Search Results

Search found 46894 results on 1876 pages for 'java native interface'.

Page 1196/1876 | < Previous Page | 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203  | Next Page >

  • Windows 2008 Routing and Remote access server - access to the internet

    - by Ian
    I have a windows 2008 r2 remote access server set up and running. The remote access works fine. My problem is that the remote access server itself doesn't have access to the internet. The box has two interfaces, an internal and an external. Inbound connections come in on the external interface and RRAS responds. All wall and nice. I want to be able to use windows update, browse, etc from this box but can't as the outbound traffic just gets blocked. I've tried going into the RRAS mmc tool and opening the interface properties, under which there are two buttons for inbound and outbound filters. There I tried adding ports 80 and 443, but this doesn't work completely. I can see the connection initiating (Syn goes out) but the session never establishes itself. Anyone done this or got any suggestions?

    Read the article

  • Why do I have to manually 'Restart Management Network' on vSphere 5 host after reboot to get networking available?

    - by growse
    I've got a couple of vSphere 5.0 hosts in a small lab environment here and I've noticed a strange behaviour. When on of the hosts gets rebooted, it is unresponsive to the network until I log into the ESX console, Press F2 to customize and select Restart management network. Once this is done, the networking works perfectly as expected. Each host has two NICs which are trunked together using Etherchannel to a Cisco 3750. The link is also a .1q VLAN trunk and the management network is configured on VLAN121 with the VM traffic configured on VLAN118. Why would the host be completely dead to the world until I physically kick it? Edit Sample switch config for trunk: interface Port-channel2 description Blade 1 EtherChannel Trunk switchport trunk encapsulation dot1q switchport mode trunk end ! ! interface GigabitEthernet4/0/1 description Bladecenter1 CPM 1A switchport trunk encapsulation dot1q switchport mode trunk speed 1000 duplex full channel-group 2 mode on end Vswitch teaming settings: Management port group settings:

    Read the article

  • Remote connection to dynamic public ip & private ip addresses

    - by user53864
    Many times I connected to windows computer which has static public ip address via remote desktop over wan links. I'm wondering how could I connect to the remote computer that has dynamic public ip address & private ip addresses assigned. I've 2 systems at home: xp system-------connected to internet(dynamic public ip) & allowed other users to connected to the internet on the interface. windows vista system--------enabled dhcp on the interface to access internet from xp. How could I remotely connect from my office to the 'vista system'?. If I've a router/modem at my home it may be possible to allow the ports for the system but I don't. Any tips?

    Read the article

  • Windows Phone 8 not interfacing with Zune software

    - by Cyberherbalist
    I just got a Lumia 521 with Windows Phone 8 and am trying to get the device to work with the Zune software on my PC. I still have my Windows Phone 7 device, and the new one is not working the same way. When I plug the WP7 device into the PC's USB port, it automatically fires up Zune and I can sync my podcasts and music etc to the device. But when I plug the Lumia into the PC it doesn't fire up Zune, and if I start Zune manually, it doesn't interface with the phone at all. Perhaps I am missing something and WP8 isn't supposed to use Zune to interface with the phone?

    Read the article

  • Standalone WLST for both WebLogic 8.1 and 9.2?

    - by imiric
    Hi, I'm writing a simple script to facilitate changing JDBC connection URLs in several WL environments, among these both v8.1 and v9.2. I want to create a standalone script, outside of any WL installation, just including wlst.jar/jython.jar/weblogic.jar, that will work both on WL 8.1 and 9.2 (obviously by referencing different MBeans). Now, this works OK for WL 8.1. I copy weblogic.jar from the server, and have managed to get ahold of both wlst.jar and jython.jar (wasn't easy, Oracle doesn't host them anymore). Also I need to make sure to locally run under the same JRE as the server (WL8.1 runs on Java 1.4.2). But if I try to connect to WL 9.2 from this setup, I get a NullPointerException when trying to access any MBean (probably because I'm running on JRE 1.4.2 and WL 9.2 uses 1.5.0). Also, I am unable to create a standalone environment for WL 9.2. If I copy weblogic.jar from 9.2 and run WLST like so: java -cp "wlst.jar:jython.jar:weblogic-92.jar" weblogic.WLST I get a java.lang.NoClassDefFoundError: weblogic/management/configuration/RepositoryMBean error. I can't find this class in weblogic92/server/lib, but it IS inside weblogic.jar from WL 8.1. So I'm really losing my patience here... Is there any way to create a standalone WLST client that can connect to any version of WebLogic (8.1 & 9.2 in the meantime)? I really wouldn't want to have to ssh into the WL environment to run my WLST script... Any ideas/suggestions are welcome. Thanks, Ivan

