Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Wed, Jun 1, 2022 at 11:21 john doe wrote: > when does it actually start operating? Does it do so then, or does it take > > a reboot? > Apparently, if you 'enable' 'ufw', it will start and be enabled at boot. Good, thanks. According to (1), ufw should work with nftables, I did not follow

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 6/1/2022 1:45 PM, Tom Browder wrote: On Mon, May 30, 2022 at 19:46 Edwin Zimmerman wrote: On 5/30/22 09:41, Greg Wooledge wrote: On Mon, May 30, 2022 at 07:13:54AM -0500, Tom Browder wrote: No worries. All those responses about the subject IP now are the norm for a bare-iron server

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 19:46 Edwin Zimmerman wrote: > On 5/30/22 09:41, Greg Wooledge wrote: > > On Mon, May 30, 2022 at 07:13:54AM -0500, Tom Browder wrote: > >> No worries. All those responses about the subject IP now are the norm > for a > >> bare-iron server ready for use by a customer,

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 5/30/22 09:41, Greg Wooledge wrote: > On Mon, May 30, 2022 at 07:13:54AM -0500, Tom Browder wrote: >> No worries. All those responses about the subject IP now are the norm for a >> bare-iron server ready for use by a customer, yours truly. It is the same >> server I messed up the firewall with

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 1:24 PM Tom Browder wrote: > On Mon, May 30, 2022 at 09:03 IL Ka wrote: > >> IMHO: It is better to have a firewall and block (policy -- drop) INPUT >> and FORWARD by default. >> And open only ports that must be opened. >> This will help if you install some software that

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 09:03 IL Ka wrote: > IMHO: It is better to have a firewall and block (policy -- drop) INPUT and > FORWARD by default. > And open only ports that must be opened. > This will help if you install some software that listens for 0.0.0.0 by > accident > >From my limited

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 08:42 Greg Wooledge wrote: .. > Unless this machine is more than just a web server...? It does serve other purposes.

Re: Firewall blocking my new Debian 11 server ports 80 and 443

IMHO: It is better to have a firewall and block (policy -- drop) INPUT and FORWARD by default. And open only ports that must be opened. This will help if you install some software that listens for 0.0.0.0 by accident On Mon, May 30, 2022 at 4:42 PM Greg Wooledge wrote: > On Mon, May 30, 2022 at

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 07:13:54AM -0500, Tom Browder wrote: > No worries. All those responses about the subject IP now are the norm for a > bare-iron server ready for use by a customer, yours truly. It is the same > server I messed up the firewall with and locked myself out of. The OS has > been

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Mon, May 30, 2022 at 02:13 john doe wrote: > On 5/30/2022 12:26 AM, Tom Browder wrote: > > On Sun, May 29, 2022 at 15:55 Greg Wooledge wrote: No worries. All those responses about the subject IP now are the norm for a bare-iron server ready for use by a customer, yours truly. It is the

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 2022-05-29, Greg Wooledge wrote: > > Second, I cannot ping this IP address, nor can I telnet to port 80 of it. > (Nor port 22.) > That's strange; I can ping it (I'm not in Kansas anymore): curty@einstein:~$ ping 69.30.225.10 PING 69.30.225.10 (69.30.225.10) 56(84) bytes of data. 64 bytes

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 5/30/2022 12:26 AM, Tom Browder wrote: On Sun, May 29, 2022 at 15:55 Greg Wooledge wrote: ... Thanks, Greg. It looks like my server was blocked from ports 80 and 443 upstream from it (as you and others suspected), so I asked my provider to reinstall the OS and ensure it has public access to

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> Maybe I should remove all firewall progs and start from zero. I would suggest you install Shorewall. it is not the pain in the arse that's been the theme of this thread so far.

