Tag Info

Hot answers tagged

10

If two hosts are on the same subnet, the traffic has no reason to go through the router. Your rules are never being applied. The two devices are connected to a switch (or some other Layer 2 networking hardware). Host A says "I want this traffic to go to Host B's IP" and your switch says "Ok, done." UPDATE: If VLANs are an option, put each host in a ...


7

For what you're trying to accomplish, DNS is not the solution. Look into proxy servers that are capable of filtering such as squid, or other web filtering options.


5

The first two lines: -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A RH-Firewall-1-INPUT -p 51 -j ACCEPT Analizing /etc/protocols these two correspond to IPSec: esp 50 IPSEC-ESP # Encap Security Payload [RFC2406] ah 51 IPSEC-AH # Authentication Header [RFC2402] The third line: -A RH-Firewall-1-INPUT -p udp --dport 5353 -d ...


5

you add them to nat talbe, and by default iptables lists filter table. to see what you added run: iptables -t nat -nL


4

Assuming the IP address you want to whitelist is 192.0.2.55: netsh advfirewall firewall add rule name="Allow from 192.0.2.55" dir=in action=allow protocol=ANY remoteip=192.0.2.55


3

This is more of an admin question and here is the answer: http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/b3266a3c17f9bb7085256b870069c0a9/5dc869eda42a372e85256c1d0039546f?OpenDocument Since I haven't used this feature before, I am not sure whether it will keep a copy in the intended recipient's mail box or not, but this is a step in the ...


3

Concerning HTTP answers, I was under the impression that they use the connection the client opened, which is allowed by my rule. Was I wrong? Yes, you were wrong. It is most likely that you want to accept connection that are established or related to incoming connections. Thus, anything that is accepted on the input rule can be answered. With a ...


3

James, why not configure the ESX hosts at the remote location so that their guests are in a DMZ, but the ESX service console etc are in a back-zone subnet that you can establish a VPN with? That way, your hosts are isolated from web connectivity (a good thing) but your guests can continue to operate front-facing. As for the remote site problem... you really ...


3

It is a good idea to apply your policies as early as possible. Put them at the start. DROP rules on internal traffic can cause problems. This rule would be consideref a fault, as it implements and ACCEPT policy. Adding an accept rule per service is the correct way to build your firewall. An accept policy indicates you are running a mostly open policy. ...


2

You didn't mention anything about the nat table, so I'm going to assume that this question relates to writing iptables firewall scripts for standalone servers, and not for multi-homed/gateway boxes. You are correct: Each chain has a single policy, so it doesn't matter where or in what order that policy rules are stated. This rule establishes a convention ...


2

DNS is definitly not the answer. All you can do with DNS is create some pool for addressing ip-range by services. But that's not what you want or need. You'll need to use a proxy! hope this will help you. look at this website, you'll find some trick about proxy like squid (not a lot explanation, but some really easy to understand tutorial look at the ...


2

I think this is a great time to look into exim ACL's. You can use them to do your cc: to bcc rewriting. http://tldp.org/HOWTO/Spam-Filtering-for-MX/exim-smtpdelays.html


2

I'm unsure why you do it so complicated. Just issue a manual SMTP connection to the server. If it sends the greeting, then you know that it is online. If yes then continue to send the rest of the mail. Measure the time between connection and disconnection and you have the time used for sending and delivery. Done. On the server you can discard the mail.


2

According to fwbuilder (recommended) and a quick inspection, the following do ricks 1 and 3. Doing (2) depends strongly on your definition of "internal" (on interface, two interfaces, etc.) $IPTABLES -N RULE_0 $IPTABLES -A INPUT -p tcp -m tcp -s 1.2.3.4 --dport 22 -m state --state NEW -j RULE_0 $IPTABLES -A FORWARD -p tcp -m tcp -s 1.2.3.4 --dport ...


2

There's a module for that! The HttpLimitReqModule. The module documentation has a decent example that's enough to get you started. There are some pretty serious limitations with IP-based rate limiting though -- CGN and some sorts of forced proxies make multiple users come from the same IP address, and other sorts of forced proxies make one user come from ...


