I have a dedicated server which hosts game servers, and is vulnerable to DDoS attacks. I want to get a DDoS-protected VPS to act as a reverse proxy for UDP. The dedicated server's IP address is 7.7.7.7 and the VPS's IP address is 9.9.9.9.  The whole idea is to hide the 7.7.7.7 address, so that it's not visible to the public when connecting to my game servers. When players connect, they should be sending packets to 9.9.9.9 and receiving packets from 9.9.9.9. If 7.7.7.7 was visible, hackers could directly attack it and bypass my reverse proxy. I don't want to "route" the UDP packets. I don't care if all the players will come from the same IP address.  Is there any way I can do this on Linux? If so, what commands?
122760
I have a server running UDP server on port 50000. This server receives updates from clients, and pings back the clients every 5 seconds to the socket they were connected from.  Now I want to redirect all the traffic to and from this UDP server via another server. Basically I want to setup a transparent proxy in front of this server. The reason is that I want to be able to easily control which server handles the UDP traffic, without the need to change DNS settings.  At first I tried usingn socat to create this proxy:   socat UDP-LISTEN:50000,fork UDP:myserver:50000  But this seems to work well for incoming traffic, but back traffic from my server to the clients doesn't reach its destination. Also it seems that socat forks another process for each connection, so I might end up with too many processes and also dead processes when clients disconnect/switch IP.  I realized that I can use iptables NAT functionality for this, but it doesn't seem to work for me. The configuration I've tried is:  sudo iptables -t nat -A PREROUTING -p udp --dport 50000 -j DNAT --to-destination myserver:50000  But it doesn't seem to work -- I don't even see the connections on my server. I'm not sure if it's due to wrong configuration or due to some other issues.  Some questions:   Do I need to somehow restart iptables once I add the nat configuration? Do I need to allow traffic to the incoming port or having the NAT setting is enough?   UPDATE: The server that actually handles the traffic is on a different machine than the one that I'm trying to setup iptables on.
62970
I'm looking for a way to change my public IP address. You know, the one that other websites see.   I know what I'm looking for is basically a proxy server, but I don't want to use a proxy for 2 reasons:  1) It slows me down. 2) See reason #1.  I'm using Ubuntu 9.10, I'm connecting to a public WiFi network (the ISP is Time Warner Cable). I'm getting my IP through DHCP.  Thanks for any help!
27578
My new server got hacked (sigh).  I have physical access to my machine.  It seems like the only changes made was a new user account created and a broken /etc/sudoers file.  It seems as though the password was discovered by dictionary attack.    After I fix these problems (or do a full re-install?), I want to add a mechanism to ban an IP (for maybe 24 hours or some time limit) after getting the password wrong x number of times, but I'm not a unix sysadmin or anything, so I'm not really sure where to get started.  What software should I use and how can I configure it?  Thanks.
22185
I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm starting to worry since they are getting more common (last month I got 2 attacks, and on november 7th there are 3 attempts already (1st, 4th and 6th of nov).  I'm not really concerned about it, since I don't have any database. All the info i have on that server is absolutely public, but I'm worried about that attacking-rate increase.  So I thought I could -temporarily- block the IPs that come from those attackers, or something that could make my server ignore requests that ask for phpMyAdmin, pma, xamp, etc.  Is there something like that? my server is Linux+Apache+Php
111640
I have set $conf['reverse_proxy'] = TRUE; in settings.php, but the IP address logged in the flood table is 127.0.0.1, not the one passed through the X-Forwarded-For header. Nginx is configured to send the X-Forwarded-For header to Apache, but it seems Drupal isn't recognizing it.  This is pretty bad because a few failed logins can lockout for everyone.  How can I make Drupal use the IP passed within the X-Forwarded-For header?