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 8:13 PM Greg Wooledge wrote: > On Sun, May 29, 2022 at 11:50:44PM +, Lee wrote: > > On 5/29/22, Greg Wooledge wrote: > > > Second, I cannot ping this IP address, nor can I telnet to port 80 of > it. > > > > For whatever it's worth.. > > > > Pinging 69.30.225.10 with

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > ssh gives me a login prompt > > Btw, I highly recommend: * Block SSH access from any IP except one you are going to use to manage this server * If you have dynamic IP, you can add all your ISP network, or, at least, your country: (list can be downloaded here

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 11:50:44PM +, Lee wrote: > On 5/29/22, Greg Wooledge wrote: > > Second, I cannot ping this IP address, nor can I telnet to port 80 of it. > > For whatever it's worth.. > > Pinging 69.30.225.10 with 32 bytes of data: > Reply from 69.30.225.10: bytes=32 time=43ms

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 5/29/22, Greg Wooledge wrote: > On Sun, May 29, 2022 at 03:39:05PM -0500, Tom Browder wrote: >> I have not intentionally hidden anything, Greg--I just never saw the need >> for >> mentioning it given the dialogue--x.y.z.w is just shorthand. If you >> must know the exact IP address, it is

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 15:55 Greg Wooledge wrote: ... Thanks, Greg. It looks like my server was blocked from ports 80 and 443 upstream from it (as you and others suspected), so I asked my provider to reinstall the OS and ensure it has public access to ports 80 and 443. Best regards, -Tom

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 03:39:05PM -0500, Tom Browder wrote: > I have not intentionally hidden anything, Greg--I just never saw the need for > mentioning it given the dialogue--x.y.z.w is just shorthand. If you > must know the exact IP address, it is 69.30.225.10. OK. Now we can actually start

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 2:21 PM Greg Wooledge wrote: > > > > > btw, are you able to ping server? > > > > > > Yes. > > > > It is always better to show the command and the output instead of saying > > yes/no! :) > > Except it should be abundantly clear by now that you're dealing with > someone who

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > btw, are you able to ping server? > > > > Yes. > > It is always better to show the command and the output instead of saying > yes/no! :) Except it should be abundantly clear by now that you're dealing with someone who believes that they must hide every single detail from the ones who

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > I must say, I can not realy understand how you can ping and not > telnet/access your web server. > > Some router between OP and his server has something like -I FORWARD -j REJECT --reject-with icmp-host-unreachable

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 5/29/2022 7:20 PM, Tom Browder wrote: On Sun, May 29, 2022 at 11:39 IL Ka wrote: btw, are you able to ping server? Yes. It is always better to show the command and the output instead of saying yes/no! :) I must say, I can not realy understand how you can ping and not telnet/access

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 11:39 IL Ka wrote: > btw, are you able to ping server? > Yes.

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 05:41:59AM -0500, Tom Browder wrote: > On Sat, May 28, 2022 at 20:06 IL Ka wrote: > ... > > 3. You should also check that Apache is running and listening to this port, > > use ``ss -lt``. > > For this command you _may_ use sudo to get process names (``sudo ss > > -ltp``).

Re: Firewall blocking my new Debian 11 server ports 80 and 443

btw, are you able to ping server? On Sun, May 29, 2022 at 7:26 PM Tom Browder wrote: > On Sun, May 29, 2022 at 10:33 AM IL Ka wrote: > > > > > >> When running those, I'm told neither the arptablrs nor the ebtables are > registered (not installed). Should I install them? > > > > No. > > > > So,

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > > and ``iptables -S`` ? > > -P INPUT ACCEPT > -P FORWARD ACCEPT > -P OUTPUT ACCEPT > -N f2b-sshd > -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd > -A f2b-sshd -s 61.177.173.50/32 -j REJECT --reject-with > icmp-port-unreachable > -A f2b-sshd -s 61.177.173.7/32 -j REJECT --reject-with >

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 10:33 AM IL Ka wrote: > > >> When running those, I'm told neither the arptablrs nor the ebtables are >> registered (not installed). Should I install them? > > No. > > So, you now have legacy (classic) iptables, right? Yes. > What is the output of ``iptables -L -v -n``

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> When running those, I'm told neither the arptablrs nor the ebtables are > registered (not installed). Should I install them? > No. So, you now have legacy (classic) iptables, right? What is the output of ``iptables -L -v -n`` and ``iptables -S`` ?

