I wanted to create a zone named "bad" with a target=reject and source=10.100.0.0/24 which will basically reject all traffic from that subnet. In the zone.  Now, if I want to allow traffic to SSH from that subnet, how can I do that?  I tried adding service SSH to "bad" zone but no luck, then I tried to add a rich rule no luck...  I tried to do what a firewall would normally do, which is denying all request that didn't match any rule...  Thanks
123495
I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server.  How can I achieve this, as the documentation I could find was too specific on this?
60353
I've looked around the web for a solution and have found numerous threads with different suggestions.  Most of which I've found has been using LUA on the resolver to return records. Other posts suggest using GEO-IP or Pipe backends. All of the content I've read have used   I am curious to know if it is possible, via LUA to change the Forwarder based on the network range rather than using LUA to store zone information.  If I can get logic similar to the following to work I should be all set:  if sourceip comes from (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) {      forwarder = 192.168.0.1; }else{      forwarder = 8.8.8.8; }   I don't see any examples of LUA from pdns that demonstrate changing any settings within PDNS itself, and am curious if that is even possible.
53208
Let's Encrypt has  they have:     Turned on support for the ACME DNS challenge   How do I make ./letsencrypt-auto generate a new certificate using DNS challenge domain validation?  EDIT I mean: How do I avoid http/https port binding, by using the newly announced  feature (2015-01-20) that lets you prove the domain ownership by adding a specific TXT record in the DNS zone of the target domain?
119994
Every night I get hundreds, sometimes thousands, of failed ssh logins on my RedHat 4 server. For firewall reasons from remote sites, I need to run on the standard port. Is there anything I should be doing to block this. I notice that many come from the same IP address. Shouldn't it be stopping those after a while?
16180
I want to run a minecraft server (port 25565) and have it send to my external address for others to play, then to my hostname (I am assuming this is automatic - Do I need a rule for this too?).  But I need to map my ipv4 address (or port 25565) to my external address. I have opened the ports on my router config, so this is all I need. Thanks!
9595
I'm on Fedora 19 and I have a problem with ssh.  Ssh is up and running and I can connect when I enter my lan ip. But when I try my server name (blahblah.no-ip.org) I get a connection refused. No-ip is already running as a service and is working properly (sending the correct ip).  I've already set up port forwarding on my router, I also changed the port of ssh both on the service and on the router port forwarding (in case my beloved ISP decided to block those ports). But still I get a connection refused and when I nmap the hostname I see that the ssh port is closed.  One thing though: I have two PCs under the same external ip (I've set up the port forwarding to the correct internal ip). When I nmap blahblah.no-ip.org I get a Port 23 and 80 open. 80 seems OK but I've never started telnet service on my machine.  Any ideas what else to try? Router is zte zxv10 and port forwarding is correctly set up. I say this because I've already set up port forwarding for deluge and it's working properly.
18491
This is a  about DNS server administration.   I have one hundred or so domains. All of these domains need to be configured identically, but it seems like a huge waste of time to have to configure a new zone and/or zonefile for every one of these domains. There has to be a better way to automate this!  I think I'm on to something...if I create a zone called ., or use some other feature in my DNS software to always return a specific IP when an A record is requested, this seems to get me pretty close to my desired end result. My server is responding authoritatively to the requests and it's so much easier to manage!  This was working great until nameserver validation software started checking these domains. I figured out that I can make most of the errors go away by adding NS records, but my software won't let me put more than one SOA record in the same zone file.  How do I work around this multiple SOA record problem?
12309
I'm trying to setup openssh-server, but I'm having some issues connecting. I changed the port to something non-standard (57757) and then set my router to forward to that port. On my LAN, I'm able to ssh into my machine fine using port 57757, but not able to do so on the WAN.   If I'm outside the LAN, and I try to access my machine by an incorrect port, I immediately get a "connection refused" message. However, with the correct port it just hangs and then timeouts.   What can I try to debug the issue? I tried a traceroute, but it didn't tell me anything useful.  EDIT: I realized that my problem was that my router didn't support accessing it by WAN IP internally. I ssh'd out to a different server and back in and it worked fine.
1460
This is a  about IPv4 Subnets.      Related:               How does Subnetting Work, and How do you do it by hand or in your head?  Can someone explain both conceptually and with several examples? Server Fault gets lots of subnetting homework questions, so we could use an answer to point them to on Server Fault itself.   If I have a network, how do I figure out how to split it up? If I am given a netmask, how do I know what the network Range is for it? Sometimes there is a slash followed by a number, what is that number? Sometimes there is a subnet mask, but also a wildcard mask, they seem like the same thing but they are different? Someone mentioned something about knowing binary for this?
51706
For some reason, I have a server that if ssh into another server...you don't need to enter the  password.  How is this done? Can someone give me step by step instructions please?
