Tag Info

Hot answers tagged

10

If two hosts are on the same subnet, the traffic has no reason to go through the router. Your rules are never being applied. The two devices are connected to a switch (or some other Layer 2 networking hardware). Host A says "I want this traffic to go to Host B's IP" and your switch says "Ok, done." UPDATE: If VLANs are an option, put each host in a ...


7

For what you're trying to accomplish, DNS is not the solution. Look into proxy servers that are capable of filtering such as squid, or other web filtering options.


5

The first two lines: -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A RH-Firewall-1-INPUT -p 51 -j ACCEPT Analizing /etc/protocols these two correspond to IPSec: esp 50 IPSEC-ESP # Encap Security Payload [RFC2406] ah 51 IPSEC-AH # Authentication Header [RFC2402] The third line: -A RH-Firewall-1-INPUT -p udp --dport 5353 -d ...


5

you add them to nat talbe, and by default iptables lists filter table. to see what you added run: iptables -t nat -nL


5

Assuming the IP address you want to whitelist is 192.0.2.55: netsh advfirewall firewall add rule name="Allow from 192.0.2.55" dir=in action=allow protocol=ANY remoteip=192.0.2.55


5

Canonically, that ESTABLISHED rule is actually RELATED,ESTABLISHED. It won't affect SSH or HTTP(S), though—the difference is that RELATED also encompasses what are technically new connections, but are related to an existing one, as in FTP data channel communications or ICMP echo replies. Overall, what you have done here is just fine.


3

This is more of an admin question and here is the answer: http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/b3266a3c17f9bb7085256b870069c0a9/5dc869eda42a372e85256c1d0039546f?OpenDocument Since I haven't used this feature before, I am not sure whether it will keep a copy in the intended recipient's mail box or not, but this is a step in the ...


3

Concerning HTTP answers, I was under the impression that they use the connection the client opened, which is allowed by my rule. Was I wrong? Yes, you were wrong. It is most likely that you want to accept connection that are established or related to incoming connections. Thus, anything that is accepted on the input rule can be answered. With a ...


3

James, why not configure the ESX hosts at the remote location so that their guests are in a DMZ, but the ESX service console etc are in a back-zone subnet that you can establish a VPN with? That way, your hosts are isolated from web connectivity (a good thing) but your guests can continue to operate front-facing. As for the remote site problem... you really ...


3

It is a good idea to apply your policies as early as possible. Put them at the start. DROP rules on internal traffic can cause problems. This rule would be consideref a fault, as it implements and ACCEPT policy. Adding an accept rule per service is the correct way to build your firewall. An accept policy indicates you are running a mostly open policy. ...


2

You didn't mention anything about the nat table, so I'm going to assume that this question relates to writing iptables firewall scripts for standalone servers, and not for multi-homed/gateway boxes. You are correct: Each chain has a single policy, so it doesn't matter where or in what order that policy rules are stated. This rule establishes a convention ...


2

DNS is definitly not the answer. All you can do with DNS is create some pool for addressing ip-range by services. But that's not what you want or need. You'll need to use a proxy! hope this will help you. look at this website, you'll find some trick about proxy like squid (not a lot explanation, but some really easy to understand tutorial look at the ...


2

I think this is a great time to look into exim ACL's. You can use them to do your cc: to bcc rewriting. http://tldp.org/HOWTO/Spam-Filtering-for-MX/exim-smtpdelays.html


2

I'm unsure why you do it so complicated. Just issue a manual SMTP connection to the server. If it sends the greeting, then you know that it is online. If yes then continue to send the rest of the mail. Measure the time between connection and disconnection and you have the time used for sending and delivery. Done. On the server you can discard the mail.


2

According to fwbuilder (recommended) and a quick inspection, the following do ricks 1 and 3. Doing (2) depends strongly on your definition of "internal" (on interface, two interfaces, etc.) $IPTABLES -N RULE_0 $IPTABLES -A INPUT -p tcp -m tcp -s 1.2.3.4 --dport 22 -m state --state NEW -j RULE_0 $IPTABLES -A FORWARD -p tcp -m tcp -s 1.2.3.4 --dport ...


