Tag Info

New answers tagged

1

I found a site that has a useful list. I suspect you were missing a few (like 8080, which is commonly used). You can use a tool like netstat to see which ports you are using at any given time. I think netstat -u netstat -t may do it, but there is probably something better out there! Be careful what options you pass to netstat because it also lists ...


0

The rule needs to be ufw allow out to any port 80. Any connection to the outside comes from a local port (but not 80!), to another computer's port 80, thus the rule must allow outbound to anywhere, on port 80. Of course, the port and destination can be changed, but that should work.


1

For what I can read from the NMAP manual there are 6 states (at least for NMAP): Open State An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers ...


1

Yes, you can add ip_conntrack_ftp to /etc/modules. Be attentive, you don't have to enter the modprobe command, just the name of kernel module!


0

For begining you look on witch port your web application work under ubuntu netstat -a Is averting ok you will see: tcp 0 0 *:9090 *:* LISTEN This mean that you server listen for incoming connection on this port. Default port for https is 443. Maybe you server listen on that port. If is iptables ...


1

Instead of the iptables, You could try: sudo ssh -gL 80:127.0.0.1:8080 localhost


0

Ok, iptables rule for this can be something like this this will accept dns req sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT This will create chain to catch dns req sudo iptables -t nat -N CATCH_DNS sudo ...


-1

Try running the container with a specific IP. docker run -d -p 127.0.0.1:4040:4040 ...


1

I don't know much about OpenVZ, but after reading some documentation, the veth Net device sounds a bit more friendly as it has more features: http://openvz.org/Differences_between_venet_and_veth But don't quote me on any of this. I checked the links by "Feature veth venet" Original answer by Tasos


0

Try iptables -A PREROUTING -d xxx.xxx.xxx.xxx -p tcp -m tcp --dport 25 -j DNAT --to-destination yyy.yyy.yyy.yyy xxx.xxx.xxx.xxx - represent ip of your mail server yyy.yyy.yyy.yyy - represent destination ip Edit Maybe is better to do post routing. iptables -t nat -A OUTPUT -i ethX -s xxx.xxx.xxx.xxx -p tcp -m tcp -j DNAT --to-destination ...


0

iptables is accepting connections from anywhere destined to port 80, fine. Based on the fact that you can curl localhost but NOT from another host within the LAN, I reckon the daemon running listens to loopback only, change it to listen on your NICs, for example eth0 and restart the service. e.g. Apache vhost config file <VirtualHost *:80> Nginx ...


2

Well you can not prevent ddos, and 200 requests is rather trivial. Best you can do , IMO, is to set limits sudo iptables -A INPUT -m limit --limit 50/minute --limit-burst 200 -j ACCEPT sudo iptables -A INPUT -j REJECT For port 80, use sudo iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT ...



Top 50 recent answers are included