Tag Info

New answers tagged

0

One thing that works is configuring Putty - in Connection / SSH / Tunnels, add individual ports, e.g. in this case, local 8080 needs to point to 10.0.0.123:80, so Putty will say L8080 10.0.0.123:80. Port forwarding in Vagrant/VirtualBox can be removed, it doesn't seem to work.


1

First, you need to modify your distribution rules to match the following. Have a look at this post. --mode nth --every 3 --packet 0 --mode nth --every 2 --packet 0 --mode nth --every 1 --packet 0 As stated, the counters are not globals. So, you need to change your rules to match the remaining packets. Second, you need to make sure you are really using a ...


4

You are tackling this problem at the wrong layer. Literally, layer 4 when you should use layer 7. Don't log TCP connections in iptables. Instead, capture HTTP traffic and inspect the Host header in the requests that the clients are making.


7

I'm not sure i get the whole picture but since you are writing about websites i think you are using a tool that is not exactly suitable for the task. imho you are looking for that information (the visited domain name) at the wrong level: you should have a proxy and analyze its logs to gather that info. A proxy is 'near' the client and has the exact and ...


3

iptables -L -t nat is what you're looking for. As you specify the table when you add the rule, you have to specify it to see it.


5

You cannot easily determine what the user typed into their browser's URL bar using just an IP address log: You can't tell if someone accessing 104.16.13.13 got there by typing aviation.stackexchange.com or tex.stackexchange.com (the best you can determine is that it's a CloudFlare IP address). In order to get the information you seek you would need to ...


0

Check you have the NFQ kernel module loaded: lsmod | grep nfnetlink_queue Check to see if packets are matching those iptables rules sudo iptables -vn -L To just use the Suricata target for MySQL, the following should work: sudo iptables -I INPUT -p tcp --dport 3306 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --sport 3306 -j NFQUEUE


0

I faced with same problem, so this works at my web-server: iptables -I INPUT -m string --string "announce.php" --algo kmp --to 65535 -j TARPIT I've added this rule at the top. You cat use DROP instead of TARPIT(yes, I'm a bad and forced —Āhinese to suffer :-D).


3

Portspoof is a tool which will allow you to emulate a lot of services listening on a large number of ports. Its primary use is to confuse port scan attempts, but it may also fill your needs.


0

This is resolved! I was missing the following rule in my IPTables ruleset: iptables -t nat -I POSTROUTING 1 -o eth0 --jump MASQUERADE


4

Notice the line in your netstat output ... tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 18843/nodejs Specifically the local address of 127.0.0.1:8080. That means that nodejs is only listening on the localhost address and so only will accept connections from the same machine. I don't know (off the top of my head) how to ...


0

Finally I solved my specific case with running nginx as reverse proxy, available from localhost only, using proxy_bind directive. From my scripts I should make queries to something like http://localhost/nginx-proxy-ip-N/https://api.example.com/?q=123


2

In this particular case, one iprange rule might be slightly faster than two CIDR rules, but the difference is so small it will likely be unnoticeable. Unless you're routing multiple gigabits per second, it's not worth trying to optimize here, and if you are, you should probably buy a purpose-built router anyway. I recommend you use CIDR comparisons anyway, ...


2

There are several protocols that Git can use, which are documented here - the most common of which is SSH, which is used on GitHub (both public and Enterprise flavours) as well as Gitosis and Gitolite. To use Git over SSH, you will need to open port 22 outbound, and to use the much rarer Git protocol, you'll need to open port 9418, which you already have, ...


0

For 512 source IPs, there won't be even a slight significant difference.


0

-A appends. This adds the rule in the end of the rules list, so incoming connection could be dropped by a rule higher in the list. To make sure that all connections from or to an IP address are accepted, change -A to -I which inserts the rule at the top of the list: iptables -I INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT iptables -I OUTPUT -p tcp -d ...


0

You have at least three possible solutions. Setting up policy based routing on your private PC. (hard to setup, more permanent, pretty) http://lartc.org/howto/lartc.rpdb.multiple-links.html Set up ssh port forwarding. (easy, junky solution) https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding Set up destination NAT (PAT) and source NAT @ VPS. ...


