New answers tagged firewall
http://clusterlabs.org/doc/en-US/Pacemaker/1.1/html-single/Pacemaker_Remote/ See section: 4.1.1. Configure Firewall on Host
The below rule will allow only your IP and Block all other IPs over port 22 or ssh. iptables -I INPUT -p tcp -s ! yourIPaddress --dport 22 -j DROP
The load balancing part of your script says : If I already know this connection, just let it go the same way than previously If I don't, send it half of the time on one interface, half of the time on the other one So you have an equal number of connection going on each interface. But some connections only have 3 packets, when other ones have 1000, the ...
In my case I had the same problem because a cron job was running every minute but was not finishing. This created hundreds of processes each running in a shell exhausting the system. So check using ps ax if you see a lot of duplicate processes maybe check your cron jobs or anything else that might be spinning up a bunch of extra shells.
The -A INPUT -s adds a rule for any packets with the source subnets specified on the line. Therefore, in your example, you are logging and dropping all packets that have a source IP address that starts with 255 and all that start with 0, such as 255.1.2.3.4 or 0.56.78.90 The idea here is that there should will never be packets that start with those ...
/sbin/iptables -L Will list all the active rules.
As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...
nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...
I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...
Top 50 recent answers are included