Ubuntu Security :: Configuring Iptables To Allow VNC And OpenVPN?
Jun 20, 2010
I'm running Ubuntu 10.04 LTS as a VM in Hyper-V, and accessing it via VNC with a machine in the same broadcast domain. I'm using OpenVPN to connect to XeroBank. I have instructions for configuring iptables to permit establishing and using the XeroBank connection, while blocking all other traffic on eth0. I've followed them successfully. I need to also permit the VNC connection, and haven't managed that. FWIW, the VM is at 192.168.111.12::5900 and the workstation is 192.168.111.2.
The attachment to this post lists the recommended contents for each Shorewall file. Which files need changed, and what do I add to each?
View 3 Replies
ADVERTISEMENT
Mar 3, 2009
I new in Linux, I have a Centos5 since sunday and well I have to configure the iptables security of this cpu, I read a lot of examples of iptables in the internet and also another Thread from here but Really a don't know what to do, I saw lots of codes but first of all I don't know where I have to write that and my teacher don't want to help me in this homework. I tried to write the codes in applications --> accessories --> Terminal
View 3 Replies
View Related
Mar 20, 2011
I want to configuring openvpn-2.1.4 on linux redhat as client server using key, but there is some drawback
[Code]...
View 1 Replies
View Related
May 7, 2010
I have set up OpenVPN for my connection. I'm using this to connect to the internet from different locations using tunnelling.
Right now I have a few IP's : on eth0 I have IP from my ISP, on eth0:1 I have my own IP.I set up MASQUERADE to eth0 - but in this case when I try to access my restricted resources IP address from ISP is visible.
What I want is to use my own IP address from eth0:1 - could somebody help me to build good working redirect entry for that? I want to redirect all connections to that IP assigned on eth0:1... - just to access Internet using my IP.
View 3 Replies
View Related
May 23, 2011
I'd like to configure IPtables to make sure I can only access the internet through an openvpn connection (so when the connection is down I have no way to access the internet but to connect to the vpn again).
I know how to do this with Firestarter (restrictive outgoing policy and I only allow the vpn server IPs) but Firestarter seems to be stupid : for some reason eth0 was changed to eth1 and Firestarter can't work properly anymore, even though that probably can be fixed with Firestarter I'm no more interested in this program and I'd better like to know how to apply the same policy using IPtables.
I've tried a few things already but it failed each time ... how can I effectively allow my computer to connect to the VPN while everything else is blocked ?
View 3 Replies
View Related
May 31, 2011
my problem is following: I'm running a bridged OpenVPN on my Debian. If the service is running, everything works fine: local and Internet, ftp, mailing from in and outside etc. But, when stopping OpenVPN, sending mails from inside (LAN) fails: I cannot reach smtp (postfix) listening on port 465. And even reaching mailboxes using IMAP gets horribly slow eg. in Thunderbird. Here is my firewall.sh script.
Quote:
#!/bin/sh
echo "
IPTABLES FIREWALL inicializalasa - szures"
# Enter the designation for the Internal Interface's
INTIF="eth0"
[Code].....
View 9 Replies
View Related
Feb 7, 2016
I managed to set up an openvpn server, ip-forwarding and a nat iptable rule for that.
Almost everything works as expected, but my problem is:
Smartphone -> VPN -> Internet ==> works (by ip and hostname)
Smartphone -> VPN -> machine in my local network by IP ==> works
Smartphone -> VPN -> machine in my local network by its hostname => DOES NOT WORK
Machine w/ VPN server -> ping to machine in local network by ip or hostname => works
So, i wonder why i cant access a local machine through the vpn by its hostname. I guess I'm missing a forwarding rule??
