387 reputation
521
bio website
location
age
visits member for 3 years, 10 months
seen Dec 4 at 17:41

Dec
3
comment iptables -D POSTROUTING -t nat -o tun0 -j MASQUERADE
Updated. Thanks. Copy & paste error
Dec
3
comment Port 53 in Amazon Security Group
The Amazon default rule is 0.0.0.0/0 All Traffic meaning, by default, all outbound traffic is allowed. That default rule has been removed and replaced with the 2 outbound rules above. Shouldn't this only allow outbound traffic on 443 and 80 only?
Dec
1
comment Why Use a NAT Instance?
Thanks. The main benefit based on our specific application is separation of services. We will evaluate.
Dec
1
comment Why Use a NAT Instance?
@Flimzy yes. Thanks for elegantly wording. Updated again.
Dec
1
comment Why Use a NAT Instance?
@Flimzy question clarified. Understand why we want the database servers isolated. Also understand that they still need internet access. The question is why use a separate server as a NAT instead of using 1 of the app instances?
Oct
9
comment Apache Instance in Private Subnet not returning packets
@MarkWagner Thank you. Please submit an answer with FORWARD chain so I can award the bounty. My default rules were to DROP forwarded traffic.
Oct
9
comment Apache Instance in Private Subnet not returning packets
I will add above but this rule is enabled. iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.10.102:80. Can you explain more about the FORWARD rule or anything that may be wrong with the PREROUTING given?
Oct
8
comment Apache Instance in Private Subnet not returning packets
on the App instance in the private subnet, Apache is listening on port 80. It is not listening on the NAT instance. I don't believe it should be, correct?
Oct
8
comment Apache Instance in Private Subnet not returning packets
Correction: ping does work to external network -> ping google.com. Ping fails to network public ip -> ping X.X.X.X fails
Oct
3
comment Apache Instance in Private Subnet not returning packets
@Andrew iptables -t nat -A POSTROUTING -j MASQUERADE. Ping does not work. wget does though.
Oct
3
comment Apache Instance in Private Subnet not returning packets
@EEAA yes this is AWS. Source/destination checking is disabled. Forwarding is enabled in /proc/sys/net/ipv4/ip_forward. Is there somewhere else to check on the forwarding?
Oct
1
comment Should a NAT host be separate from a Bastion host
@John edited the question to elicit fact based answers. Can you provide your insight?
Sep
10
comment Is www-data considered a non-privileged user on Apache?
Thanks. So it is best to sudo chown -R www-data:www-data /etc/apache2 on Debian systems? I assume you want to deny access to all except root and www-data anyway. Is there a user I am forgetting that would need write access?
Sep
9
comment Ubuntu EC2 server not accepting key following OpenSSH upgrade
Best practices are to use ssh passwordless authentication whenever possible.
Jan
16
comment Mount a Symlink Directory to Document Root for Deployment
In my setup, the parent 2 levels above DocumentRoot required the Options Symlinks Directive. So <Directory /var/www/site/staging/>Options FollowSymLinks</Directory>
Jan
15
comment Mount a Symlink Directory to Document Root for Deployment
unfortunately the DocumentRoot should be current/public. This allows items in the project to be placed outside the document root. I don't believe the DocRoot can be a symlinked subdirectory like current/public is. Am I wrong on this? This was not shown correctly in the intial question but is updated.
Jan
15
comment Mount a Symlink Directory to Document Root for Deployment
@Gilles do you have any thoughts on this?
Sep
23
comment mysql-server-5.5 (5.5.32-0ubuntu0.12.04.1) … start: Job failed to start
Logfiles pointed to a corrupt InnoDB table. Removed table.
Sep
22
comment Replace MySql databases with a more recent copy via command line
Upon checking all Innodb tables are ok. For MyISAM, can a mysql stop followed by copying MYD & MYI files work? Are there other considerations?
Sep
9
comment /etc/init.d/iptables-persistent start returns fail but seems to work
ip6tables-restore < /etc/iptables/rules.v6 works. Does that mean I do not need to explicity start iptables persistent? Instead I should use iptables-restore and ip6tables-restore?