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 09:51 IL Ka wrote: > >>> Do I have to switch all four *legacy *tables? >> > > yes > When running those, I'm told neither the arptablrs nor the ebtables are registered (not installed). Should I install them? >

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > >> Do I have to switch all four *legacy *tables? > yes

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 17:24 IL Ka wrote: > ... I am not familiar with nft, bit you can switch to iptables using >> ``update-alternatives`` >> > > # update-alternatives --set iptables /usr/sbin/iptables-legacy > # update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > #

Re: Firewall blocking my new Debian 11 server ports 80 and 443

Le 29/05/2022 à 13:22, Tom Browder a écrit : On Sun, May 29, 2022 at 05:41 Tom Browder wrote: Does anyone have a good reason for me to NOT install and enable UFW? -Tom  good reason would be that thtere is obviously already something on your server magaing the firewalling. Having 2

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > > Good to know. But does fail2ban require ipset? > No, but having several thousand rules is not convenient, so I prefer ipset > They never have before in over 15 years, and, before I got this server > started, its mate was serving fine. But if the ufw doesn't work, I'll ask > them. > I'd

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 07:06 IL Ka wrote: > Does anyone have a good reason for me to NOT install and enable UFW? >> > > ufw can't be used with ipset AFAIK, and I use ipset for many reasons > (fail2ban, block access outside of my country etc). > But If you only SSH your host from one static IP,

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > > Does anyone have a good reason for me to NOT install and enable UFW? > > ufw can't be used with ipset AFAIK, and I use ipset for many reasons (fail2ban, block access outside of my country etc). But If you only SSH your host from one static IP, you probably do not need fail2ban at all.

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > $ telnet x.y.z.w 80 > Trying x.y.z.w... > telnet: Unable to connect to remote host: No route to host > But you can ssh to this host, right? Well, that means the firewall blocks your request and sends the ICMP message "no route to host". Switch to the legacy iptables using

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sun, May 29, 2022 at 05:41 Tom Browder wrote: Does anyone have a good reason for me to NOT install and enable UFW? -Tom

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 20:06 IL Ka wrote: ... 3. You should also check that Apache is running and listening to this port, > use ``ss -lt``. > For this command you _may_ use sudo to get process names (``sudo ss > -ltp``). Read ``ss --help`` > > If you were able to connect on this host, then try

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 20:06 IL Ka wrote: > >> $ sudo su >> # telnet 80 >> Trying 0.0.0.80... >> > > 1. You are using telnet wrong: it should be "telnet [host] [port]". Please > read "man telnet". > 2. You do not need sudo to use telnet, do not do that > 3. You should also check

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > $ sudo su > # telnet 80 > Trying 0.0.0.80... > 1. You are using telnet wrong: it should be "telnet [host] [port]". Please read "man telnet". 2. You do not need sudo to use telnet, do not do that 3. You should also check that Apache is running and listening to this port, use ``ss

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 19:10 Timothy M Butterworth < timothy.m.butterwo...@gmail.com> wrote: … On the local host try running `telnet 127.0.0.1 80` > I was able to connect, thanks, Timothy! Now what? I would really like to use ufw. -Tom

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 19:01 Greg Wooledge wrote: > On Sat, May 28, 2022 at 05:51:38PM -0500, Tom Browder wrote: > … > > ... wow. Just wow. How can such a short excerpt contain so many failures? Greg, calm down. I get it, but I haven’t unlearned years of muscle memory—sorry. And the