iptables dump:
# Generated by iptables-save v1.4.21 on Sun Feb 7 20:56:52 2016
*nat
:PREROUTING ACCEPT [786:59064]
:INPUT ACCEPT [728:53047]
:OUTPUT ACCEPT [19:1487]
:POSTROUTING ACCEPT [20:1576]
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
COMMIT
# Completed on Sun Feb 7 20:56:52 2016
View 0 Replies
View Related
Apr 26, 2009
I've tried both the firewall interface that comes with Fedora and Firestarter, neither can configure as I want. So I think I'm going to have to do it by hand. In this laptop I have one 10/100 Nic and one wifi connection, at times either of them can be connected to the network. How can I configure IPtables so that any traffic is allowed out, nothing is allowed in (other than std stateful firewall replies), no icmp and that the fw logs any attempts to connect to the laptop?
View 5 Replies
View Related
Apr 27, 2011
Because my ISP is blocking every IP port under 1000, I'd like my local nat'ed server to be able to translate incoming and outgoing traffic from some port above 1000 to the default server port locally.Example :
To connect to my IMAP server (default port : 143) from the outside,I'd connect to my public IP, port 1143 (opened and nat'ed to the right server on my router) and the server would translate this port to 143 on the same machine.I wish I could simply configure my router to do that but sadly Linksys doesn't permit such setting... I also could modify the listening port of my server but I prefear to keep the default port inside my network.I think that iptables is the right tool to do that and I never used it and I must say that this tool is not so easy to configure at first sigh
View 5 Replies
View Related
Jan 2, 2010
Im a total beginner when it comes cryptography and networking. Finally managed to create a connection with OpenVPN on Ubuntu to a vpn provider called ivacy. On this page:http://ivacy.com/en/doc/user/setup/winxp_openvpn they give configuration files and keys, which I used. The question is, if someone wanted to see my network traffic, could they do it using the keys provided on that page. Reading the OpenVPN documentation i saw that it is also possible to create your own keys. Would that be more secure?
View 10 Replies
View Related
Nov 11, 2009
I've been tasked with setting up a RHEL FTP server to mirror one we currently have. From what I've read, I need to install and configure VSFTPD and then configure IPTables. From what I've been able to come up with, I need to follow the steps in this article to install and setup VSFTPD. Is this a good complete article to follow you think?Also, how do I copy the iptables config from that server to my new one? I think that iptables on our current server only allows certain IPs or blocks certain IPs (not sure which), so I need to have it do that on my new server as well
View 14 Replies
View Related
Jan 8, 2010
I have a running proxy server that I wish to also turn into a VPN server.The VPN is not used so much that a user can access the network but is used so that they can obtain a geo specific IP address for their applications (the proxy server only does this for HTTP).I would therefore like to block off the VPN from accessing any of my Linux box's ports such as email, web server etc.Clients are given local IPs of 172.16.0.x.What should I take into consideration to block off clients from accessing dangerous stuff on the network?
View 4 Replies
View Related
Nov 29, 2010
There dosent seem to be a guide for this...i can use pptp vpn on ubuntu-how do i use openvpn-a step by step guide would be really useful!!
The vpn provider i use is called 'hidemyass' vpn-anyone know if openvpn will work on ubuntu with this?
View 1 Replies
View Related
Jan 5, 2010
A couple of weeks ago I was using openvpn with a provider of PVNs on a home wifi network with no problems.I had installed openvpn using apt-get install and downloaded theopvn PVN files from the organization.erything worked fine.I would type sudo openvpn nameoffile.ovpn and then add my username and password during the installation process.However, when I try to do the same on an Ethernet network, the installation work fines (as above) and informs me that everything is connected (same as on the home Wifi network) but Firefox and all other software cannot connect to anything on the Internet.I contacted the organization who said the DNS was a problem and I needed to install resolvconf then modify each .opvn file using up /etc/openvpn/update-resolv-conf and down /etc/openvpn/update-resolv-confcauses the installation to hang because it does not like openvpn pointing to an external file.Irrespective of the problem I have with this "solution", previously I could use openvpn without modifying the .ovpn files. It just worked! I wonder if anyone knows why using the exact same configuration on an Ethernet network (which I have not used before with openvpn) is causing problems
View 4 Replies
View Related
Jul 17, 2010
I just installed OpenVPN using apt, and it doesn't seem to have components which are distributed with the source, such as easy-rsa. Why would tools like this be excluded from the package? I prefer to use apt rather than compiling from source, to keep things neat and simple.