108960
My home PC has a VPN connection to my office. The office network is firewalled, with a secure zone on 192.168.0.* and a DMZ on 10.0.0.*   From outside, www.mycompany.com routes to a public IP - say 1.2.3.4. Our firewall NATs that to 10.0.0.4. From within the office LAN, we use DNS records on our domain controllers to resolve www.mycompany.com straight to 10.0.0.4, because we can't route to the public interface of our own firewall.  When I connect the VPN from home, I get a 192.168.0.* IP assigned via DHCP, but because I'm not using the VPN as my default gateway, I can't route to 10.0.0.* addresses unless I manually add a route.  I've created a persistent route to pass traffic for the 10.0.0.* subnet via the default gateway on the secure firewall zone:  route add -p 10.0.0.0 mask 255.255.255.0 192.168.0.1   Here's the problem. When I reboot, the route still appears in the routing table - fine. If I then connect the VPN, the route appears, but doesn't work - I can't route to anything on the 10.0.0.0 subnet. BUT, if I remove and then re-add the route AFTER the VPN is connected, it works fine.  I have no idea why this is the case. The before/after configuration is IDENTICAL - same IP, same route table - but if I create route then connect, it fails; if I connect the VPN and then create the route, it succeeds.  Looking for any tips as to how I can either stabilize the configuration, or automatically create the route when the VPN connects?
102112
On a linux  networked machine,  i would like to restrict the set of addresses on the "public" zone  (firewalld concept), that are allowed to reach it. So the end result would be no other machine can access  any port or protocol, except those explicitly allowed, sort of a mix of     --add-rich-rule='rule family="ipv4" source not  address="192.168.56.120" drop'    --add-rich-rule='rule family="ipv4" source not  address="192.168.56.105" drop'   The problem above is that  this is not a real list, it will block everything since if its one address its blocked by not being the same as the other, generating an accidental "drop all" effect,  how would i  "unblock" a specific non contiguous set? does source accept a list of addresses? i have not see anything in my look at the docs or google result so far.     EDIT: I  just  created this:  # firewall-cmd  --zone=encrypt --list-all encrypt (active)   interfaces: eth1   sources: 192.168.56.120   services: ssh   ports: 6000/tcp   masquerade: no   forward-ports:    icmp-blocks:    rich rules:    But i can still reach port 6000 from  .123   my intention was that   if a source is not listed, it should not be able to reach any service or port
122026
I just purchased a domain on Dreamhost, let's say foo.com. I already have hosting, let's say at 123.4.56.789, and have setup a directory foo.com which is accessible at 123.4.56.789/foo.com/. I can set the DNS to point foo.com to that IP, but how do I route it to that folder once it's there? My hosting has a really bad cPanel that gives me almost no help. Can I use .htaccess, or something else? What's the best way to accomplish this?  Edit in response to comment(s): It's VPS hosting, so I have access to http.conf and other system files. Also, yes it's Apache.
10329
I am running multiple web servers in my house, each of which is plugged into my router.  Server A Server B Server C  I currently can only use one server since my IP (xx.xxx.xx.xx) port 80 is pointing towards server A. However some domains point to server A, some to B, etc.  With my one IP address, how do I point to each server? For example my A(host) records all point to just my IP address.  Sorry if I sound confusing. Let me know if I am not being clear.  Each server is running Ubuntu Server 12.04.02 and is using Apache (if that helps). My router is also a Netgear and my ISP is Time Warner Cable.
103443
Any site that I visit can see my local IP (e.g. 192.168.1.102). Is there any reliable way to block this behavior? (browser setting, OS setting, router setting, etc.) I am particularity interested in Google Chrome and Mozilla Firefox, but any modern open source browser will do. If it is a browser plugin, it should be open source with a solid user base.  By reliable I mean, that I do not need to check the leakage again after every software update.  More info / what I have read so far:   There was a Chrome plugin that is not working anymore Local IP is obtained using JavaScript / WebRTC   Live Demo here:  Source code:   Firefox developers is not going to fix the leak (bug is open from 2014):  In Private / Incognito mode does not prevent this leak. If you use static IPs, and have non typical local IP (e.g. 10.66.77.88 or 192.168.212.121), then there is no need for . Your external IP + internal IP is perfect fingerprint.   Update 1: It is not duplicate of  - I want to prevent private / local IP leak, not disable all WebRTC.  Update 2: No, it is not related to header X-Forwarded-For (HTTP_X_FORWARDED_FOR), that is added when user/administrator chooses to do so. In my provided demo it is not your choice... It is Google's and Mozilla's choice to leak your private IP even when using private browsing mode.  Update 3: Ability to determine my local IP allows malicious JavaScript to quickly identify my local subnet and print on my local network printers from any website in the world without me doing anything.  This  finds my LAN printers using JavaScript.  Update 4: It is not a good idea to reveal private IP to every website. By seeing your private IP, for example 192.168.88.101, I can guess with very high probability that you are using MikroTik router. Also, I can track particular user event if user uses different browsers because local and remote IP stays the same for some time (hours or even days).
