542

I have drawn some sketches Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and forward all connection attempts to the local sourcePort to port onPort on the machine ...


16

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little simpler than yours: # Masquerade outgoing traffic iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE # Allow ...


15

Local Port forwarding ssh creates an additional local port which it will forward to a port on the remote system. example ssh -L 8080:127.0.0.1:80 user@webserver Then in your browser on local use URL http://localhost:8080/ it will connect to local machines port 8080, which ssh will forward on to remote ssh, and it will then make a request to 127.0.0.1:...


10

Looks like indeed it is designed to work differently compared to IPv4's */forwarding and all/forwarding: From https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt: conf/all/forwarding - BOOLEAN Enable global IPv6 forwarding between all interfaces. IPv4 and IPv6 work differently here; e.g. netfilter must be used to control which ...


6

I think you're looking for the yes command : yes | unzip my.zip It sends y to the output again and again. If you want to send something else, specify it as the argument: yes n | unzip my.zip You can also use echo if there's only one question: echo no | unzip my.zip


6

The only way to do this is via a very dirty hack. I do not recommend it. setfacl -R -m u:another_user:rwx "${SSH_AUTH_SOCK%/*}" sudo -u another_user SSH_AUTH_SOCK="$SSH_AUTH_SOCK" composer update The reason for this is that your SSH keys are accessed via a named socket. That named socket is in a directory owned by you, and cannot be accessed by anyone else....


5

The Linux kernel source hasn't had the CONFIG_IP_FORWARDING option since the 2.0.x kernel series. As far as I know, there is no compile time option anymore to enable IP forwarding by default for the built kernel. Since the 2.1.x series, the correct way to enable IP forwarding for IPv4 has been with the net.ipv4.ip_forward sysctl option. Add the following ...


5

You'd have to look at your DNS server config, but assuming you don't have anything like forwarders set up, indeed you're correct that its the root hints file. DNS is organized into a tree (sort of: for redundancy, nodes are duplicated; so, e.g., there are multiple root nodes). The root hints file tells the server where to find one of the root nameservers (...


5

If you do not specify the hostname psql assumes domain socket connections. As per the man page: If you omit the host name, psql will connect via a Unix-domain socket to a server on the local host, or via TCP/IP to localhost on machines that don't have Unix-domain sockets. Try adding -h localhost to the psql command line. As to the Oracle error, I would ...


5

Actually iptables is suited very well to restrict this. The filter table, where packets are allowed or blocked has three chains. In each chain rules can be defined to match packets and trigger an action if a packet is matched. Against which chain of rules a packet is matched depends on the direction of the packet relative to the host where iptables is ...


5

Setting ip_forward allows packet forwarding in general. Some Linux distributions may disallow forwarded packets in iptables for security reasons, e.g. if ip_forward is set by error. /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT sets a rule to allow packets from eth0 to eth1 that are responses or similary related ...


4

Try adding the subnets of the two gateways to leftsubnet on the central server. Even though rightsubnet on each gateway includes the respective opposite subnet, the traffic selector will be narrowed to what's configured on the central server as leftsubnet (i.e. 192.168.1.65). You should see that in the output of ipsec statusall. You may also configure ...


4

Some distro's come with a premade sshd_config that has separate permissions based on a username or group, example: Match User anoncvs X11Forwarding no AllowTcpForwarding no ForceCommand cvs server Jim most likely resolved this by commenting out, or adjusting the directive to match the permissions he needed. More info available via man ...


4

* I'm not an expert in iptables or Linux Network Scheduling, but I'll try to help! Looking at iptables manual page user@host:~$ man 8 iptables we can see in nat (Network Address Translation) table description: "This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering ...


4

You're probably adding a rule intended for the nat table in the filter table block suitable for iptables-restore, and with inappropriate syntax. Until you know how to edit /etc/iptables/rules.v4 directly (by studying the output of iptables-save), you should do this instead: be careful, since the rule will be applied immediately, change the current running ...