View 2 Replies
View Related
Aug 4, 2010
I installed OpenVPN and gadmin-openvpn-server from the repos and I can't seem to activate the openvpn server in the gui. I have the server certificate generated, and all the information on encryption protocols setup, and accounts named and ready, despite accounts that were already there, such as www-data, bind, ossec, etc being listed. The server log states:
PLUGIN_INIT: could not load plugin shared object /usr/lib/openvpn-pam-auth.so: /usr/lib/openvpn/openvpn-pam-auth.so: cannot open shared object file: No such file or directory.
View 5 Replies
View Related
Jan 5, 2011
I use vpntunnel.se and followed their tutorial for OpenVPN and it connects and assigns an IP. However, once the sequence is initiated and I open my browser I cannot connect to a webpage and get a "cannot resolve" error. I e-mailed their support and they suggested I change the DNS of my network settings. I did that but the same problem. Once I close OpenVPN my internet works again. It works in windows, so I know it is not my router...I use a wireless connection with my router. I don't know if this has something to do with anything...
View 9 Replies
View Related
Apr 21, 2010
I have a virtual private server running ubuntu server edition that I have set up as an openvpn client. The problem I have is that the moment I turn on openvpn, I am no longer able to ssh into the machine. Is there a way to enable me to connect to it even when it is tunneling?
View 4 Replies
View Related
Jul 20, 2011
I have to say, I'm a little astonished at how anxious people are to bypass password checks on networks, all for the convenience of having things come up automatically. But given the world as we find it, I'm seeking a different approach.
I have an OpenVPN network. It works fine, but for my laptop, I've selected a client certificate that requires a password, so that if it falls into nefarious hands, the thief will not have immediate access to the VPN.
I'm trying not to have any data at all on the laptop (yes, a waste of a 500GB drive). So I want the VPN up even before I log in through the GUI.
It would be nice if the boot-up sequence would pause for the openvpn start script to ask for this password. I see the script contains a line "# X-Interactive: true" which I understand from documentation is supposed to accomplish this. But it doesn't. OpenVPN simply fails to start, which is better than the alternative, but a pain.
I have already disabled the splash screen (having been around Linux for over ten years, I am more comfortable seeing boot-up messages anyway, though even on this x86 they flash on so quickly I'm not sure I'm really gaining anything).
What am I missing?
View 2 Replies
View Related
Jan 10, 2010
Why is that certificates need to be revoked with openvpn?I simply removed them from the keys folder but everytime the client connects it just places the certificates back into the keys folder itself?! Should that be possible?
Secondly, I have a problems etting the revoke command.Is there a known setting on the openssl.cnf file that might cause this?
[root@server]# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
[root@server]# ./revoke-full client2
Using configuration from /etc/openvpn/easy-rsa/2.0/openssl.cnf
error on line 282 of config file '/etc/openvpn/easy-rsa/2.0/openssl.cnf'
21368:error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:629:line 282
code....
View 1 Replies
View Related
May 21, 2011
I recently installed Bastille as one of several programs to protect my new install. When I was going through the configuration, I was under the impression selecting to disable single user login would still allow me to login using my root password. On the graphical login screen it does not work.When I boot in recovery mode (I had a dual-boot installed), I can login in fine, but this is in a command line/terminal like screen. I attempted to re-configure Bastille using this screen, and here are my lackluster results.Command:/usr/sbin/InteractiveBastille -cThis command takes me through the questioning phase, but at the end I receive this error message when trying to save the new configuration.Failed to open log file /var/log/Bastille/action-log: Permission Deniedand ERROR: couldn't not write to etc/Bastille/config (exact wording!)I am not sure how to remedy this. I am tempted to try to uninstall Bastille and try something else, but I do want to have a security package as I file share.
