113
votes
Accepted
SSH from A through B to C, using private key on B
Schematic:
ssh ssh
A ------> B ------> C
^ ^
using A's using B's
ssh key ssh key
Preconditions:
A is running ssh-agent;
A can access B;
B can access C;
A's ssh ...
- 1,483
102
votes
Accepted
How to open port for a specific IP address with firewall-cmd on CentOS?
Try this command
firewall-cmd --permanent --zone=public --add-rich-rule='
rule family="ipv4"
source address="1.2.3.4/32"
port protocol="tcp" port="4567" accept'
Check the zone file later to ...
- 4,485
88
votes
How to Unban an IP properly with Fail2Ban
Example for SSH in interactive mode.
type in bash:
fail2ban-client -i
then in interactive mode type read the status of a jail:
status sshd
you'll get:
Status for the jail: ssh
|- Filter
| |- ...
- 981
88
votes
How to open port for a specific IP address with firewall-cmd on CentOS?
Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces.
firewall-cmd --new-zone=special --permanent
firewall-cmd --reload
firewall-cmd -...
- 240k
60
votes
UFW Firewall Rules ordering?
If you're interested in reordering your UFW rules, this is one way to do it.
$ sudo ufw status numbered
To Action From
-- ------ --...
- 760
60
votes
I accidentaly forbid SSH connection to a remote server... What's next?
There are several alternatives:
See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it.
If they don't offer that, see ...
- 973
47
votes
I accidentaly forbid SSH connection to a remote server... What's next?
If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.
- 1,414
45
votes
Accepted
How to remove access to a port using firewall on Centos7?
Solution: Do not forget the --runtime-to-permanent
$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent
$ firewall-cmd --reload
- 915
41
votes
In the output of `last`, what does suffix ".d" after an IP address mean?
59.224.XX.178.d is not an IP-address but a hostname, or rather part of it.
Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the ...
- 73.4k
37
votes
Accepted
iptables show just one chain
I almost deleted this question. D'oh! From man iptables:
-L, --list [chain]
List all rules in the selected chain.
- 1,051
36
votes
Accepted
UFW comment existing rule?
If you add exactly same rule, then the existing rule gets overwritten and comment is updated there.
E.g.:
recyber@linux:~$ sudo ufw allow from 10.0.0.0/24 to any port 1234 comment "Comment"
Rule ...
- 376
33
votes
How to check if a port is blocked on a Windows machine?
Since PowerShell 4.0 you can use the command Test-NetConnection
If you want to test Port 3306 as in your example the command is
Test-NetConnection -ComputerName localhost -Port 3306
TechNet Test-...
- 1,085
32
votes
How to check if a port is blocked on a Windows machine?
NETSTAT will tell you if the port is listening but it will not tell you if the port is open to the outside world. What I mean by this is that NETSTAT may show that the 0.0.0.0 is LISTENING on port ...
- 1,829
32
votes
Where does UFW (uncomplicated firewall) save command-line rules to?
Ubuntu 16.04 LTS
/etc/ufw/user.rules
Debian 9
/etc/ufw/user.rules
In general, try:
locate user.rules
Should output something like:
/etc/ufw/user.rules
/usr/share/ufw/user.rules
/usr/share/ufw/...
- 425
32
votes
Accepted
How to ssh to a server which I can not directly reach?
You can use the following command to set up an SSH tunnel from the remote server to your local machine:
$ ssh -f -N -R 1234:localhost:22 user@your_machine_ip
When the tunnel is set up, you can ...
- 36.1k
31
votes
Accepted
What Does a Layer 3,4 Firewall do that a Layer 7 Does Not?
It sounds like you're getting a bit of misleading jargon. The technical definitions for these types of firewalls are:
Layer 3 firewalls (i.e. packet filtering firewalls) filter traffic based solely ...
- 476
30
votes
Which ports do I need to open in the firewall to use NFS?
I found useful directions for my problem on this page, but there was no easy to follow recipe. So here's my recipe.
TL;DR - need to allow both nfs ports (111, 2049) and mountd port after fixing it.
...
- 401
30
votes
I accidentaly forbid SSH connection to a remote server... What's next?
This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.
- 301
26
votes
Accepted
Debugging iptables and common firewall pitfalls?
In general:
Viewing and modifying the firewall configuration requires administrator privileges (root) as does
opening services in the restricted port number range. That means that you should either be ...
- 73.4k
25
votes
iptables: difference between NEW, ESTABLISHED and RELATED packets
Asumming for both server and client a restrictive INPUT and open OUTPUT, i.e.:
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
And from iptables-extensions(8) over the example of FTP in active mode:...
- 436
25
votes
iptables error: unknown option --dport
Another possible solution is that you're forgetting to run as root. I just ran into this when using the debian tutorial
$ iptables -t nat -p tcp -I PREROUTING --src 0/0 --dst 127.0.0.1 --dport 80 -j ...
- 371
23
votes
Accepted
Check ufw default policy action
Try ufw status verbose:
root@cmp:~# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
Now I change it to allow:
...
- 9,802
23
votes
How to block mysterious remote requests?
It is hard to say what exactly is going on here. However you state:
The request looks like my server is spending time serving or getting other pages content.
This together with the "GET http://...
- 17.4k
22
votes
Accepted
Relationship between bastion host and jump host
A Bastion host is a machine that is outside of your security zone.
And is expected to be a weak point, and in need of additional security considerations.
Because your security devices are technically ...
- 5,577
21
votes
Accepted
AWS EC2 deny single ip address and allow all
The only way to deny sources/IP addresses is to use Network ACL's in the VPC. These operate like a firewall allowing or blocking traffic incoming to your subnet, and operate above the Securtiy group ...
- 432
20
votes
How to install gpg keys from behind a firewall?
Something like
gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 \
--keyserver-options "timeout=40 http-proxy=$http_proxy" \
--recv-keys B0F4253373F8F6F510D42178520A9993A1C052F8
...
- 524
19
votes
Ufw and Iptables. Which is better and why?
I ain't afraid of no quake i mean firewall! [ref.1]
TL;DR PART
a simple image about pizza can answer sometimes many questions :)
Take a good look at this picture, then read the text below:
(IMAGE) ...
- 340
18
votes
CentOS 7 Firewall Configuration
Here are some commands with descriptions below that I came across and were helpful
firewall-cmd --state
view status of firewalld service (systemctl status firewalld)
firewall-cmd --zone=public --...
- 349
16
votes
Debugging iptables and common firewall pitfalls?
Iptables/Firewall "introduction"
A Firewall is basically a policy-based network filter. Linux firewalls are built around Netfilter; the kernel's network packet processing framework which is made of ...
- 3,359
Only top scored, non community-wiki answers of a minimum length are eligible