Hot answers tagged

2

Before answering the questions, I'd like to address some of the assumptions in it. The firewalling properties of NAT were also beneficial for security. This is often-repeated, but simply not true; see below. IPv4 NAT firewall rules are "block incoming packet remote-address:port -> local-address:port, unless sent outgoing packet local-address:port ->...


2

The time module will deliver close to what you are wanting; the below covers 2:00am to 6:00am every day (read up on this module for further information as it does also allow for targeting on a per day of the week basis): -m time --timestart 02:00 --timestop 06:00 but you would need to create many rules to achieve your "every 5 minutes" requirement. Also ...


2

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Yes.* Or is it potentially more complicated than that? No.* Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router ...


1

After getting an overwhelming number of responses on SF... not!?!, I did my own research the figured it out. This is how I did it. Configuration -SSH to Host A and update /etc/network/interfaces as below: auto lo iface lo inet loopback iface eth1 inet manual auto vmbr1 iface vmbr1 inet static address 10.0.2.99 netmask 255.255.255.0 ...


1

Changes made with firewall-cmd are only persistent when you (also) make them persistent with --permanent... man firewall-cmd --permanent The permanent option --permanent can be used to set options permanently. These changes are not effective immediately, only after service restart/reload or system reboot. Without the --permanent option, a ...


1

Dropping the [RST,ACK] and [FIN,ACK] will not work. There are many application like ftp upload that will simply fail to ack the completion of the FTP transfer. The comments by gscott are the correct method, but one additional requirement is needed. You must make them strict by applying the policy iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -...



Only top voted, non community-wiki answers of a minimum length are eligible