View 3 Replies
View Related
Feb 14, 2011
Within the documentation of example OpenVPN setups there is a setup that shows an OpenVPN Server with two network interfaces. One interfaces is plugged into the public internet network and the second interface is plugged into the private network.
Normally I assume that it would be best to place the OpenVPN system inside the network behind the router and firewall and open only the ports needed on the router to allow access to the OpenVPN system. All other router ports would be closed. This is the first example they show. To see what I am talking about see page(s) 6-7 here -> [URL]
If one were to use the two interface public facing setup, when would that setup best be justified? I guess if you didn't want to open any ports on the router/firewall then this could be justified but then you have to lock down this public system individually instead of having it protected by the network firewall.
View 1 Replies
View Related
Jan 17, 2010
I am currently trying to make my computer as secure as it can possibly be. I am configuring the firewall to be restrictive by default, but I have some programs that are still unable to connect to the internet.
1. Pidgin Internet Messenger (I use AIM and MSN)
2. Skype
View 3 Replies
View Related
Oct 16, 2010
how can I configure a new "stored secret" in Seahorse? Or System > Preferences > Passwords and encryption keys, in a free translation from Brazilian Portuguese "Senhas e chaves de criptografia"? For instance, let's say I want to add a stored secret to be used with Skype: in Seahorse (Ubuntu 10.10), I clicked on Files > New > Stored secret, select the "login" keyring, type "Skype" in the description field and my skype password in the "Password" field and finally click "Add". But when I right-click the new secret > Properties, I can't change or type anything in the "Details" or "Applications" tabs, So, how can I inform Seahorse how, when or with what should it use my secret?
View 2 Replies
View Related
Apr 5, 2010
i have some problems with configuring openvpn tunnel connection to my openvpn server. I'm using static-key tcp connection. Network manager always said to me that connection could not be established. Also, when i try to run openvpn from terminal, i got some strange permissions problem:
Code:
openvpn --config config.ovpn
Mon Apr 5 15:48:37 2010 OpenVPN 2.1_rc19 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Oct 13 2009
Mon Apr 5 15:48:37 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Apr 5 15:48:37 2010 /usr/sbin/openvpn-vulnkey -q moj.key
[code]....
View 1 Replies
View Related
Jan 14, 2010
i ran this
Code:
iptables -N rate-limit
iptables -A rate-limit -p tcp -m conntrack --ctstate NEW -m limit --limit 3/min --limit-burst 3 -j RETURN
iptables -A rate-limit -j DROP
iptables -I INPUT 1 -p tcp --dport 22 -j rate-limit
i am no longer able to ssh in to the machine , how can i reset iptables and firestarted back to default?
View 3 Replies
View Related
Jul 24, 2010
i need to open this address ftp.nai.com, is there a way to use address not ip in iptables?
View 7 Replies
View Related
Sep 17, 2010
I've recently moved from Firestarter to UFW/GUFW, and I wonder if someone could confirm if my iptables configuration is secure.
When I enter sudo iptables -L i get:
Code:
View 3 Replies
View Related
Dec 29, 2010
eth1 has connection to the net via gateway ..eth0 on the same machine has users on a intranet and needs access to the internet, i need to allow internet connection and prevent packets which logically originate from the internet getting into the intranet
View 1 Replies
View Related
Apr 21, 2011
Installing a router, and I need to completely "wipe" iptables (flush I mean) on both computers, and I think I run ufw/gufw on both, so that would need to be uninstalled. The router is very secure, has NAT, etc, etc, and I'd rather setup all that side of things in one point, rather than on each computer.
View 2 Replies
View Related
