iptables -t nat -A POSTROUTING -o eth0 -j SNAT -p tcp --dport 80 --to-source 1.2.3.4-1.2.3.6
If I'm understanding the iptables man correctly this rule should round-robin outgoing http requests over the IP range, instead it's sticking to the first IP no matter how many connections I make.
We have a few IIS servers that will be acting as front end for our users to split off the load.
Currently, we have one IIS with 1 SSL. we are going to do round robining for the FQDN to span a few IIS servers. I just wanted to make sure we would not run into any issues with the certificate. I was thinking of installing it on one server after generating the CSR and then once the root trusted is in place, export it and import it in all the other servers. Do you think this would be an issue at all? is there a better way?
additionally, the certificate is about to expire, I need a certificate with $1mil insurance, what do you think is the best deal (trusted source) going around? should I do the ones with 256bit too or have you seen any conflicts, do they auto negotiate if the client can only support 128bit?
Round-robin and UserDirs
I just setup a round-robin so that my website is always available even if one of the 2 servers goes down. It works like it should, however, i can't access the userdirs from server2. The userdirs are located on server1.
It's setup like this:
www1.domain.org is server1
www2.domain.org is server2www.domain.org is the round-robin. I have 2 WWW's pointed with an A record to each of the server's IP addresses.
On server 1 i have 2 userdirs which are accessible through www1.domain.org/~user . They should also be reachable on www2, because if they are not, they wont be accessible half the time due to the round robin.
I therefore added a .htaccess in www2's root document directory with the following info:
Redirect /~user1/ http://www1.domain.org/~user1/
Redirect /~user2/ http://www1.domain.org/~user2/
So when i go to www2.domain.org/~user1/, i should be automatically be transferred to server1... but all i get is a 404 error page. It works perfectly when accessed on www1. I don't see what i'm doing wrong. I thought it might be the userDir setting in apache that might be causing trouble.. but that is turned off on server2, so that should not be the problem. Anyone here have any idea how to access the user dirs via server2?
Looking for redundant setup, round robin?
I'm looking to make high availability setup, and wondering how many of you have made it so?
we are looking to multi-home the page with a round robin setup, using multiple VPSs/dedicated servers geographically different locations.
Right now i'm still looking at "stale" DNS setup, no automanagement of servers down. Is there a service/software which already offers automatic changes of zones for removing servers which are down, and adding them back when they get back online?
Do i need to custom tailor everything?
I am trying to do a fail over solution with round robin dns. Our dns is served by windows and our web servers are setup with Linux..
I know round-robin does not by default do a fail over, however my understanding is that a script can be used to remove the failed server for dns, is anyone aware of something that will do this for windows?
It seems the more places we can put servers, the more places boss-man wants them
We're setting up an external network to test back into our network from geographically/carrier diverse locations. We've got about 15 hosts up, but most are in the states, one in london, one in amsterdam, one in frankfurt and one in hong kong.
The current wish list of locations includes -
- Japan
- S. Korea
- Australia (holy cow bw is expensive in sydney! is anyone charging less than $500 per Mb?)
- Paris, France (we have one quote in, but it is pretty pricy)
- Italy
- Spain
- Sweden
I'm doing research and have submitted rfq's to companies in most of these locations, but was hoping for personal recommendations of hosts you have used.
Does anyone know any tools or scripts that you can run to do email round trip monitoring (eg, sending and ensuring it’s received within x minutes)?
Not looking for a solution that is hosted (eg, websitepulse.com) but for something that can be run off a machine locally.
I execute the following commands, in the following order:
iptables --flush
iptables --zero
iptables -A INPUT -s 218.65.12.161 -j DROP
will that last command successfully ban that IP until reboot?
If not, what needs to be done? I can't access my site if I don't flush + zero iptables first but I need to be able to ban with iptables.
We was unable to log in into Round cube with any email account. URL....
View 2 Replies View RelatedI am experiencing a strange problem with iptables: after in activate them, they are gone in a few minutes. For example, I drop traffic from an ip and after few seconds, all rules are flushed without touching anything!
View 2 Replies View RelatedI need to block about 5000 IPs .. Is it possible to add this amount of IPs to iptables?
I mean ... Will this slow down the machine response?
What do you prefer or what do you think is better, iptables or apf for a firewall?
View 9 Replies View Relatedi install csf on centos,
my server is working but the network is unreachable,
i try to run "service iptables stop",
and the server is unreachable now,
i check from whm,it shows csf is working,
but i ssh the server and type "service iptables status",
it shows "firewall is stopped",
is it correct?
is not,how can i fix the issue?
Is there a way for me to whitelist myself or something?
I get up everyday and have to call LSN because my server has blocked me for some reason...
If I keep getting spam from a certain IP, can I add that IP to Iptables? Will it stop me receiving spam from that IP? I'm not quite sure how it all works.
Or what is the most effective method to stop spam?