2

There's a module for that! The HttpLimitReqModule. The module documentation has a decent example that's enough to get you started. There are some pretty serious limitations with IP-based rate limiting though -- CGN and some sorts of forced proxies make multiple users come from the same IP address, and other sorts of forced proxies make one user come from ...


2

Not really sure what the limitation is that they are talking about. It should be very easy to setup either a static or dynamic distribution group in AD/Exchange that then sends e-mail to all employees regardless of the domain they actively use for Email. One key difference between Exchange and many other POP or IMAP systems is that the e-mail address tied ...


2

The reasons php files aren't being processed is that when it hits the /data/public/ location it stops there and doesn't know how to process php files. Try putting your php location in another file called php.conf and include that file in your server block and in the /data/public/ block. So your config will look something like server { location ^~ ...


2

location = /nonexistent.php { rewrite ^ /existent.php last; } http://nginx.org/r/rewrite; http://nginx.org/r/location;


2

Yes, it's possible via Outlook inbox rules. If you are in an Exchange environment they still will (or should) be routed through your corporate MTA or at least your internal SMTP relay so you should be able to easily confirm this from there. If your employees send directly to your ISP's SMTP relay then it'll be a bit more difficult to confirm. You'd have ...


2

For IIS at least one option is Dynamic IP Restrictions which is a supported addon for IIS 7 from Microsoft. It's features include: Dynamically blocking of requests from IP address based on either of the following criteria: The number of concurrent requests. The number of requests over a period of time. It can be installed with the Web ...


2

You need the break flag added to the rewrite rule, so that processing stops, and as this is inside a location block processing will continue inside that block: rewrite ^/petproject/?(.*)$ /$1 break; Note I also added /? to the matching pattern so that you don't end up with double slashes at the beginning of the url.


2

The configuration has the usual problem that generally happens with nginx. That is, using root directive inside location block. Try using this configuration instead of your current location blocks: root /home/me/Documents/site1; index index.html; location /petproject { alias /home/me/pet-Project/website; } This means that the default directory for ...


2

I suggest posting on F5's iRules forum for this, devcentral.f5.com. Here's the iRules forum link: http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/afv/topics/Default.aspx To provide a suggestion, it would help to know what type of persistence you're using. In general, you could manually select a pool member, but then you'd ...


2

If you want to quick and dirty solution (because of few user) and without external script/daemon (just using postfix and its maps), take a look in Postfix Restriction Classes. In that page, you should see examples how that feature works. In short, every class will have own set of restriction just like you want. For your case, first you will add this checks ...


1

You need to have something like this RewriteEngine On Options +FollowSymLinks RewriteRule ^article/([a-z0-9-/]+).html$ article.php?url=$1 [NC,L] RewriteRule ^produs/([a-z0-9-/]+).html$ produs.php?urlprodus=$1 [NC,L] So rewrite matches are different; now you would be able to make rewrite from say www.domain.tld/article/myRewriteRule.html to ...


1

Technical solution/explanation: From the network point of view, you need to configure two elements: webserver (Apache, Ngix,..) iptables to forward all port 80 packets transparently to the new webserver IP port 80 You will have to create a web page but this will be complicate because you probably want to forward the user to the original page after the ...


1

There is no such thing. There's no server-side rule in Exchange that can run a script. You'll have to do it with some mail client that can do things like that - or as TheCleaner suggested, don't use email at all, use SNMP or query the BUE database itself. I'm not going to address your question of "How do I write to a MySQL database from Powershell?" ...


1

Since your use case is very special and standard Postfix lookup methods do not work for you, I would consider using Postfix content inspection. Usually it is used for anti-spam/virus filtering, but since you can hook up your own Perl/whatever scripts to it, you can create a small script with the language you like and let it answer to Postfix if the mail ...


1

If your switches support port mirroring, you could always mirror both the manager's port and the exchange server, then wireshark the traffic on it (filter to smtp only and set it to save to file when it captures XX megabytes). That should let you determine if emails are being copyed from anywhere. Also I would ensure the manager's pc has setting to ask for ...



Only top voted, non community-wiki answers of a minimum length are eligible