    Read the article

  • Not all events appear in Nagios history (archive)

    - by Lars
    in the "Host & Service history" of my check_mk interface I can see various events, but a lot of events are missing. On the default interface at "View Alert History For This Service" or in the logfiles /var/log/nagios/archives/*.log the same issue: I can see many events of the last days, but not all of them. In the /etc/nagios/nagios.cfg the options log_event_handlers, log_initial_status and log_passive_checks are set to 0, the other log_... options are set to 1. I don't think that any of these options causing the problem that not all events are logged. What could cause this problem?

    Read the article

  • Restore access to Cisco Connect after changing router settings

    - by StasM
    I have recently bought Cisco Valet Plus (M20) wireless router (which I recognize now was a mistake, but nevermind). It has two setup options - Cisco Connect software and web-based setup. Cisco Connect software allows changing very small set of settings, web-based setup allows access to almost all settings, except settings for guest network. The problem is that when I use web-based setup, Cisco Connect after some changes refuses to talk to the router, so I can't change guest settings anymore (since web interface doesn't allow to change them). It must be because of some config parameter not matching or some password set wrong - but I don't know where Cisco Connect stores them. So, does anybody have any idea how to make Cisco Connect talk to the router again once I changed the settings through the web interface?

    Read the article

  • How to correctly set up iWARP? Preferably on loopback

    - by ajdecon
    iWARP is a protocol for doing remote direct memory access (RDMA) on top of TCP/IP, so that it can work with Ethernet and other network types as opposed to Infiniband. It works with many of the standard IB interfaces - the IB verbs, for example - so it's all pretty transparent. I'm doing some IB-verbs programming (mostly for the sake of learning about how they work better), and it'd be wonderfully convenient for me if I could use iWARP to do RDMA over my loopback interface, so that I could test some of my code without getting on our IB-connected cluster. :-) But I cannot figure out how to get a "local development environment" set up: there are no tutorials I'm aware of for even setting up iWARP from scratch on a server or a network interface. Can anyone give me a tutorial or point me in the right direction? Environment is Fedora 16 running in VirtualBox.

    Read the article

  • Linux QoS: bulk data transmission during idle times

    - by syneticon-dj
    How would I do a QoS setup where a certain low-priority data stream would get up to X Mbps of bandwidth, but only if the current total bandwidth (of all streams/classes) on this interface does not exceed X? At the same time, other data streams / classes must not be limited to X. The use case is an ISP billing the traffic by calculating the bandwidth average over 5 minute intervals and billing the maximum. I would like to keep the maximum usage to a minimum (i.e. quench the bulk transfer during interface busy times) but get the data through during idle/low traffic times. Looking at the frequently used classful schedulers CBQ, HTB and HSFC I cannot see a straightforward way to accomplish this.

    Read the article

  • Bind telnetd to specific IP on AIX 5.3?

    - by Sama
    Is it possible to bind telnetd to a specific IP on AIX 5.3? I know telnet is evil. Unfortunately, we have to have it listening on one interface for a specific application, but I want to make sure that's the only interface/IP that it's listening on. I have been searching all over the net and have found some advice for Linux, but it doesn't appear to be applicable to AIX. Full disclosure: I am not the server admin, but I am working closely with them and am familiar with *nix. Add: This is an internal server, which is connected to two different vlans. This is NOT connected to the Internet(!).

    Read the article

  • Where is debian storing its network settings?

