New answers tagged

0

You have no rule to allow outgoing, although your rules for ports 22 and 443 appear to be bi-direction. You should be filtering ICMP on the external interface, and allowing DNS traffic on port 53 (both UDP and TCP). I would recommend you use a n IPv6 capable firewall builder. There are ports that you likely want to block outgoing traffic on even if you ...


4

tcp/53 DNS tcp/88 Kerberos tcp/135 RPC tcp/445 sysvol share tcp/389 LDAP tcp/464 Kerberos password (Max/Unix clients) tcp/636 LDAP SSL (if the domain controllers have/need/use certificates) tcp/1688 KMS (if KMS is used. Not necessarily AD, but the SRV record is in AD and clients need to communicate with the KMS). tcp/3268 LDAP GC tcp/3269 ...


1

The client will need to access Kerberos so that's TCP 88 Then there is the Global Catalogue service so that's TCP 3268 There is the KPassword service TCP 464 (this allows password changes) Then there is LDAP port TCP 389, clients still need to access this to help locate domain controllers. There are also UDP ports for Kerberos (88) and KPassword (464) I am ...


0

If anyone is actually interested in reordering their UFW rules, and landed here this is how you do it. $ sudo ufw status numbered To Action From -- ------ ---- [ 1] 22 ALLOW IN Anywhere [ 2] 80 ALLOW IN Anywhere [ 3] 443 ...


0

Thanks for the suggestions. While the initial question wasn't totally addressed, the guided questions did help me figure things out further. I'm sure I'm not the only one who may have this problem in the future, so I'm posting my answer. What is happening, (as I did suspect) is that in the iptables, there are a few rules that capture traffic on selected ...


0

Network is responsible for communication between two devices. Since you can telnet to port 22 successfully, it is NOT a network problem. Is that an old ubuntu server? Do an update on your ssh client, remove all entries for that server from your ~.ssh and try to ssh again.


0

you can use some network sniffer tools which will pinpoint to process level which one is sending what. You can as well filter if needed. some examples: network monitor 3.4 (microsoft) outdated, but works well. fiddler ... (other most probably) Give network monitor a try and within 15 minutes you know where to look next.


1

netstat -b -o lists the network connections, process and PID - you should be able to figure out which IIS worker process is doing all the port 25 connections.


0

Where is the Web-Server running from ? If it is running on your physical machine - my best guess is that it is running on your 127.0.0.1 Ethernet. You could have given it a Alias in Apache Httpd config so it would appear like an FQDN. But for a better chance of an answer please supply OS Web Server Type (Apache IIS etc) At the moment it is all rather a ...


0

Test the destination Link (IP) using the traceroute/MTR commands. https://www.digitalocean.com/community/tutorials/how-to-use-traceroute-and-mtr-to-diagnose-network-issues it will give you the hop where non-working systems are stopping at. If it is firewall then you may need to look for the specific ports such as for a website http/https. And for your ...


1

You could see on your iptables config an see such entries: -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT -A INPUT -p tcp -m tcp --dport ...


0

Turned out there was an applied ACL that filtered ALL ports based on a list. We found it and added the needed protocols to the list.


1

It looks like Docker tampers directly with IPTables. It is possible to override this behavior by adding --iptables=false to to the Docker daemon. Edit /etc/default/docker and uncomment the DOCKER_OPTS line: DOCKER_OPTS="--dns 8.8.8.8 --dns 8.8.4.4 --iptables=false" Source: http://blog.viktorpetersson.com/post/101707677489/the-dangers-of-ufw-docker


0

I found out on my server that the /usr/local/cpanel/scripts/update_spamassassin_config script accesses these whois servers for updating its configuration. Maybe this has to do with spamassassin in which case it is very probably legitimate. If this is running on a server with spamassassin please check its update interval.


1

There is no difference in haproxy configuration. If you're having problems with being behind a firewall, then the issue is likely with your firewall. Specifically in your case, I bet it's a problem with either your NAT rules or your firewall doesn't allow internal users to access resources via the external IP.


1

As stated in previous reply's, you can't access your server with domain:port because your hosting provider has that port blocked. Before you contact them and ask to allow access to your server's IP from port 8025, test connection with telnet: telnet domain 8025 You should get error that looks like this: telnet: Unable to connect to remote host: Connection ...


0

You might have to run caspol.exe on the IIS DMZ server, per this question: Permissions issue with virtual directory to UNC path Also, use a service account for the app pool. It will have to have the same name and password in the domain and as a local account on the DMZ server of course.


1

You have to add the SNAT rule to the nat table and not mangle. You could also add the rule directly to the active table using: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j SNAT --to-source 192.168.1.230 And if everything is working save it to a file using: iptables-save > file


0

This should do it. (%{GREEDYDATA:srcint}:%{GREEDYDATA:srchost})|(%{GREEDYDATA:srcint}) also test with http://grokdebug.herokuapp.com/


-1

you can also try a SAAS solution for managing iptables -> https://www.efw.io/Forum it can do AWS cloud integration also.


0

Updated Answer to Address Updated Question New key information: There is no possibility of temporarily configuring an ethernet port on the ASA to provide IP communications. As a result any answer cannot require the use of ASDM (HTTP/HTTPS), TFTP, SSH, or Telnet. Answer The answer is that if your only way to connect to the ASA is via the console cable and ...


2

Before answering the questions, I'd like to address some of the assumptions in it. The firewalling properties of NAT were also beneficial for security. This is often-repeated, but simply not true; see below. IPv4 NAT firewall rules are "block incoming packet remote-address:port -> local-address:port, unless sent outgoing packet local-address:port ->...


3

SPF checks occur early on in the conversation so the sender (probably) doesn't get a chance to send the email before the attempt is rejected. So no, they're not recoverable.


0

NAT reflection is disabled by default, so tests from your internal network are going to fail. From pfSense's Troubleshooting Guide: Port forwards do not work internally unless NAT reflection has been enabled. Always test port forwards from outside the network, such as from a system in another location, or from a 3G/4G device. I think I've tripped over ...


4

First Step block DNS TeamViewer client using port 80 for the outbound connection, it is difficult to block using port basis. So, because TeamViewer client must be connected first to the TeamViewer server, we can use another aproach, that is blocking every dns request for the *.teamviewer.com and/or *.dyngate.com. Second Step block IP Address Range The ...


0

You are probably routing the answers to the wrong interface. ip route add 239.255.255.250 dev wlan0 Should do the trick.


1

FTP is using TCP exclusively. Your ftp server might use UDP to resolve ip addresses. If you are using conntrack for accepting related packets You don't need additional rules for any UPD packets (incoming DNS reply will by accepted by --state RELATED rule in your firewall). Having said that FTP in passive mode requires establishing a TCP connection to ...


0

I'm almost certain a DOS or DDOS attack is UDP, or at least it can be, but check this out. https://www.us-cert.gov/ncas/alerts/TA14-017A It was last updated April 13th 2016, so it's definitely still applicable. It's just a list of all the different types of UDP ports and attack types.


-1

You certainlly can open/forwarding the 445 port for SMB in firewalled network(s), even with public ip/domain. Ex: \\your-domain.com\shared-folder



Top 50 recent answers are included