I like AWstats for viewing/visualizing web traffic to my server. However, I am in a situation where I would like to visualize ALL traffic to/from a network, in a way similar to AWstats. That is to say, Free and Visual. The program will have to be linux/http/java based as it will run on a linux server off of a Network Tap.
View 5 RepliesI wanted to tell my server to block all traffic but US only traffic. So i followed this guide:[URL].. Now I know, it's the best way to help prevent hackers/crackers (doesn't matter to me what they are called. I just have to stop them). My server only deals with US clients anyways so might as well just start right there for my server's security before getting into the brute force and injection preventions. So I got it all done compiled everything moved to the proper directory. I then started to setup my iptables. Like so
Code: iptables -F INPUT
iptables -F OUTPUT
iptables -I INPUT 1 -s *.*.*.* -p tcp --dport 22 -j ACCEPT
iptables -I INPUT 2 -s *.*.*.* -p tcp -j ACCEPT
[Code]...
After seeing that i went digging in the code and figured it was something todo with memory allocation.
Recently I notice that when I'm connected to an vpn server (pptpd) and I'm using it as a default gateway my download and upload speed decreases almost to the half of the usual speed. I made a test using iptables in order to count how much GRE packets are generated (except the real traffic itself) in that way:
Code:
iptables -I INPUT -p gre -j ACCEPT
iptables -I OUTPUT -p gre -j ACCEPT
iptables -I FORWARD -s 172.16.10.101 -j ACCEPT
iptables -I FORWARD -d 172.16.10.101 -j ACCEPT
The first 2 rules match all GRE packets between the pptpd server and client, and the next rules - the traffic between the server and the client.
When I turn the counters to zero and begin to generate traffic (to browse, to download etc.) I see that the GRE packets are even more than these in the FORWARD chain.
So, my question is first of all is my test correct and is it true that so much gre traffic is being generated during the browsing (it becames clear that the traffic is double than if the pptpd wasn't used as a gateway) and if yes - can that traffic be reduced?
I was wondering how I can get this done. I reinstalled my awstats and deleted my awstats data. How do I pull the data from my original access_log which is around 270MB in size.
Any suggestion? I tried updating awstats but it's timing out and I'm getting an internal server error which I assume is from the 270MB access_log size.
I need to set up my centOS computer as a firewall in my home network. Ive got 2 interfaces, eth0 and eth1. I want to allow and forward all traffic on eth0 and block all traffic on eth1 except ssh, ping(icmp) and DNS. How do I do this? Ive tried some editing in /etc/sysconfig/iptables but no luck.
View 1 Replies View RelatedI'm currently tunnelling to my Ubuntu pc at home from my laptop in order to bypass my schools false-positive prone filter. Is there a way to record traffic that both comes to and is delivered by my pc?
View 1 Replies View RelatedHow could I configure Ubuntu to be setup as follows...
Wireless Client ----> Wireless Router ----> Home Server ----> Internet
What is needed to make all of the wireless traffic go to my internet connection port. I will be having two ethernet cables plugged into the system one from the wireless router and one to my internet router.
I have just recently switched my setup to have my server be in the middle of traffic and act as my new router while making my other routers just switches. However, after doing this I can no longer access my UPnP devices. They used to show up in my router but I am assuming either there is an issue with my iptables rules or that some how having my server run the dhcp and dns routing is messing with UPnP.
View 2 Replies View RelatedI have set up a Virtual machine on a dedicated server from 1and1. I hoped to use a bridge to give the vm direct access to the internet but 1and1 do mac filtering and so the only option is to use NAT.
I used Virtual Machine Manager on my Ubuntu 10.04 machine at home to install Debain Lenny on the vm on the server using KVM and all went well. I put it on a virtual network 192.168.100.0 and i can access it from the host and i can access the internet from the guest using NAT that libvirt set-up.
I bought another ip address from 1and1 with the hope of forwarding packets to the new ip address 11.22.33.02 to the guest vm.
I have tried all sorts of routing rules using iptables without any success.
my virtual network is on virbr1 the guest ip is 192.168.100.50 my external network device is ip say 11.22.33.01 on eth0 with the secondary ip say 11.22.33.02 on eth0:1
Here are the latest rules i tried:
Quote:
iptables -t nat -A PREROUTING -d 11.22.33.02 -i eth0 -j DNAT --to-destination 192.168.100.50
iptables -t nat -A POSTROUTING -s 192.168.100.50 -o eth0 -j SNAT --to-source 11.22.33.02
iptables -A FORWARD -p tcp -i eth0 -o virbr1 -d 192.168.100.50 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
[Code].....