3

SSH SOCKS5 Tunnelling using PuTTY: Firstly connect to your server via SSH using PuTTY. Right-click on the top bar and hit 'change settings'. Goto Connection/SSH/tunnels. Source port: 4567, select 'Dynamic' and hit 'Add' Open up your choice of browser, and configure the 'Manual Proxy settings' to listen on port 4567 on localhost (127.0.0.1). In Firefox ...


3

A few notes: SNAT does not work the way you described it in the description, SNAT replaces the source IP, it won't change the destination IP. After a packet goes through your 2 rules, it will have: source: IP_HOST_A:31090 destination: IP_HOST_B:32090 neither DNAT or SNAT targets are capable of duplicating packets In order to duplicate packets, you can ...


3

SSH tunnels are useful to cross insecure networks, leveraging end to end encryption, connecting two end-points that seats on distinct trusted networks. EDITED A far as I can tell (thanks to comments), what you have is: A local host-A: your localhost, on your local network (likely behind firewall/NAT) A publicly reachable host-B: the aws server A non-...


3

In Linux, an incoming packet is routed by checking whether a packet should be handled by the local machine or not. If it should, it is processed directly without first routing it through the "correct interface". The IP address is kindof just an alias for the machine and it doesn't matter which interface the packet arrived on. The same happens if you ...


3

so the answer (after @YoMismo put me on the right track) is to add one more iptables rule: sudo iptables --table nat -A POSTROUTING -s 192.168.42.0/24 ! -d 192.168.42.0/24 -j MASQUERADE The result can be seen with sudo iptables -t nat -L -n -v So in summary: Add a route on the device requiring access as follows: sudo ip route add 0.0.0.0/0 via 192.168....


2

Here is a step by step tutorial to make it a VPN server. VPN will send all your internet traffic through an encrypted tunnel to your VPS: First, install the pptpd package. pptpd offers a PPTP-type VPN which is supported by Microsoft and other network vendors. This is also the easiest to setup. sudo apt-get install pptpd Next up, edit /etc/pptpd.conf with ...


2

First, set-up squid - sudo apt-get install squid Follow the directions at the above link to configure it. Allow only localhost to be secure. Then, set-up port-forwarding - from local port 3128 to remote port 3128 (to use the squid defaults); then configure your web-browser to use port 3128 and localhost as your proxy. Requests will go over the ssh port ...


2

Your limits are quite a bit aggressive. I don't see the point of having rules that only accept one packet per hour. You might have set high burstiness, but the bucket is only recharged by one every hour, and only if you actually received less than one packet per hour. The worst part is that these limits are applied for ALL packet, since you do not accept ...


2

You can use ssh port forwarding ssh user@work.example.org -L 10000:172.16.10.10:10000 After you can connect on localhost:10000 and actually you will connect to the service at 172.16.10.10:10000 You can also create a "proxy" with ssh -D parameter.


2

Add this router to your /etc/exim4/exim4.conf.template file (assuming non-split config), before the lowuid_aliases router (assuming you really want such a spam-magnet): catchall: driver = redirect domains = +local_domains data = you@gmail.com


2

You will need to get it to load a GTK theme (the default gnome one is adawita) You can try GTK_THEME=Adwaita then the command. Have you also looked at using x2go? It often gives better performance.


2

The handy tool is to list existing rules with line-numbers: iptables --line-numbers -t filter -L FORWARD You could delete the rules with -D option: iptables -t filter -D FORWARD 1 You could insert a new rule at specified location with -I option: iptables -t filter -I FORWARD 0 blah-blah-blah this would insert a new rule at the very beginning of a table,...


2

Your question breaks down into two parts. Why do we need the MASQUERADE rule. Why does it need to be in the POSTROUING chain. Is there any altenative? To answer the first question we must first understand how iptables NAT works. The NAT tables are used on the first packet of a connection to determine what translations should be applied to that connection. ...


2

Your in and out interfaces are reversed in the iptables command. They should be: sudo iptables -A FORWARD --in-interface enp5s0 --out-interface tun0 -j ACCEPT and: sudo iptables -t nat -A POSTROUTING --out-interface tun0 -j MASQUERADE


Only top voted, non community-wiki answers of a minimum length are eligible