0

I think I've hit similar problem years ago. You can give a shot for: --multihome Configure a multi-homed UDP server. This option can be used when OpenVPN has been configured to listen on all interfaces, and will attempt to bind client sessions to the interface on which packets are being received, so that outgoing packets will be sent out of the ...


2

To allow from only certain IP or range use the -s flag and an ip and netmask for example sudo iptables -I INPUT -p tcp -s 10.0.0.0/25 --dport 5000:5020 -j ACCEPT -m comment --comment "Allow Ports 5000s" Will allow only from systems with an IP of 10.0.0.1 thru 10.0.0.126 There is more information here IP Tables How TO To help you find a subnet to use to ...


0

You can use a GeoIP service to obtain the list of known China IP, and then forbid their connection with iptables. Have a look here GeoLite2 Free Downloadable Databases and download the CSV file. From the file GeoLite2-Country-Locations-en.csv you can find that China has a geoname id of 1814991. You then use that value to filter ...


-1

Well, get the IP range of all public IPs in China, add them to iptables with DROP. Stupid idea though, you should be using some DDOS-avoiding options (for apache for example: mod_evasive or mod_security) or even plain old limits in iptables like: iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ...


4

If you're trying to mitigate DDOS attacks, then you need to have your ISP block the bad actors at their level. Once the DDOS traffic has hit your router/firewall/server, it's already eating up your bandwidth.


2

Replace -i eth0:1 with -d 1.1.1.1/32 I believe you have used ifconfig to create interface alias. Actually you can assign more than one IP for interface with iproute2 utility(ip addr add ..). It's better to use IP addresses in iptables rules.


2

Formal answer: go to VPS management panel, get local access (virtual KVM) somehow or call them. Explanation of steps/rules to prevent falling for it again: There are ip, routing and firewall rule changes that may go bad and block your access. and it applies to dedicated network device configuration too, not to VPSes only So unless you are 100% sure that ...


0

If you use same website name you will get same IP to connect to. You can use iptables to change the destination IP from IP1 to IP2 (dev server) on port condition.


2

A general way to fix a broken instance is to shut it down and attach the root volume to a working instance. You can then mount the volume there and view logs or edit configuration files. You can then detach the volume and start it up in its own instance.


29

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.


43

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.


55

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see if you can boot the VM to a recovery linux CD (some providers offer this) and then correct the firewall rules that way and then boot it like normal. If you ...


0

The 3 rules required are: iptables -t nat -A POSTROUTING -o eth0 -s 172.19.233.0/24 -j SNAT --to-source 46.aaa.xxx.bbb iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport ! --dports 22,53,80,123,443,1194 -j DNAT --to-destination 172.19.233.2 iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport ! --dports 53,123,1194 -j DNAT --to-destination ...


0

If you need temporary workaround you can use ssh port forwarding ssh -R 3306:1.1.1.1:3306 127.0.0.1 -N In this case you have to permit GatewayPorts in sshd_config GatewayPorts yes Also do not forget to open this port in iptables


0

As it seems that 1.2.3.5 and 1.2.3.189 are on same subnet, server 1.2.3.189 will try to reply with its own IP (layer 2). you should also SNAT returning packets from 1.2.3.189 to 1.2.3.5 adding : iptables -t nat -A POSTROUTING -s 1.2.3.189 -j SNAT --to-source 1.2.3.5


0

Thanks Matt! I figured it would be something easy like this. So I need to use the FORWARD rule, not the OUTPUT! I don't have to worry about IP address changing, since this server also provides DHCP and I assign them to appliances based on MAC address. But I see how your suggestion would work in a different scenario. As to the routing comments...I am a cut ...


0

This won't work. # # (6) OUTPUT rule to allow a client LAN access, but DROP internet access # I use this to prevent various home appliances from accessing the internet # iptables -A OUTPUT -s 192.168.10.110 -j DROP The reason it won't work is the OUTPUT table only filters traffic originating from your router, rather than passing through it. You want the ...