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 7:52 PM Tom Browder wrote: > > > On Sat, May 28, 2022 at 17:51 Tom Browder wrote: > >> On Sat, May 28, 2022 at 17:30 IL Ka wrote: >> >>> I am running an Apache server and using Qualys Lab’s server checker. It shows no access to the server. Have you tried

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 05:51:38PM -0500, Tom Browder wrote: > $ sudo su > # telnet 80 > Trying 0.0.0.80... ... wow. Just wow. How can such a short excerpt contain so many failures? 1) "sudo su" is stupid. You don't need TWO setuid programs to get a root shell. Either use

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 17:51 Tom Browder wrote: > On Sat, May 28, 2022 at 17:30 IL Ka wrote: > >> I am running an Apache server and using Qualys Lab’s server checker. It >>> shows no access to the server. >>> >>> Have you tried to telnet to port 80 from home? Do you see apache >> listening

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 17:30 IL Ka wrote: > I am running an Apache server and using Qualys Lab’s server checker. It >> shows no access to the server. >> >> Have you tried to telnet to port 80 from home? Do you see apache > listening this port using ``ss``? > On the new host I did: $ sudo

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > I am running an Apache server and using Qualys Lab’s server checker. It > shows no access to the server. > > Have you tried to telnet to port 80 from home? Do you see apache listening this port using ``ss``? > > Whatever attempt I make to change the ports disappears when I reboot. > > Sure,

Re: Firewall blocking my new Debian 11 server ports 80 and 443

Tom Browder wrote: > On Sat, May 28, 2022 at 14:11 Tom Browder wrote: > > > As the bare-iron server came from my long-time cloud provider (since > > Debian 6), incoming ports 80 and 443 are blocked. > > > A little more digging shows the new server is using fail2ban and nft > tables, so I >

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 17:08 Dan Ritter wrote: … Therefore, something outside of your machine is blocking the > ports, or you are misreading or misusing the tools that are > telling you the ports are blocked. Tell us how you are checking the ports I am running an Apache server and using

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > > A little more digging shows the new server is using fail2ban and nft > tables, so I > need help on how to properly allow https and http inbound. > > I am not familiar with nft, bit you can switch to iptables using ``update-alternatives`` # update-alternatives --set iptables

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On Sat, May 28, 2022 at 14:11 Tom Browder wrote: > As the bare-iron server came from my long-time cloud provider (since > Debian 6), incoming ports 80 and 443 are blocked. A little more digging shows the new server is using fail2ban and nft tables, so I need help on how to properly allow https

Re: Firewall blocking my new Debian 11 server ports 80 and 443

> > > > -P INPUT ACCEPT > -P FORWARD ACCEPT > -P OUTPUT ACCEPT > -N f2b-sshd > -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd > -A f2b-sshd -s 62.204.41.56/32 -j REJECT --reject-with > icmp-port-unreachable > -A f2b-sshd -s 61.177.173.48/32 -j REJECT --reject-with > icmp-port-unreachable >

Re: Firewall blocking my new Debian 11 server ports 80 and 443

On 5/28/22 22:11, Tom Browder wrote: > As the bare-iron server came from my long-time cloud provider (since > Debian 6), incoming ports 80 and 443 are blocked. > > I ran my usual iptables command for new servers from them, but this > time the default settings were different so it didn't work.

Re: Firewall blocking my new Debian 11 server ports 80 and 443

Tom Browder wrote: > As the bare-iron server came from my long-time cloud provider (since > Debian 6), incoming ports 80 and 443 are blocked. > > I ran my usual iptables command for new servers from them, but this > time the default settings were different so it didn't work. > > Output from

Re: Firewall iptables qui ne bloque pas le port 53

- Mail original - > De: "JUPIN Alain" > À: "Liste Debian" > Envoyé: Jeudi 21 Avril 2022 09:26:49 > Objet: Firewall iptables qui ne bloque pas le port 53 > Bonjour, > Je vous soumet un petit problème ... sur une install Debian 11, j'ai > installé pi-hole (pour bloquer les pubs) >

