saved with the iptables-save command iptables-restore [-c] [-n]


3

Yes, at this point you need to have someone reboot the system. If you didn't make the change persistent it should be okay. When I have to make changes to iptables and have no way of recovering, I put a cron job up to revert the iptables changes to the last known saved state. You can use iptables-save and then run iptables-restore in your cronjob. So it ...


0

I would suggest the mod_proxy_wstunnel module available in Apache 2.4.5 onwards. It allows you to relay from a URL to another websocket server on any port. e.g. To take your example: ProxyPass /ws1/ ws://websocketserverA:800/ ProxyPass /ws2/ ws://websocketserverB:801/


0

Let's assume you have a SSH on your serverA on port 22. serverB tries to connect to it. It sends a packet from a random port within a net.ipv4.ip_local_port_range (3252 for example) to serverA 22 port. serverB:3252 -> ufw incoming allow 22 -> serverA:22 So on serverA connection gets allowed because incoming connections on 22 port are allowed, but but ...


0

Fore reference, I found the answer here: http://openvpn.net/index.php/open-source/documentation/howto.html#policy


0

Presuming you are running your own internal DNS server, you can be authoritative for the "example.com" zone and then forward all other queries to something like OpenDNS or Google's public resolvers (or act as a recursing resolver, which is not hard). In your internal authoritative "example.com" zone, you will need to have records corresponding to all of the ...


1

It has nothing to do with CAT6 cables. The problem is with the software update/configuration stability. I had the same issue, I could only get a bandwidth of 60Mbps out of a 120Mbps pipe. I tried the suggestions, and replaced the cables to CAT6, but actually it remained at the same speed. Then I saved the config, and did a HW reset on the ZW USG50. Guess ...


1

You can create a sub-interface on your LAN interface (X0, usually) and use VLAN tagging to separate the traffic. In Network > Interfaces there is a "Add Interface" button.


1

Yes, you can do this, it's not intuitive though. Also, you should have been able to find the documentation through Google? Here's the document: http://www.sonicwall.com/downloads/supporting_multiple_firewalled_subnets_on_sonicos_enhanced.pdf Example #1 Default NAT Mode with secondary subnet Create Static ARP entry for the gateway address of ...


1

The First IP is the IP that has been resolved by the DNS-Server. The second IP should be your Router that tells you that the TTL expired in transit. So when the destination is not reachable. The last router gives you an error.


0

It's probably the health checks that are triggering the ban, as they're not sending a hostname. You can try using 'httpchk' or 'ssl-hello-chk' instead, which might resolve the issue and allow you to re-enable fail2ban.


2

Using fail2ban v.0.8.6: $ sudo fail2ban-client status # to reveal your JAIL name (mine is ssh) $ sudo fail2ban-client set ssh delignoreip your_ip_address $ sudo nano /etc/hosts.deny # delete your ip address $ sudo fail2ban-client reload


2

The proper way of doing this is to contact the vendor, typically via a support ticket. I don't know if Dell/SW offers tech support if you're not paying maintenance, but it's worth finding out. An x86 server has a fairly standard hardware architecture so that you can run the vendor's diagnostics, or your own that you download, for testing RAM, faulty CPU, ...


-1

In Mint 17 I found this in /lib/ufw not /usr/lib/ufw all the IPtabled version rules are here and allow me to edit them as I desire.


0

While HTTP downloads via de browser and FTP downloads via an FTP client were awful from a few specific internet service providers (ISPs), HTTP downloads via curl/wget and FTP uploads went absolutely fine. In the end we fixed it by replacing the firewall. We're thinking it might have a faulty network interface card (NIC), since its second NIC was already ...


3

The rule is not in your iptables so as it stands the port is not open except on your loopback interface (line 4). Try running the command again. You might also want to insert it somewhere other than the beginning of the table too iptables -I 5 INPUT -p tcp --dport 8095 -j ACCEPT If his works then save the state of your firewall however your distro does ...


1

Working on Windows Server 2012 R2 Core, this worked for me: Set-NetFirewallRule -DisplayGroup "File And Printer Sharing" -Enabled True Here is how to check if it was succesful Get-NetFirewallRule -DisplayGroup "File And Printer Sharing" And find the value in "Enabled", it should be set to TRUE. More info and arguments can be found here: ...



Top 50 recent answers are included