1

You may need to reload systemd after adding\updating services ("units" on systemd language). See daemon-reload Reload systemd manager configuration. This will rerun all generators (see systemd.generator(7)), reload all unit files, and recreate the entire dependency tree. While the daemon is being reloaded, all sockets systemd listens on behalf of ...


1

Let me suppose the following 3 things in your setup : you have a default policy on the INPUT table of ACCEPT (it is the default value). your packet / byte counter on the last rule -A INPUT -i all -p all -j REJECT is 0 you do not have an interface named 'all' AFAIK the -i parameter does not have a key word like all, so it is considered as an interface ...


3

The messages aren't starting with iptables-denied: because [221395.082051] is actually part of the message. The kernel can be configured to produce log messages with or without a time stamp indicating how many seconds after boot a particular message was produced. Once the message reaches syslog there is no longer any knowledge of the structure of the ...


1

I was running into this issue while using a home OpenVPN server and connecting to it using the Tunnelblick application on Mac. What was happening on my end is that a route with my home IP as the destination and an incorrect gateway was getting leftover after disconnecting from the VPN. Deleting this route solved the issue, simply $ sudo route -n delete ...


7

The problem is that you can't refer multiple IP ranges in a single iptables rule, but using multiple rules indirectly leads to a disjunction (logical OR): connections will be logged if they match your first, OR your second rule. What you want, is a conjunctive behavior (logical AND): new connections coming out of 10.51.0.0/16, AND also out of ...


0

Depending on version and distribution, sometimes you have to activate the iprange extension: iptables -A INPUT -s ! 10.51.0.0/16 -m iprange -j LOG


6

Incoming connections are always going to match one of those rules aren't they? A connection from 10.51.0.1 for example won't get logged by the first rule but will hit the second one. Don't you need the equivalent of !10.51.0.0/16 && !192.168.0.0/16 (probably not valid syntax but correct logically).


0

I had the same issue. In fact, there was no iptables-persistent in /etc/init.d So, I created the iptables-persistent file in /etc/init.d nano /etc/init.d/iptables-persistent and wrote the following inside: #!/bin/sh # Written by Simon Richter <sjr@debian.org> # modified by Jonathan Wiltshire <jmw@debian.org> # with help ...


0

one option is to remove the service: https from the zone firewall-cmd --zone=public --remove-service=https and then use what is known as rich rules to specify what sources [IP addresses] may access what service [such as http and https] like so: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="x.x.x.0/24" service name="https" ...


0

Use: iptables -I INPUT -s 77.35.0.0/16 -j DROP iptables -I INPUT -s 95.159.0.0/16 -j DROP


1

Usual solution (as far as I know and certainly what I've implemented) is combination of iptables (to restrict direct access) and then providing access via reverse proxy in Apache, Nginx, your web server of choice. Web search for "securing elasticsearch" brings up plenty of relevant stuff. Depends exactly what you're tryng to do whether reverse proxy is ...


1

Your server is listening on IPv6 only. Are you sure your nmap is trying to connect through IPv6 and not IPv4 ? You can test nmap with IPv6 with the option "nmap -6"


1

I think what you really wanted was something based around the hashlimit module.


0

It doesn't work on pure IP-level, one needs to know how DHCP does work: At first, the DHCP client does send a packet (DHCPDISCOVER) from 0.0.0.0 to 255.255.255.255 (the local broadcast address). The DHCP server will offer an IP address (DHCPOFFER); in terms of iptables, this will be a packet from the DHCP server's address and also targeted at the local ...


0

I was trying to help slow down the spam running through EXIM and enabled some new Blocklists on CSF. There is a setting at at the bottom of the CSF config page called "lfd Blocklists" to enable or disable some pre-configured ones. I commented out a few and it started up again. Some of the blocklists can add thousands of IP's to the firewall. When you reach ...


0

You forgot to allow outgoing DNS queries, thus ssh can't find the IP address for the hostname. You need to allow outgoing traffic to TCP port 53 and UDP port 53.



Top 50 recent answers are included