Re: Firewall POSTROUTING problem

On 8/11/21 7:01 PM, Alain D D Williams wrote: On Wed, Aug 11, 2021 at 11:50:30PM +0200, deloptes wrote: Alain D D Williams wrote: iptables -A FORWARD -j ACCEPT and the OUTPUT? OUTOUT is also ACCEPT, however this is not, I think, important as the packets come from 10.239.239.23 (via br0)

Re: Firewall POSTROUTING problem

On Thu, Aug 12, 2021 at 01:28:57AM +0300, IL Ka wrote: > > > > > > > > > > iptables -A FORWARD -j ACCEPT > > > > Are you sure your packets are forwarded via netfilter? > Try to disable forwarding (with sysctl) or change rulte to -j DROP and > check traffic with sniffer (no packet should be

Re: Firewall POSTROUTING problem

> > > > > > iptables -A FORWARD -j ACCEPT > Are you sure your packets are forwarded via netfilter? Try to disable forwarding (with sysctl) or change rulte to -j DROP and check traffic with sniffer (no packet should be forwarded from virt machine to the Internet)

Re: Firewall POSTROUTING problem

On Wed, Aug 11, 2021 at 11:50:30PM +0200, deloptes wrote: > Alain D D Williams wrote: > > > iptables -A FORWARD -j ACCEPT > > > > and the OUTPUT? OUTOUT is also ACCEPT, however this is not, I think, important as the packets come from 10.239.239.23 (via br0) and go to the Internet - thus

Re: Firewall POSTROUTING problem

Alain D D Williams wrote: > iptables -A FORWARD -j ACCEPT > and the OUTPUT? > and this is not a problem ... evidence is outgoing packets with source > address 10.239.239.23 ah, ok, I misinterpreted it. -- FCD6 3719 0FFB F1BF 38EA 4727 5348 5F1F DCFE BCB0

Re: Firewall POSTROUTING problem

On Wed, Aug 11, 2021 at 11:32:51PM +0200, deloptes wrote: > I remember it was not only the POSTROUTING. May be I am wrong, but I think > FORWARD and OUTPUT is important. > I also wonder why you are mixing up the -s and --to-source. You should be > using the local address for -s and --to-source

Re: Firewall POSTROUTING problem

Alain D D Williams wrote: > Hi, > > I have problems getting POSTROUTING to work on a Debian 10 box. > > Setup: > > INTERNET ... Broadband modem 192.168.108.1 > > Network internal to the Debian box for virtual machines 10.239.239.0/24 > > Debian has address 192.168.108.2 (interface enp3s0)

Re: Firewall o Filtro de Contenidos en modo Bridge.

El 31 de julio de 2018 19:52:29 CEST, JCMD escribió: >Si, > >Tienes que buscar Open bridge transparent proxy. > >Saludos > >El mar., 31 de jul. de 2018 1:50 PM, Ramses >escribió: > >> Hola a tod@s, >> >> Los firewalls FortiGate tienen un modo de funcionamiento, Bridge, en >el >> que lo insertas,

Re: Firewall o Filtro de Contenidos en modo Bridge.

El 31 de julio de 2018 19:54:17 CEST, Itzcoalt Alvarez escribió: >Pfsense podria ser la opcion > >El 31 de julio de 2018, 12:50, Ramses >escribió: > >> Hola a tod@s, >> >> Los firewalls FortiGate tienen un modo de funcionamiento, Bridge, en >el >> que lo insertas, entre el router del Operador y

Re: Firewall o Filtro de Contenidos en modo Bridge.