37649
We have a public server which accepts SSH connections from multiple clients behind firewalls.   Each of these clients create a Reverse SSH tunnel by using the ssh -R command from their web servers at port 80 to our public server.  The destination port(at the client side) of the Reverse SSH Tunnel is 80 and the source port(at public server side) depends on the user. We are planning on maintaining a map of port addresses for each user.  For example, client A would tunnel their web server at port 80 to our port 8000; client B from 80 to 8001; client C from 80 to 8002.  Client A: ssh -R 8000:internal.webserver:80 clienta@publicserver  Client B: ssh -R 8001:internal.webserver:80 clientb@publicserver  Client C: ssh -R 8002:internal.webserver:80 clientc@publicserver   Basically, what we are trying to do is bind each user with a port and not allow them to tunnel to any other ports.   If we were using the forward tunneling feature of SSH with ssh -L, we could permit which port to be tunneled by using the permitopen=host:port configuration. However, there is no equivalent for reverse SSH tunnel.  Is there a way of restricting reverse tunneling ports per user?
40966
So here's the problem:   I have a single server with multiple hostnames, meaning I have A records example.com and *.example.com pointing to the server's ip-address I want to limit incoming ssh connections to a specific hostname, that is I want to allow only logins to user@secret.example.com, and disallow login attempts using user@ip-address or user@example.com   The man page from sshd_config has the following for ListenAddress:  Specifies the local addresses sshd(8) should listen on.   The following forms may be used:  ListenAddress host|IPv4_addr|IPv6_addr ListenAddress host|IPv4_addr:port ListenAddress [host|IPv6_addr]:port   which seems to indicate that sshd has the ability to restrict itself to a a specific hostname. However I've tried ListenAddress secret.example.com:22, but after restarting sshd that doesn't seem to add any restrictions based on hostname used.  man sshd_config doesn't seem to show any other options in that vein.  Is there something I'm missing, or does sshd simply not have that ability?
121341
Tunneling data over SSH is pretty straight-forward:  ssh -D9999 username@example.com   sets up port 9999 on your localhost as a tunnel to example.com, but I have a more specific need:   I am working locally on localhost host1 is accessible to localhost host2 only accepts connections from host1 I need to create a tunnel from localhost to host2   Effectively, I want to create a "multi-hop" SSH tunnel. How can I do this? Ideally, I'd like to do this without needing to be superuser on any of the machines.
40484
I'm trying to redirect a single port to a local server via IPtables.  Currently I have the following rules:  iptables -t nat -A PREROUTING -p tcp -m tcp --dport 55555 -j DNAT --to-destination 10.188.44.125:3306 iptables -t nat -A POSTROUTING -j MASQUERADE   When I have these rules in place, my rsync process of ssh fails.  I'm assuming something here is conflicting, but I'm not sure what.  Any suggestions?  Thanks!  Update: Here are the rules I have in place to allow the rsync over ssh connection.  My input policy is set to drop.  Other policys are set to accept.  iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT   Update 2  Here are the results of iptables-save for the nat:  *nat :PREROUTING ACCEPT [8:468] :INPUT ACCEPT [7:408] :OUTPUT ACCEPT [2:134] :POSTROUTING ACCEPT [0:0] [0:0] -A PREROUTING -p tcp -m tcp --dport 53306 -j   DNAT --to-destination 10.183.42.125:3306 [2:134] -A POSTROUTING -j MASQUERADE COMMIT
30890
describes how to SSH into a machine that can only be accessed through one or more hosts (that can also be SSH'd into).  Is there an equivalent way of using scp? That is, copy a file to my local machine from the far machine (assuming I have password or key access to all machines along the way)?
25546
I want to be able to route a portion of my traffic through another machine over SSH. For example, is it possible to browse the web through the ssh tunnel and also browse the web through your LAN connection without much effort? (i.e. I want a seamless transition from using tunnel to using LAN)   Thus it is not a simple how do I tunnel ALL web traffic through ssh tunnel, but moreso how can I setup a tunnel that I can use at my discretion but not impeded my normal traffic flow. (Kind of on an as-needed basis)    I would like the filtered traffic to be encrypted when leaving the LAN and it could be ftp, ssh, web, mail whatever traffic.    Some questions I think I need to answer/address:   Does this require multiple nics?  Does this require setting up a proxy?  Can I even do this the way I want it to function?    Are there other options aside from a tunnel to achieve the result of having some traffic (user decides) encrypted through another machine (outside the LAN) and have other traffic use the normal flow through the LAN and out into the internet world?   Edit: If some of the answers depend on specific traffic types I can be more specific and say that web traffic is a primary focus of this. However, other traffic such as IM/Email traffic would be desirable.
26637
I use Ubuntu 16.04 and seek to harden my SSH authentication in a special manner.  The current situation:  I have a machine with a minimal Ubuntu server I use mainly to transfer files to via its local OpenSSH server. Now, I don't have a firewall on that machine from a few reasons and I also avoid using a key pair hence I use only a password. One of the only ways I have left to defend from brute force attacks, and the one I most desire at the moment, is using a mechanism that blocks a user for X amount of hours, after Y amount of connection tries.  The desired situation:  I wish to have a standalone mechanism (that is, not as part of a firewall) that blocks a user for X amount of hours, after Y amount of connection tries as a way to defend from brute force attacks.  My Question:  Do you know a utility (and specific configuration) that will let me achieve the desired situation?