Hot answers tagged

10

If two hosts are on the same subnet, the traffic has no reason to go through the router. Your rules are never being applied. The two devices are connected to a switch (or some other Layer 2 networking hardware). Host A says "I want this traffic to go to Host B's IP" and your switch says "Ok, done." UPDATE: If VLANs are an option, put each host in a ...


7

For what you're trying to accomplish, DNS is not the solution. Look into proxy servers that are capable of filtering such as squid, or other web filtering options.


6

you add them to nat talbe, and by default iptables lists filter table. to see what you added run: iptables -t nat -nL


6

Assuming the IP address you want to whitelist is 192.0.2.55: netsh advfirewall firewall add rule name="Allow from 192.0.2.55" dir=in action=allow protocol=ANY remoteip=192.0.2.55


6

Canonically, that ESTABLISHED rule is actually RELATED,ESTABLISHED. It won't affect SSH or HTTP(S), though—the difference is that RELATED also encompasses what are technically new connections, but are related to an existing one, as in FTP data channel communications or ICMP echo replies. Overall, what you have done here is just fine.


5

The first two lines: -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A RH-Firewall-1-INPUT -p 51 -j ACCEPT Analizing /etc/protocols these two correspond to IPSec: esp 50 IPSEC-ESP # Encap Security Payload [RFC2406] ah 51 IPSEC-AH # Authentication Header [RFC2402] The third line: -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224....


4

I'm afraid time has moved on, and F22 is one of those cherishable distros using the adorable new systemd to start things up. One of the many happy enjoyable side effects is that rc.local is no longer run (or to be more precise, I haven't been able to make it run reliably) so that won't be helping. Put your firewall rules into /etc/sysconfig/iptables in the ...


4

To use sudo, you can do sudo iptables-save | sudo tee /etc/sysconfig/iptables The shell don't have the right to write in /etc/sysconfig/iptables, as it is run in your user.


3

The reasons php files aren't being processed is that when it hits the /data/public/ location it stops there and doesn't know how to process php files. Try putting your php location in another file called php.conf and include that file in your server block and in the /data/public/ block. So your config will look something like server { location ^~ /data/...


3

Concerning HTTP answers, I was under the impression that they use the connection the client opened, which is allowed by my rule. Was I wrong? Yes, you were wrong. It is most likely that you want to accept connection that are established or related to incoming connections. Thus, anything that is accepted on the input rule can be answered. With a stateless ...


3

This is more of an admin question and here is the answer: http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/b3266a3c17f9bb7085256b870069c0a9/5dc869eda42a372e85256c1d0039546f?OpenDocument Since I haven't used this feature before, I am not sure whether it will keep a copy in the intended recipient's mail box or not, but this is a step in the ...


3

James, why not configure the ESX hosts at the remote location so that their guests are in a DMZ, but the ESX service console etc are in a back-zone subnet that you can establish a VPN with? That way, your hosts are isolated from web connectivity (a good thing) but your guests can continue to operate front-facing. As for the remote site problem... you really ...


3

It is a good idea to apply your policies as early as possible. Put them at the start. DROP rules on internal traffic can cause problems. This rule would be consideref a fault, as it implements and ACCEPT policy. Adding an accept rule per service is the correct way to build your firewall. An accept policy indicates you are running a mostly open policy. (...


3

The configuration has the usual problem that generally happens with nginx. That is, using root directive inside location block. Try using this configuration instead of your current location blocks: root /home/me/Documents/site1; index index.html; location /petproject { alias /home/me/pet-Project/website; } This means that the default directory for ...


3

Changes to Transport Rules take effect after about 15 minutes in my experience. In Azure AD, the process called Forward Sync is leveraged to push updates to objects throughout the infrastructure. I do not know if Transport Rules are objects that use this mechanism or if it is a separate Exchange process. In O365, this will really depend on your ...


2

I suggest posting on F5's iRules forum for this, devcentral.f5.com. Here's the iRules forum link: http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/afv/topics/Default.aspx To provide a suggestion, it would help to know what type of persistence you're using. In general, you could manually select a pool member, but then you'd ...