    - by user13743
    I have a debian machine that is supposed to have a static ip, but insists on getting its address from the DHCP server. Here's this settings file: $> cat /etc/network/interfaces # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # The loopback network interface auto lo iface lo inet loopback # The primary network interface allow-hotplug eth0 iface eth0 inet static address 192.168.1.99 gateway 192.168.1.1 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255 Yet $> sudo /etc/init.d/networking restart Reconfiguring network interfaces...done. $> sudo ifconfig eth0 Link encap:Ethernet HWaddr 00:e0:03:09:05:2e inet addr:192.168.1.205 Bcast:255.255.255.255 Mask:255.255.255.0 ... Where is it being told to use dhcp?

    Read the article

  • Proxy Error 502 "Reason: Error reading from remote server" with Apache 2.2.3 (Debian) mod_proxy and Jetty 6.1.18

    - by Martin
    Apache is receiving requests at port :80 and proxying them to Jetty at port :8080 The proxy server received an invalid response from an upstream server The proxy server could not handle the request GET /. My dilemma: Everything works fine normally (fast requests, few seconds or few tens of seconds long requests are processed ok). Problems occur when request processing takes long (few minutes?). If I issue request instead directly to Jetty at port :8080 the request is processed OK. So problem is likely to sit somewhere between Apache and Jetty where I am using mod_proxy. How to solve this? I have already tried some "tricks" related to KeepAlive settings, without luck. Here is my current configuration, any suggestions? #keepalive Off ## I have tried this, does not help #SetEnv force-proxy-request-1.0 1 ## I have tried this, does not help #SetEnv proxy-nokeepalive 1 ## I have tried this, does not help #SetEnv proxy-initial-not-pooled 1 ## I have tried this, does not help KeepAlive 20 ## I have tried this, does not help KeepAliveTimeout 600 ## I have tried this, does not help ProxyTimeout 600 ## I have tried this, does not help NameVirtualHost *:80 <VirtualHost _default_:80> ServerAdmin [email protected] ServerName www.mydomain.fi ServerAlias mydomain.fi mydomain.com mydomain www.mydomain.com ProxyRequests On ProxyVia On <Proxy *> Order deny,allow Allow from all </Proxy> ProxyRequests Off ProxyPass / http://www.mydomain.fi:8080/ retry=1 acquire=3000 timeout=600 ProxyPassReverse / http://www.mydomain.fi:8080/ RewriteEngine On RewriteCond %{SERVER_NAME} !^www\.mydomain\.fi RewriteRule /(.*) http://www.mydomain.fi/$1 [redirect=301L] ErrorLog /var/log/apache2/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog /var/log/apache2/access.log combined ServerSignature On </VirtualHost> Here is also the debug log from a failing request: 74.125.43.99 - - [29/Sep/2010:20:15:40 +0300] "GET /?wicket:bookmarkablePage=newWindow:com.mydomain.view.application.reports.SaveReportPage HTTP/1.1" 502 355 "https://www.mydomain.fi/?wicket:interface=:0:2:::" "Mozilla/5.0 (Windows; U; Windows NT 6.1; fi; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10" [Wed Sep 29 20:20:40 2010] [error] [client 74.125.43.99] proxy: error reading status line from remote server www.mydomain.fi, referer: https://www.mydomain.fi/?wicket:interface=:0:2::: [Wed Sep 29 20:20:40 2010] [error] [client 74.125.43.99] proxy: Error reading from remote server returned by /, referer: https://www.mydomain.fi/?wicket:interface=:0:2:::

    Read the article

  • Cisco 877 as PPPoA/PPPoE bridge (no routing) - how to make it listen to IP for management?

    - by Ingmar Hupp
    I have a Cisco 877 configured to bridge ADSL with PPPoA to PPPoE on Vlan1. This works fine, but in this mode the only way I can configure the Cisco is via the serial console. I'd like to have the Cisco also listen on an IP address so I can telnet/ssh into it. I think the right way to go about this would be via bridge irb, but I'm not sure exactly how (or if that's even the right direction). IOS is 12.4T and my current config (cut down to essentials) is: no ip routing no ip cef ! ! interface ATM0 no ip address no ip route-cache no atm ilmi-keepalive pvc 0/38 encapsulation aal5snap ! dsl operating-mode auto bridge-group 1 ! ! interface Vlan1 no ip address no ip route-cache bridge-group 1 Just setting an IP address on Vlan1 didn't have the desired effect, but surely this must be possible somehow (the Draytek Vigor 120 even does it by default).