Si, Tienes que buscar Open bridge transparent proxy. Saludos El mar., 31 de jul. de 2018 1:50 PM, Ramses escribió: > Hola a tod@s, > > Los firewalls FortiGate tienen un modo de funcionamiento, Bridge, en el > que lo insertas, entre el router del Operador y la LAN, y actúan como > Firewall /

Re: firewall rules for NAT

On 1 Jul 2017 7:31 pm, "Pascal Hambourg" wrote: Le 01/07/2017 à 03:25, Igor Cicimov a écrit : > > You know what, i just checked the iptables rules the op sent again and > realized this: > > -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp > >

Re: firewall rules for NAT

On Sat, 1 Jul 2017 13:25:30 +0200 Pascal Hambourg wrote: Hello Pascal, >Are you sure that your mailer displays the plain text version, not the >HTML version ? I'll change my answer; I only looked at a couple of Igor's messages and they were fine. However, further

Re: firewall rules for NAT

On Sat, 1 Jul 2017 13:25:30 +0200 Pascal Hambourg wrote: Hello Pascal, >Are you sure that your mailer displays the plain text version, not the >HTML version ? Positive. I use Claws Mail *without* any HTML plugin. -- Regards _ / ) "The blindingly

Re: firewall rules for NAT

Le 01/07/2017 à 12:54, Brad Rogers a écrit : On Sat, 1 Jul 2017 11:30:41 +0200 Pascal Hambourg wrote: Hello Pascal, PS. Igor, the plain text version of your posts does not properly mark the quoted text from the message you reply to : it appears as if it was your text,

Re: firewall rules for NAT

On Sat, 1 Jul 2017 11:30:41 +0200 Pascal Hambourg wrote: Hello Pascal, >PS. Igor, the plain text version of your posts does not properly mark >the quoted text from the message you reply to : it appears as if it was >your text, without any quotation marks. It's fine

Re: firewall rules for NAT

Le 01/07/2017 à 03:25, Igor Cicimov a écrit : You know what, i just checked the iptables rules the op sent again and realized this: -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT --to-source 10.7.33.100 is NOT how you would do SNAT with DNAT, you

Re: firewall rules for NAT

On 1 Jul 2017 7:13 am, "Pascal Hambourg" wrote: Le 30/06/2017 à 15:09, Igor Cicimov a écrit : > On Fri, Jun 30, 2017 at 3:50 PM, Pascal Hambourg > wrote: > >> >> Stateful NAT requires symmetric routing, i.e. reply packets go through the >> router

Re: firewall rules for NAT

Le 30/06/2017 à 15:09, Igor Cicimov a écrit : On Fri, Jun 30, 2017 at 3:50 PM, Pascal Hambourg wrote: Stateful NAT requires symmetric routing, i.e. reply packets go through the router that did the NAT operations on original packets and keeps the state for these NAT

Re: firewall rules for NAT

On Fri, Jun 30, 2017 at 3:50 PM, Pascal Hambourg wrote: > Le 30/06/2017 à 00:38, Igor Cicimov a écrit : > >> On 29 Jun 2017 6:32 pm, "Lucio Crusca" wrote: >> >>> >>> Il 27/06/2017 23:35, Pascal Hambourg ha scritto: >>> >>> Le 27/06/2017 à 13:29, Lucio

Re: firewall rules for NAT

Le 30/06/2017 à 00:38, Igor Cicimov a écrit : On 29 Jun 2017 6:32 pm, "Lucio Crusca" wrote: Il 27/06/2017 23:35, Pascal Hambourg ha scritto: Le 27/06/2017 à 13:29, Lucio Crusca a écrit : -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT --to-source

Re: firewall rules for NAT

On 29 Jun 2017 6:32 pm, "Lucio Crusca" wrote: Il 27/06/2017 23:35, Pascal Hambourg ha scritto: > Le 27/06/2017 à 13:29, Lucio Crusca a écrit : > >> >> -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT >> --to-source 10.7.33.100 >> >> > If this rule is required,

Re: firewall rules for NAT

Il 27/06/2017 23:35, Pascal Hambourg ha scritto: Le 27/06/2017 à 13:29, Lucio Crusca a écrit : -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT --to-source 10.7.33.100 If this rule is required, then your routing setup is wrong. Thank you very much, that was the problem.

