New answers tagged

0

iptables-DNAT rules will be replaced with the following settings. (Script execution user's .ssh/config) Host 10.20.30.40 Hostname 127.0.0.1 Port 1234 If ssh-portforward is running with the same user, I think it good to use the ProxyCommand. Host 10.20.30.40 ProxyCommand ssh server1.test.com nc %h %p


0

Beware: read this only if you have root access to both source and intermediate machines. Since you say source machine (let's call it A ) has no way to contact the destination one (called C ), I assume that there are routing or permission restrictions that prevent this. Restrictions that the intermediate (machine B) can avoid. You can make the source machine ...


0

Either use VPN connections for this (all machines connected via private network) which is safer or port forwarding (which is not a bad idea), just remember to limit connection IP pool on machine in private network.


1

Your first iptables rule is correct and sufficient to do the job. I'd consider explicitly specifying an incoming interface such as: iptables -t nat -A PREROUTING -i ${wan_if} -d ${jumper_ip} -p tcp --dport 22 -j DNAT --to-destination ${invisibleserver_ip} But this is not required. Your POSTROUTING rule is a bit flawed. I don't think it is going to break ...


1

Got it work by changing -i to -d: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.0.100:22 where x.x.x.x is the public IP I want to listening on.


2

You need to add the EXPOSE statement to your Dockerfile for port 8080. Here's the reference from Docker: https://docs.docker.com/engine/reference/builder/#expose Your final Dockerfile should look like this: FROM adzerk/boot-clj EXPOSE 8080 WORKDIR /app COPY . /app


0

Edit the file /etc/sysctl.conf net.ipv4.ip_forward = 0 reload sysctl -p /etc/sysctl.conf masquerade your private IP as your public when you go out to the internet (whichever interface owns the public IP) iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Nat imcoming requests back to you VM and port - presumably a bridge or tap device. iptables -t ...


0

I think also you should use a bridged connection: Try to find out your name of the network: virsh net-edit <network name> The name of the network you can see in the Virt Manager. Normally it's default: virsh net-edit default Change from NAT to bridge (also the Bridge name you find in Virt Manager) <network> ...


0

There are a few things we should consider. What am I doing wrong here? Let's see the current iptables config and then we can examine it. Does UFW interfere with iptables? UFW is a command line front end for iptables but it lacks many of the features of iptables. Having the iptables configuration will show us what UFW has done based on the ...


2

The official netfilter doc states that the PREROUTING is checked before the INPUT chain. http://superuser.com/a/674103/21439 In other words the NEW packet first goes through PREROUTING and when your INPUT or your FORWARD examines the NEW packet, it already contains destination port 8080. And it gets dropped by your own rules.


0

Are you sure that tomcat itself is listening on port 8080? Because the docker container is indeed listening on port 32768 and that port is opened in the firewall ( In fact entirely open because the policy is ACCEPT and there is no REJECT or DROP rule ), it seems that may be the problem. You can verify with docker exec -ti pensive_leakey ss -tln


0

Your rules seems correct as you have described it and as you say the RDP portion works so it seems to be defined correctly. In situations like this, I will generally turn on logging for the policy (default settings only log deny packets for a packet filter) and attempt the connection again with the application to confirm that the traffic is actually flowing ...


0

You disabled NAT Loopback. This needs to be enabled in order to use your external IP address from within your network.


1

You should use NGinx or Apache2 to do it. I would recommend NGinx with the proxypass, something like that : location /firstapp { proxy_pass http://localhost:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }



Top 50 recent answers are included