    Read the article

  • Citrix XenApp application does not have keyboard focus when launched

    - by Jason Pearce
    On new or existing Citrix XenApp 4.5 servers, I am having problems streaming the Allscripts Pro EHR application via the XenApp web interface. When users launch the application via the Citrix XenApp web interface, the application does not have focus, preventing users from typing in their username and password. If they use their mouse to select either the username or password fields, they still cannot enter any text. However, if they do any of the following actions, they can then enter in their username and password and the application runs without problems: Click on the Login button with empty fields. Logon fails but they can then enter their credentials. Minimize the login window and then maximize it. They can then gain keyboard focus to enter their credentials. What might be preventing this particular application from having focus when it launches?

    Read the article

  • Problems installing icinga-web

    - by Kungurov
    I'm using Ubuntu 10.04 LTS (64bit, Server), Apache 2.2.14 Following the instruction from the oficial icinga page http://docs.icinga.org/latest/en/index.html I installed the icinga-web-1.7.1 on my machine and configured a few hosts for test purposes. The Classic Interface runs as expected but the new Web Interface does not show any data. When I try: ps aux | grep ido2db | grep -v grep I get: icinga 27425 0.0 0.0 41464 600 ? Ss Jul27 0:00 /usr/local/icinga/bin/ido2db -c /usr/local/icinga/etc/ido2db.cfg which might indicate a problem with idomod/ido2db because according to the docs there should be at least 2 processes greped. Any ideas how to fix that?

    Read the article

  • routing through multiple subinterfaces in debian

    - by Kstro21
    my question is as simple as the title, i have a debian 6 , 2 NICs, 3 different subnets in a single interface, just like this: auto eth0 iface eth0 inet static address 192.168.106.254 netmask 255.255.255.0 auto eth0:0 iface eth0:0 inet static address 172.19.221.81 netmask 255.255.255.248 auto eth0:1 iface eth0:1 inet static address 192.168.254.1 netmask 255.255.255.248 auto eth1 iface eth1 inet static address 172.19.216.3 netmask 255.255.255.0 gateway 172.19.216.13 eth0 is conected to a swith with 3 differents vlans, eth1 is conected to a router. No iptables DROP, so, all traffic is allowed. Now, passing the traffic through eth0 is OK, passing the traffic through eth0:0 is OK, but, passing the traffic through eth0:1 is not working, i can ping the ip address of that sub interface from a pc where this ip is the default gateway, but can't get to servers in the subnet of the eth1 interface, the traffic is not passing, even when i set the iptables to log all the traffic in the FORWARD chain and i can see the traffic there, but, the traffic is not really passing. And the funny is i can do any the other way around, i mean, passing from eth1 to eth0:1, RDP, telnet, ping, etc, doing some work with the iptable, i manage to pass some traffic from eth0:1 to eth1, the iptables look like this: iptables -t nat PREROUTING -d 192.168.254.1/32 -p tcp -m multiport --dports 25,110,5269 -j DNAT --to-destination 172.19.216.1 iptables -t nat PREROUTING -d 192.168.254.1/32 -p udp -m udp --dport 53 -j DNAT --to-destination 172.19.216.9 iptables -t nat PREROUTING -d 192.168.254.1/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination 172.19.216.11 iptables -t nat POSTROUTING -s 172.19.216.0/24 -d 172.19.221.80/29 -j SNAT --to-source 172.19.221.81 iptables -t nat POSTROUTING -s 172.19.216.0/24 -d 192.168.254.0/29 -j SNAT --to-source 192.168.254.1 iptables -t nat POSTROUTING -s 172.19.216.0/24 -o eth0 -j SNAT --to-source 192.168.106.254 dong this is working, but,it is really a headache have to map each port with the server, imagine if i move the service from server, so, now i have doubts: can debian route through multiple subinterfaces?? exist a limit for this?? if not, what i'm doing wrong when i have the same setup with other subnets and it is working ok?? without the iptables rules in the nat, it doesn't work thanks and i hope good comments/answers