Re: firewall rules for NAT

On 27 Jun 2017 9:29 pm, "Lucio Crusca" wrote: Il 26/06/2017 11:35, Dan Purgert ha scritto: > That shouldn't be happening -- you may have an errant rule you didn't > show > I think I did show that rule: -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT

Re: firewall rules for NAT

Le 27/06/2017 à 13:29, Lucio Crusca a écrit : -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT --to-source 10.7.33.100 The problem is that without that rule things do not work at all (connections time out). If this rule is required, then your routing setup is wrong. What is

Re: firewall rules for NAT

Il 26/06/2017 11:35, Dan Purgert ha scritto: That shouldn't be happening -- you may have an errant rule you didn't show I think I did show that rule: -A POSTROUTING -d 10.7.33.109/32 -p tcp -m tcp --dport 25 -j SNAT --to-source 10.7.33.100 The problem is that without that rule things do

Re: firewall rules for NAT

Lucio Crusca wrote: >[...] > It works like a charm, but there is one problem: my mail server receives > all the connections from the router, which has its own private IP > address (10.7.33.100), so the mail server can't enforce SPF policies nor > DNS RBL rules on incoming mail connections.

Re: Firewall

El mié, 15-03-2017 a las 16:49 -0400, luis godoy escribió: > Hola, se puede usar o instalar un firewall en una versión live? > (Versión 8) si (http://www.netfilter.org/documentation/index.html)

Fwd: Re: firewall para novatos

hola! El 26/11/16 a las 14:20, R Calleja escribió: Lo mejor es iptables, sirve para todas las distribuciones linux y es muy configurable, mucho mejor que los graficos. Abajo un scrip de firewall para un servidor, con algunas modificaciones puede servir: #!/bin/bash # Dirección IP del

Re: firewall para novatos

El 26/11/16 a las 14:57, Laotrasolucion escribió: El 26/11/16 a las 10:35, divagante escribió: Hola gente! Bueno, por conveniencia para quien quiera ayudarme con algun dato dire que soy un usuario de debian de 7 años de antiguedad, pero que aun no encontre el tiempo o las ganas de conocer

Re: firewall para novatos

Firestarter http://robersoft.blogcindario.com/2011/01/00010-firewall-cortafuegos-en-ubuntu.html *Saludes;* rasa. El 27 de noviembre de 2016, 17:08, Alejandro Gutiérrez < alexfile...@gmail.com> escribió: > Algo simple e intuitivo podría ser Gufw, la interfaz gráfica de ufw. > > El 27/11/16

Re: firewall para novatos

Algo simple e intuitivo podría ser Gufw, la interfaz gráfica de ufw. El 27/11/16 a las 11:09, Ricardo Adolfo Sánchez Arboleda escribió: > Mira > https://es.wikipedia.org/wiki/PfSense > https://pfsense.org/ > > > > *Saludes;* > > rasa. > > El 26 de noviembre de 2016, 12:57, Laotrasolucion >

Re: firewall para novatos

Mira https://es.wikipedia.org/wiki/PfSense https://pfsense.org/ *Saludes;* rasa. El 26 de noviembre de 2016, 12:57, Laotrasolucion escribió: > > > El 26/11/16 a las 10:35, divagante escribió: > > Hola gente! > > > > Bueno, por conveniencia para quien quiera

Re: firewall para novatos

El 26/11/16 a las 10:35, divagante escribió: > Hola gente! > > Bueno, por conveniencia para quien quiera ayudarme con algun dato dire > que soy un usuario de debian de 7 años de antiguedad, pero que aun no > encontre el tiempo o las ganas de conocer profundamente la > administracion de

Re: Firewall de baixo custo com Debian

Em casa uso um raspberry 2 funciona 100%. Pode usar 2 ou 3.E como o consumo de bateria é baixo. Ao encaminhar esta mensagem, por favor: 1 - Apague meu endereço eletrônico; 2 - Encaminhe como Cópia Oculta (Cco ou BCc) aos seus destinatários. Dificulte assim a disseminação de vírus, spams e