76181
My DSL/WiFi router provided by my ISP has an internal IP address of 10.0.0.138, the addresses provided by DHCP are in the format of 10.0.0.xxx.  Now, I want to start using static IP addresses on my local network, and I don't know what to provide for the subnet mask.  What is a subnet mask?  Should I be using 255.255.255.0 or 255.0.0.0 as my subnet mask? What is the difference?
66517
I want to block my server talking to an external IP address continously.  The IP address in question is I think is being hijacked or spoofed. When Used who.is it resolves to Netherlands. But if you use any other tools it resolves to Jordan.  Any step by step configuration is highly appreciated.  Thank you Kind Regards N
26431
If several computers with local addresses (192.168.0.#) are connected to a router and each computer opens a web browser and requests a page over HTTP, when these TCP:80 packets are sent out, the router switches the local address with the static IP of the router (i.e. Provider given IP) so the server can reply to the appropriate address.   But how does the router know to which computer to forward the HTTP reply, since the TCP header does not contain the local IP address (does it?), and all computers are using port 80?  Does this have anything to do with the MAC addresses?   How exactly does this work?
34193
I have a server on local network with local IP 192.168.0.1 that is running POP3 server on port 995 (SSL). This server doesn't have external IP and I am not in control of it.  There's another server on local network with local IP 192.168.0.2 and external IP 123.123.123.123. It is running Ubuntu 16.04 and I have control over it.  How do access port 995 on server 192.168.0.1 via external IP 123.123.123.123?  UPDATE: So I tried this with iptables on 192.168.0.2 with no success so far:  sudo iptables -t nat -A PREROUTING -p tcp --dport 995 -j DNAT --to-destination 192.168.0.1:995
114948
I know about the "hosts" file that can map ips to static names.  But I want to do the same thing inside the router, so I can access this "hosts" file by any computer on that LAN. I have D LINL router. how can I achive my target?
93678
I have a small but popular local website, it is a nonprofit venture. We arrange programming contest. But randomly in some contest our servers goes down. For example in last contest, we had around 300 users and we deployed 12 C4Large grade servers (when site went down, we increased server to tackle it) but still the site was down for 2 hours (even though after 1 hour most of the contestants left seeing the site not working). All our servers are accessed through AWS Load balancer and we use SSL in the load balancer level. I think due to using load balancer, IIS can't differentiate upcoming traffic by IP so i can't apply the IIS built in dynamic IP based restriction for such attack. Is there a way to do these from AWS?  Is this an issue of DDos/Dos attack on our server? We use the same server and same code but in some contest we face this issue but in some other we do not face this issue. But I do not know how to track this to be sure whether we are under DDos or not. What can we do to protect ourselves?  Thanks
36586
Quick question - I run two linux boxes, one my own desktop and the other my VPS. For security reasons on the VPS end I opted for socket connections to MySQL (/var/run/mysqld/mysql.sock). I know I can tunnel like this: ssh -L 3307:127.0.0.1:3306 user@site.com if I set up the remote sql server to listen on some port, but what I want to know is can I do something like: ssh -L /path/to/myremotesqlserver.sock:/var/run/mysqld/mysql.sock thereby tunnelling two sockets, as opposed to two ports?  A perfectly acceptable solution would also be to forward a local port to the remote socket file, but where possible I'm trying not to have tcp servers running on the remote box.  (and yes, I know tcp would be easier).