    Read the article

  • IDE to SATA convertor Motherboard Issue

    - by ravidev
    I bought new motherboard Intel DH67GD which has not IDE interface to attach the DVD writer. It has 2 SATA with 6Gb/s, 3 SATA with 3Gb/s and 1 e-SATA with 3GB/s.(mobo specs link : http://www.intel.in/content/www/us/en/motherboards/desktop-motherboards/desktop-board-dh67gd.html) Can anyone tell me how can i connect my old LG DVD Writer(IDE interface) with Mobo ?? Will IDE to SATA Connector work? If yes then how to connect that DVD writer with IDE-SATA converter? Please provide link. Thanks in advance !!

    Read the article

  • ASA firewalls: how does stateful filtering affect my access lists?

    - by Nate
    Ok, so assume that I have an ingress access list that looks like this: access-list outside_in extended ip permit any X.Y.Z.1 eq 25 access-group outside_in in interface outside And I want to do egress filtering. I want to allow inside machines to respond on port 80, and I want to allow ports over 1024. Given that the firewall is statefull, do I need to have the rule access-list inside_in extended ip permit X.Y.Z.1 any eq 25 in my inside_in ACL, or can I get away with just access-list inside_in extended ip permit any any gt 1024 access-group inside_in in interface inside In other words, if I apply an egress access list, do I have to explicitly allow machines to respond to requests allowed by the ingress access list, or does the statefullness of the firewall handle that for me? Thanks!

    Read the article

  • VLC without chrome in Windows

    - by timberwo7ves
    I'm trying to run VLC (2.1, 64 bit) without any chrome on Windows 7. You can achieve it by going to Preferences, and in the Interface tab, unchecking Integrate video in interface, and also in the Video tab, unchecking Window decorations. The problem lies in the fact that without Window decorations there is no apparent way to move or resize the video window - in GOM player, for example, you can move window by dragging on the video itself; is there an option for this in VLC? Ideally, I would like to move the window by the method described above (by dragging the video), and would like the Window decorations to reappear on mouseover, to allow resizing; I'm a new VLC user, but unsure how far the customisation goes. - I'd settle with just the moving of the window via dragging the video if this is possible by advanced setting. There is a similar question here, but not exactly, and no solution to that particular question.

    Read the article

  • Basic networking: Centos Server Router + Ubuntu Client setup.. unable to access outside world from client

    - by ale
    I am trying to set up my Centos Server with two NICs as a router. eth0 is connected to the outside world and eth1 is connected to an Ubuntu client. Here's eth0 on the server: DEVICE=eth0 BOOTPROTO=dhcp ONBOOT=yes TYPE=Ethernet eth1 on the server: DEVICE=eth1 BOOTPROTO=static IPADDR=192.168.0.10 # a free address on my network ONBOOT=yes TYPE=Ethernet My server has IPv4 packet forwarding turned on and my iptables only contains: # iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE # iptables --append FORWARD --in-interface eth1 -j ACCEPT My Ubuntu client has this in its /etc/network/interfaces auto lo iface lo inet loopback iface eth0 inet dhcp gateway 192.168.0.10 but I can't get an Internet connection from the server for my client. I can't even ping my server from the client: $ ping 192.168.0.10 Destination Host Unreachable

    Read the article

  • VSTS2010 crashes on opening the team explorer->My queries node

    - by vstsuser
    VSTS2010 crashes on opening the team explorer-My queries node this does not repeat if MSN office communicator (2007 R2 version) is exited. the issue occurs only if MSN office communicator is up and running. (no issues reported by communicator though) Any help in this regard? Debug log: Unable to cast COM object of type 'CommunicatorAPI.MessengerClass' to interface type 'MessengerAPI.IMessenger2'. This operation failed because the QueryInterface call on the COM component for the interface with IID '{....}' failed due to the following error: Error loading type library/DLL. (Exception from HRESULT: 0x80029C4A (TYPE_E_CANTLOADLIBRARY)). Windows event log EventType clr20r3, P1 devenv.exe, P2 10.0.30319.1, P3 4ba1fab3, P4 microsoft.teamfoundation.collaboration.microsoft, P5 10.0.0.0, P6 4c7d8ce4, P7 49, P8 0, P9 system.invalidcastexception, P10 NIL.