I am new to iptables. We have two Squid proxy servers running in "non-transparent mode" (172.16.0.1 and 172.16.0.2). Currently users have to configure the proxy server they want to use by configuring them in their browsers. Recently I saw an example for redirecting web traffic to a single transparent proxy server.
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
Can anyone modify this rule to accommodate my current setup of two proxy servers running in non-transparent mode. i.e Redirect web traffic to the 172.16.0.1-172.16.0.2 ip range.
I'm trying to setup a Centos 5.6 Squid Proxy Server with Content Filtering & Antivirus Scanning Incoming HTTP Traffic from the Internet
I then proceeded to setup an configure the Proxy Server, i was able to test and confirm that Squid and Dansguardian Content Filter is working, however i dont know if Clamav is scanning HTTP traffic before it hits the client/server. Is there a way i can check if the Antivirus scanning is working.. is there some log file or real world test i can i can do to confirm that Clamav is scanning incoming traffic or even blocking potential viruses ??
Anyone who has squid proxy server with Clamav configured and its working can share there settings/setup with me and how they tested it ??
Because I had some difficulties to make awstats running (I'm not an expert!), I would share my experience with a MINI STEP BY STEP GUIDE. I would like also to discuss some details with experts thus at the end of the guide ,I'll make some questions to them:
I have installed a new server Centos 5.5 32 bit and configured 3 virtual hosts; at the end of /etc/httpd/conf/http.conf I have:
-------http.conf virtual host--------
ServerName 127.0.0.1
NameVirtualHost *:80
<VirtualHost *:80>
[code]....
I need to stop the viewing of robots.txt on my website. I get the contents of the file displayed in my browser when I issue the command: [URL] stop this as it displays all the directories I don't want them to go to.
The main problem is that I can look at any directory on my site and get a file listing and then right-click on that file name and then save it to my client hard-drive all from my browser. ex: [URL] I think I can change this behavior in the apache config but don't know enough.
Suppose when I install squid proxy server Can I view the web pages visited by a particular user/machine in a particular session? I think we can analise the information by the log files of squid. But can I view the page(static)?
View 6 Replies View RelatedI've installed qmailtoaster on CentOS. I use vqadmin for managing virtual domain. I can list the current domains on vqadmin interface. But when I choose "View Domain", enter a my domain and choose "View Domain", I receive a white page. I can't view the information about my domain. Please help me to resolve the problem. I can create a new domain and view the domain on vqadmin but I can't view the existing domains.
View 1 Replies View RelatedI have been beating my head for the last few weeks on this problem, (although I have been taking the wrong approach, it seems).
I need a gateway to direct web traffic to three separate servers/domains. I have been trying to do this with both a dns server and , (seperatly), apache server to forward requests. The dns server was a no go, and <i can only get apache to redirect http and ftp.
After Googling this ALOT, I believe that what I need is a gateway server to redirect my traffic to the 3 different servers. I have been reading about using using nat and iptables for this and was wondering if anyone had any advice/suggestions on this. The other thought I had was to use something like pfSense to create the gateway, but I am still reading the documentation, and I am unsure if this approach will work.
About two years ago, my church set up a wireless access point. They gave it a WEP encryption, and wrote all the keys down on a piece of paper and taped it to the router, which was in full view, and reachable for anyone to get what they need and connect. I used it once, saved all the settings to the default network manager applet on my laptop (running Fedora Core 12), and put it back. Earlier this year, the front hall (where the router and paper with encryption keys was stored), was completely redone, and the router put up in the drop ceiling.
Mistake. Now the darn thing is sitting on top of Fiberglass insulation, and impossible to get to. There are people who need to connect, but since it's a church, and they don't really understand, they went and buried that router WITH all the encryption keys. So long story short, I need to get these people connected, but need to find the key... preferably without Hacking in. Is there a way, on the default "Network Manager" Applet, or in the terminal to VIEW saved keys?
We have something on our network that is reaking havoc with our content filter. I am trying to track it down, but so far I have been unsuccessful. We have approximately 500 devices in 100+ different locations spread across 9 states. Looking at each computer is not really feasible.