2

I'm unsure why you do it so complicated. Just issue a manual SMTP connection to the server. If it sends the greeting, then you know that it is online. If yes then continue to send the rest of the mail. Measure the time between connection and disconnection and you have the time used for sending and delivery. Done. On the server you can discard the mail.


2

I think this is a great time to look into exim ACL's. You can use them to do your cc: to bcc rewriting. http://tldp.org/HOWTO/Spam-Filtering-for-MX/exim-smtpdelays.html


2

DNS is definitly not the answer. All you can do with DNS is create some pool for addressing ip-range by services. But that's not what you want or need. You'll need to use a proxy! hope this will help you. look at this website, you'll find some trick about proxy like squid (not a lot explanation, but some really easy to understand tutorial look at the ...


2

Yes, it's possible via Outlook inbox rules. If you are in an Exchange environment they still will (or should) be routed through your corporate MTA or at least your internal SMTP relay so you should be able to easily confirm this from there. If your employees send directly to your ISP's SMTP relay then it'll be a bit more difficult to confirm. You'd have ...


2

According to fwbuilder (recommended) and a quick inspection, the following do ricks 1 and 3. Doing (2) depends strongly on your definition of "internal" (on interface, two interfaces, etc.) $IPTABLES -N RULE_0 $IPTABLES -A INPUT -p tcp -m tcp -s 1.2.3.4 --dport 22 -m state --state NEW -j RULE_0 $IPTABLES -A FORWARD -p tcp -m tcp -s 1.2.3.4 --dport ...


2

You didn't mention anything about the nat table, so I'm going to assume that this question relates to writing iptables firewall scripts for standalone servers, and not for multi-homed/gateway boxes. You are correct: Each chain has a single policy, so it doesn't matter where or in what order that policy rules are stated. This rule establishes a convention ...


2

Not really sure what the limitation is that they are talking about. It should be very easy to setup either a static or dynamic distribution group in AD/Exchange that then sends e-mail to all employees regardless of the domain they actively use for Email. One key difference between Exchange and many other POP or IMAP systems is that the e-mail address tied ...


2

There's a module for that! The HttpLimitReqModule. The module documentation has a decent example that's enough to get you started. There are some pretty serious limitations with IP-based rate limiting though -- CGN and some sorts of forced proxies make multiple users come from the same IP address, and other sorts of forced proxies make one user come from ...


2

location = /nonexistent.php { rewrite ^ /existent.php last; } http://nginx.org/r/rewrite; http://nginx.org/r/location;


2

For IIS at least one option is Dynamic IP Restrictions which is a supported addon for IIS 7 from Microsoft. It's features include: Dynamically blocking of requests from IP address based on either of the following criteria: The number of concurrent requests. The number of requests over a period of time. It can be installed with the Web ...


2

If you want to quick and dirty solution (because of few user) and without external script/daemon (just using postfix and its maps), take a look in Postfix Restriction Classes. In that page, you should see examples how that feature works. In short, every class will have own set of restriction just like you want. For your case, first you will add this checks ...


2

You need the break flag added to the rewrite rule, so that processing stops, and as this is inside a location block processing will continue inside that block: rewrite ^/petproject/?(.*)$ /$1 break; Note I also added /? to the matching pattern so that you don't end up with double slashes at the beginning of the url.


2

You say "i could cut the youtube for the https". This isn't going to work; URLs on an HTTPS connection are exchanged under cover of crypto. The firewall may be in the data stream, but it won't see this conversation, as by that point its job is reduced to taking encrypted packets from one interface to another. Yes, it's possible for clients to try to go to ...


2

Nope. Windows firewall does not behave like other familiar firewalls. A BLOCK will always be evaluated before an ALLOW. The block rule you have above is unnecessary though - blocking is the default approach. Source: https://technet.microsoft.com/en-us/library/dd421709%28v=ws.10%29.aspx My last sentence is incorrect since I misunderstood the original ...



Only top voted, non community-wiki answers of a minimum length are eligible