    Read the article

  • How to get rid of NAT in a LAN?

    - by Alberto
    Currently the LAN I manage is organized as follows: internal network (192.168.1.0) which uses a Linux server as a gateway (internal address on interface br0 192.168.1.1, external address on interface br1 10.0.0.2) through NAT; then the 10.0.0.0 network has another gateway (10.0.0.1) which through another NAT connects the whole thing to the internet. What I would like to achieve is to configure the Linux server so that the first layer of NAT is no more necessary, so that for example a computer in the 10.0.0.0 network can ping every computer in the 192.168.1.0 network. I deleted this iptables rule: iptables -t nat -A POSTROUTING -o br1 -j SNAT --to-source 10.0.0.2, but of course now computers on 192.168.1.0 cannot reach the internet; ip forwarding is of course enabled. What's missing here? Thanks

    Read the article

  • Chain Gateways on the LAN

    - by Black2night
    I installed m0n0wall in a virtualized environment, i have 10 PCs connected to a router ( 192.168.1.0/24) which connect them to the internet through PPPoE, the problem is that this router does not have a QoS so what i want to do is the following :- let all the PCs get their IP from the Router and the default gateway will be m0n0wall the moon wall will have 2 interface (Lan 192.168.1.20) and (Wan 192.168.1.21 and default gateway 192.168.1.1) now when any PC want to access the internet it should go through m0n0wall and then m0n0wall will forward the connection to the default gateway through the wan interface which is the PPPoE running on the router (192.168.1.1) the big question is this scenario possible or not and what do you suggest? Thanks

    Read the article

  • SSL Certificate for local web server

    - by Firefly
    Is it at all possible to create a self-signed certificate for use on multiple machines on a local network which would stop the browser complaining it is not a trusted site? We have a product which is basically a computer running lighttpd to serve a web interface for configuring the computer (sort of how a router has a web interface). There can also be many of these machines running on the same network with dynamic IP's. What I basically want to do is enable SSL for extra security but I don't want people who are on the local network to be given a browser warning about the certificate not being trusted. Is this at all possible?

    Read the article

  • How to open a server port outside of an OpenVPN tunnel with a pf firewall on OSX (BSD)