Re: Firewall de baixo custo com Debian

Se alguém tiver interesse tenho um mini pc parado em casa que usava como lab, tem um atom, 2 ou 4 gb de ram, disco sata 120gb, 1 porta giga, wireless, usava ele com uma switch gerenciável. Atendia muito bem o que eu precisava, e o bom dele é o baixo consumo de energia e não ocupar espaço, pois ele

Re: Firewall de baixo custo com Debian

2016-08-26 11:51 GMT-03:00 Diego Neves : > Em 26 de agosto de 2016 11:33, Tiago Pigazao escreveu: >> Rodrigo, No meu ambiente eu tenho um solução bem parecida com o que você >> pretende fazer... no meu caso eu uso um K6-2 500mhz, 128ram, 40GB HD , nele

Re: Firewall

El Wed, 24 Aug 2016 10:49:31 -0700, Luis Ernesto Garcia escribió: > Deseo contruir una minidmz o sea tres pc una con tres tarjetas de red > una tarjeta para el adsl una para la lan y otra para la dmz, en un > comienzo pienso debian con un iptables y un dns para el server > principal, y dentro de

Re: Firewall

El 24/08/16 a las 13:49, Luis Ernesto Garcia escribió: Deseo contruir una minidmz o sea tres pc una con tres tarjetas de red una tarjeta para el adsl una para la lan y otra para la dmz, en un comienzo pienso debian con un iptables y un dns para el server principal, y dentro de la dmz un

Re: Firewall de baixo custo com Debian

vlw Thiago! Em 16 de agosto de 2016 21:29, Thiago Zoroastro < thiago.zoroas...@yahoo.com.br> escreveu: > Boa noite, > > Gostaria de indicar a você buscar por Dual Core, de preferência um E7500, > que é 2.93 GHZ e tem um desempenho bastante satisfatório. E é bastante > econômico no gasto de

Re: Firewall de baixo custo com Debian

On 16-08-2016 20:52, Rodrigo Cunha wrote: > Srs. quero montar um firewall/squid e VPN para a minha residencia com > o intuito de distribuir internet gratis para duas ruas proximas a > minha residencia. > Meu objetivo é além de prover internet, melhorar meu conhecimento com > squid e iptables

Re: Firewall de baixo custo com Debian

Boa noite, Gostaria de indicar a você buscar por Dual Core, de preferência um E7500, que é 2.93 GHZ e tem um desempenho bastante satisfatório. E é bastante econômico no gasto de energia. De custo benefício no mercado é o melhor que havia, porque é barato e bastante eficiente: Intel® Core™2

Re: Firewall - basic config?

On 04/27/2016 05:22 AM, Jonathan Dowland wrote: On Sat, Apr 23, 2016 at 01:04:36PM -0400, Harris Paltrowitz wrote: 2. I found that "ufw" works as a line-command-based-front-end to iptables. Good call. ufw is (IMHO) one of the best iptables-frontends for basic FWs. I am particularly fond of how

Re: Firewall - basic config?

On Sat, Apr 23, 2016 at 01:04:36PM -0400, Harris Paltrowitz wrote: > 2. I found that "ufw" works as a line-command-based-front-end to iptables. Good call. ufw is (IMHO) one of the best iptables-frontends for basic FWs. I am particularly fond of how easy it makes adding a rate-limiting rule. > 3.

Re: Firewall - basic config?

On Sat, Apr 23, 2016 at 01:04:36PM -0400, Harris Paltrowitz wrote: > Hi List, > > I have a question regarding how I've configured my iptables to act as a very > basic "firewall", i.e., one that simply prevents any and all incoming > connections. Now, from my readings over the past several days I

  1   2   3   4   5   6   7   8   9   10   >