2

Not really sure what the limitation is that they are talking about. It should be very easy to setup either a static or dynamic distribution group in AD/Exchange that then sends e-mail to all employees regardless of the domain they actively use for Email. One key difference between Exchange and many other POP or IMAP systems is that the e-mail address tied ...


2

Yes, it's possible via Outlook inbox rules. If you are in an Exchange environment they still will (or should) be routed through your corporate MTA or at least your internal SMTP relay so you should be able to easily confirm this from there. If your employees send directly to your ISP's SMTP relay then it'll be a bit more difficult to confirm. You'd have ...


2

location = /nonexistent.php { rewrite ^ /existent.php last; } http://nginx.org/r/rewrite; http://nginx.org/r/location;


1

If you want to deny all outbound traffic, except for connections to 2 specific endpoints, you can change the default behavior for outbound connections to "Block". This way, all outbound connections will be blocked, unless they are explicitly allowed. Open the Windows Firewall with Advanced Security MMC, right-click the Firewall in the left pane, and select ...


1

If your switches support port mirroring, you could always mirror both the manager's port and the exchange server, then wireshark the traffic on it (filter to smtp only and set it to save to file when it captures XX megabytes). That should let you determine if emails are being copyed from anywhere. Also I would ensure the manager's pc has setting to ask for ...


1

A possible solution could be sender_dependent_default_transport_maps or sender_dependent_relayhost_maps. With more information about your configuration you would probably get more detailed help here.


1

I found a very useful script that creates rules dynamically for specific hosts in this blog. The script needs to be run with cron, so it can lookup a hostname and add/delete rules in case the IP changed. #!/bin/bash HOSTS_ALLOW=/etc/ufw-dynamic-hosts.allow IPS_ALLOW=/var/tmp/ufw-dynamic-ips.allow add_rule() { local proto=$1 local port=$2 local ...


1

I just checked the ip6tables man page on CentOS 6 and Debian 7 and they both include iprange: iprange This matches on a given arbitrary range of IP addresses. [!] --src-range from[-to] Match source IP in the specified range. [!] --dst-range from[-to] Match destination IP in the specified range. The man page for ...


1

UDP does not have any concept of connections, but you can limit to a number of packets per second by using the limit module: -m limit --limit 5/second Even though UDP does not have any concept of connections, iptables still perform connection tracking on UDP packets in the most typical configurations. For that reason it can make a difference if the limit ...


1

For IIS at least one option is Dynamic IP Restrictions which is a supported addon for IIS 7 from Microsoft. It's features include: Dynamically blocking of requests from IP address based on either of the following criteria: The number of concurrent requests. The number of requests over a period of time. It can be installed with the Web ...


1

The reasons php files aren't being processed is that when it hits the /data/public/ location it stops there and doesn't know how to process php files. Try putting your php location in another file called php.conf and include that file in your server block and in the /data/public/ block. So your config will look something like server { location ^~ ...


1

If you are talking about a contacts in a Public folder then you can Create a no ContactItem Form by copying the existing from, and then setting that new form as the default for a given Public Folder. You need to distribute the form by publishing it to the Organization Forms Library, which is a hidden public folder. In your new form you can use VBA to ...


1

Did you find the right answer and were you able to configure it already? To my knowledge this behavior is by design, taking into account that the Resource Booking Attendant is configured, active and working


1

When configuring your firewall, you can set default policy to accept all traffic and then deny unwanted ones. The other (more secure) one is to set the default policy to deny all traffic and accept the needed ones. For your email services, you will usually need to open the port of SMTP, POP, and IMAP. You cna find many tutorials and howtos on configuring ...


1

Sounds like your talking about an access rule, correct? TechNet explains the problems of requiring user auth. You must use ISA proxy or ISA client for user pre-auth to work. http://technet.microsoft.com/en-us/library/cc302664.aspx The problem is once you tell a rule to only allow for certain accounts (anything other then the default "All Users" which is ...



Only top voted, non community-wiki answers of a minimum length are eligible