I've got two VPS's and both have the same ruleset for outbound EG_TCP
Code:
EGF="1"
EG_TCP_CPORTS="21,25,37,43,53,80,110,113,123,443,873,2089,3306"
EG_UDP_CPORTS="53,465,873,6277"
Whenever I turn EGF to 1 my VPS locks me out of everything, I need togo into hyperVM to turn it off and restart my firewall.
What would cause this?
It's Fedora Core 5 on OpenVZ i've googled and cannot seem to find a reason why it would do that. Could be something in the host node kernel that may need adjusting?
I am working with iptables and am trying to figure out the best ruleset for cpanel servers.
I have a few custom ports for a few services, but other than that, does anyone have a recommended ruleset for the typical cpanel cluster?
how can i clear iptables?
i enter many ip in it that most of them is worng and i must clear it
Do you find iptables enough or do you use a hardware firewall for linux? I haven't used anything less than hardware firewalls for years but I gather than most simply rely on iptables. Is that a smart choice?
View 6 Replies View RelatedI got blocked by my server. Hivelocity helped me to gain access by my server.
I was told that to avoid being blocked again I should type
iptables -A INPUT 202.155.151.185 -j ACCEPT
What I ended up was
iptables -A INPUT 202.155.151.185 -j ACCEPT
Bad argument `202.155.151.185'
Try `iptables -h' or 'iptables --
i have code :
1. IF=`/sbin/route | grep -i 'default' | awk '{print$8}'`
2. IP=`/sbin/ifconfig $IF | grep "inet addr" | awk -F":" '{print$2}' | awk '{print $1}'`
3. IPT="/usr/sbin/iptables"
4. NET="any/0"
5. DNS="xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy"
6. SERV_TCP="22 80 443 "
7. SERV_UDP="53 123"
8. HI_PORTS="1024:65535"
........
i dont know line of 5's sense .I am must changed warrant is what?
Code:
# iptables -D INPUT -s 25.55.55.55 -j DROP
iptables v1.3.8: Couldn't load target `standard':/usr/local/lib/iptables/libipt_standard.so: cannot open shared object file: No such file or directory
What is going on? The libipt_standard.so file is located in /lib/iptables, but not /usr/local/lib/iptables. I tried moving all of the libipt files into the /usr/local/lib/iptables directory, but I got segmentation errors.
I have installed APF on box and set ports for in and out and enabled it.. of course, iptables is running from booting..
[root@localhost /]# runlevel
N 3
[root@localhost /]# chkconfig --list | grep iptables
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@localhost /]# chkconfig --list | grep apf
apf 0:off 1:off 2:off 3:on 4:on 5:on 6:off
but when I check it like this
[root@localhost ~]# service iptables status
Firewall is stopped.
[root@localhost ~]# service iptables start
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: mangle filter [ OK ]
Unloading iptables modules: ^[[A [ OK ]
[root@localhost ~]# service iptables status
Firewall is stopped.
it said iptables is stop...even I start manually...
I am not sure APF is running correctly because of iptables..
# apf -r
Unable to load iptables module (ip_tables), aborting.
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# uname -a
Linux servername 2.6.17.9 #1 SMP Sun Aug 27 17:08:11 ICT 2006 i686 athlon i386 GNU/Linux
is there any reason that I cannot use iptables? If I edit monokern option in apf to 1, I cannot use ftp in passive mode
I have CSF installed on one of our server.
CSF dont ban the IP and if manually it is done I get following error.
----------------
csf -d 195.88.65.47
Adding 195.88.65.47 to csf.deny and iptables DROP...
iptables: Index of insertion too big
DROP all opt -- in !lo out * 195.88.65.47 -> 0.0.0.0/0
Error: iptables command [/sbin/iptables -v -I INPUT 2 -i ! lo -s 195.88.65.47 -j DROP] failed, at line 864
-------------------
Also iptables is not running on server.
If status is checked it says its stopped.
I have many sites on my server I dont want to get any downtime.
Please let us know how can we fix this issue as soon as possible.
I have tried reinstall CSF but still the issue remains same.
I keep trying to flush my iptables on my linux server but every time i try to do so my server seems to freeze (i lose access and have to reboot it for it to come back online), how can I go about deleting those ips manually rather than executing the flushing command? what options do I have?
View 4 Replies View Relatedroot@xxxx[~]# service iptables status
Firewall is stopped.
root@xxxx[~]# service iptables start
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
Unloading iptables modules: [ OK ]
root@xxxx[~]# service iptables status
Firewall is stopped.
why not iptables don't start ?
i create a template for xen ( hypervm ) from jailtime site. now i install iptables , but iptables do not work and when i enter " service iptables restart" , iptables do not start. ( i check it from "service iptables status" )
View 4 Replies View RelatedI used a script to block some unwanted countries from accessing my site. In total I had about 3000 lines with ipranges. Now I just went ahead and put this on one of the servers, one that I really don't need the traffic on. But I am wondering what kind of affect this may have on the speeds. Will it really affect it more then a few ms? And anything else I should maybe worry about? Except maybe the loading time at reboots.
View 2 Replies View Related