I need a machine that can sit in between our network and our internet connection and graphically monitor in real time and logs how much traffic each device is sending and receiving. It would need to sit inline so it has to have two nics and be able to pass traffic. The machine also needs to be transparent. Reconfiguration of our routers or workstations is not an option.
I have used ethereal and wireshark before. Ethereal may be a viable option, but wireshark seems to provide lots of information, but no practical way to make use of it. how to set up the box to be a transparent device on the network that will allow internet bound traffic to flow (freely)?
When I goto Places->Network sometimes I see the other Windows computers in our house, and sometimes I don't. How do I make this more consistent?
When I double click on the "Windows Network" icon right now, I get "Failed to retrieve share list from server". Sometimes this works and I get to see the shares on the Windows pcs.
I'st just installed 10.10 on Virtual Box. I'm trying to map some windows drives (On the host) permanently. Using Places->Connect To Server etc I can connect to my windows box no problem and see the directories etc in Nautilus (2.32.0) all ok.But rebooting the system results in my having to log in again - I've looked atis that the only what to get this to work permanently?Also, and more importantly K-Develop (And possibly others) can't see this mapped drive when I want to open a file from it? What would be the problem here?
View 4 Replies View RelatedI just installed awstats and I can't get it to generate any report? I used the default Fedora 12 install.Here is the config file:
Code:
LogFile="/var/log/httpd/access_log"
LogType=W
LogFormat=1
LogSeparator=" "
SiteDomain="dev-server.net"
[Code]...
I' running awstats via
/etc/logrotate.d/httpd
prerotate
/usr/bin/awstats_updateall.pl -awstatsprog=/var/www/awstats/awstats.pl now
endscript
I have a strange issue. The only time I have trouble with yum is when awstats is included in an update. When it is, it always hangs on it when it gets to it. Yum will not complete. I have to cancel out... kill the yum pid and do it again. Tonight I did a yum-complete-transaction to do some unfinished actions - one included the removal of an old awstats - it hung on that.
View 9 Replies View RelatedHow can I remove awstats from my Debian Lenny installation, will aptitude remove awstats
View 5 Replies View RelatedI'm trying to set up awstats for my web server which runs ISPConfig3. Due to ISPConfig, my log-rotated files have the extension .log.gz, and the naming syntax of DATE-access.log.gz.
According to awstats documentation, I need their tool to merge the log files, however, I cannot get it to work. I always get file not found or pipe error like messages.
Code:
I took a look at permissions, log files are world-readable. Checked path's 1000 times, no typo. When I try to find out whats wrong, the problems usually begins when I try to use the * character in the LogFile variable, ..
Anyone got experience with multiple log files and awstats? ...
We had recently got some problem with our server(local server) and we recently upgraded from Ubuntu server 8.04 to 10.04 and we were not able to access awstats logs from web.So can any one say a method to get back the logs from the server?
View 1 Replies View RelatedHow to install and configure awstats in ubuntu?
View 1 Replies View RelatedI'm trying to install awstats via the command line
after running
Code:
apt-get install awstats
, seems to install OK
when running the command
Code:
cp /etc/awstats/awstats.conf /etc/awstats/awstats.yourdomain.ext.conf
I get NO such directory or file any idea to why
I'm logged in as root system is Ubuntu 9.04 l TT ( karl )
I am using CentOS 5.4 and did a yum install of cacti. I installed all the necessay packages, like net-snmp, php net snmp and all that. Everything else works but I can't for the life figure out how to monitor traffic on eth0. I do not have any SNMP Interface Statistics or alike in either the Associated Graph Templates or Associated Data Queries.
Heres the output of "snmpwalk localhost -c public -v2c" , SNMPv2-MIB::sysDescr.0 = STRING: Linux xxx.xxxx.net 2.6.18-164.6.1.el5xen #1 SMP Tue Nov 3 17:53:47 EST 2009 i686
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (7515443) 20:52:34.43
[Code]...
I am trying to monitor the interfaces on the local computer only.
I was wondering what the best way of redirecting all traffic, not just http traffic, from my hosted web server on hostmonster (with a domain name) to my home server.... I wondered if it would be possible to do it with a simple script running on the hosted web server?? Also is there a way of getting round having all the ports open on the hosted web server that I want to use on my home server??
View 2 Replies View Related