    - by Timbo
    I have a Mac mini that I use as a media server running XBMC and serves media from my NAS to my stereo and TV (which has been color calibrated with a Spyder3Express, happy). The Mac runs OSX 10.8.2 and the internet connection is tunneled for general privacy over OpenVPN through Tunnelblick. I believe my anonymous VPN provider pushes "redirect_gateway" to OpenVPN/Tunnelblick because when on it effectively tunnels all non-LAN traffic in- and outbound. As an unwanted side effect that also opens the boxes server ports unprotected to the outside world and bypasses my firewall-router (Netgear SRX5308). I have run nmap from outside the LAN on the VPN IP and the server ports on the mini are clearly visible and connectable. The mini has the following ports open: ssh/22, ARD/5900 and 8080+9090 for the XBMC iOS client Constellation. I also have Synology NAS which apart from LAN file serving over AFP and WebDAV only serves up an OpenVPN/1194 and a PPTP/1732 server. When outside of the LAN I connect to this from my laptop over OpenVPN and over PPTP from my iPhone. I only want to connect through AFP/548 from the mini to the NAS. The border firewall (SRX5308) just works excellently, stable and with a very high throughput when streaming from various VOD services. My connection is a 100/10 with a close to theoretical max throughput. The ruleset is as follows Inbound: PPTP/1723 Allow always to 10.0.0.40 (NAS/VPN server) from a restricted IP range >corresponding to possible cell provider range OpenVPN/1194 Allow always to 10.0.0.40 (NAS/VPN server) from any Outbound: Default outbound policy: Allow Always OpenVPN/1194 TCP Allow always from 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) OpenVPN/1194 UDP Allow always to 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) Block always from NAS to any On the Mini I have disabled the OSX Application Level Firewall because it throws popups which don't remember my choices from one time to another and that's annoying on a media server. Instead I run Little Snitch which controls outgoing connections nicely on an application level. I have configured the excellent OSX builtin firewall pf (from BSD) as follows pf.conf (Apple App firewall tie-ins removed) (# replaced with % to avoid formatting errors) ### macro name for external interface. eth_if = "en0" vpn_if = "tap0" ### wifi_if = "en1" ### %usb_if = "en3" ext_if = $eth_if LAN="{10.0.0.0/24}" ### General housekeeping rules ### ### Drop all blocked packets silently set block-policy drop ### all incoming traffic on external interface is normalized and fragmented ### packets are reassembled. scrub in on $ext_if all fragment reassemble scrub in on $vpn_if all fragment reassemble scrub out all ### exercise antispoofing on the external interface, but add the local ### loopback interface as an exception, to prevent services utilizing the ### local loop from being blocked accidentally. ### set skip on lo0 antispoof for $ext_if inet antispoof for $vpn_if inet ### spoofing protection for all interfaces block in quick from urpf-failed ############################# block all ### Access to the mini server over ssh/22 and remote desktop/5900 from LAN/en0 only pass in on $eth_if proto tcp from $LAN to any port {22, 5900, 8080, 9090} ### Allow all udp and icmp also, necessary for Constellation. Could be tightened. pass on $eth_if proto {udp, icmp} from $LAN to any ### Allow AFP to 10.0.0.40 (NAS) pass out on $eth_if proto tcp from any to 10.0.0.40 port 548 ### Allow OpenVPN tunnel setup over unprotected link (en0) only to VPN provider IPs ### and port ranges pass on $eth_if proto tcp from any to a.b.8.0/24 port 1194:1201 ### OpenVPN Tunnel rules. All traffic allowed out, only in to ports 4100-4110 ### Outgoing pings ok pass in on $vpn_if proto {tcp, udp} from any to any port 4100:4110 pass out on $vpn_if proto {tcp, udp, icmp} from any to any So what are my goals and what does the above setup achieve? (until you tell me otherwise :) 1) Full LAN access to the above ports on the mini/media server (including through my own VPN server) 2) All internet traffic from the mini/media server is anonymized and tunneled over VPN 3) If OpenVPN/Tunnelblick on the mini drops the connection, nothing is leaked both because of pf and the router outgoing ruleset. It can't even do a DNS lookup through the router. So what do I have to hide with all this? Nothing much really, I just got carried away trying to stop port scans through the VPN tunnel :) In any case this setup works perfectly and it is very stable. The Problem at last! I want to run a minecraft server and I installed that on a separate user account on the mini server (user=mc) to keep things partitioned. I don't want this server accessible through the anonymized VPN tunnel because there are lots more port scans and hacking attempts through that than over my regular IP and I don't trust java in general. So I added the following pf rule on the mini: ### Allow Minecraft public through user mc pass in on $eth_if proto {tcp,udp} from any to any port 24983 user mc pass out on $eth_if proto {tcp, udp} from any to any user mc And these additions on the border firewall: Inbound: Allow always TCP/UDP from any to 10.0.0.40 (NAS) Outbound: Allow always TCP port 80 from 10.0.0.40 to any (needed for online account checkups) This works fine but only when the OpenVPN/Tunnelblick tunnel is down. When up no connection is possbile to the minecraft server from outside of LAN. inside LAN is always OK. Everything else functions as intended. I believe the redirect_gateway push is close to the root of the problem, but I want to keep that specific VPN provider because of the fantastic throughput, price and service. The Solution? How can I open up the minecraft server port outside of the tunnel so it's only available over en0 not the VPN tunnel? Should I a static route? But I don't know which IPs will be connecting...stumbles How secure would to estimate this setup to be and do you have other improvements to share? I've searched extensively in the last few days to no avail...If you've read this far I bet you know the answer :)

    Read the article

< Previous Page | 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203  | Next Page >