rmmod nf_nat_ftp
rmmod nf_conntrack_ftp
modprobe nf_conntrack_ftp ports=21,1021
modprobe nf_nat_ftp
iptables nat ftp
Leave a reply
Category Archives: Linux networking
veth with kernel namespaces
ip netns add netns0
ip netns list
netns0
ip netns exec netns0 ip link set lo up
ip link add veth-default type veth peer name veth-netns0
ip link set veth-netns0 netns netns0
ip a | grep veth
6: veth-default@if5:
link/ether 56:78:d4:a5:8f:55 brd ff:ff:ff:ff:ff:ff link-netns netns0
ip addr add 10.0.3.1/24 dev veth-default
ip link set veth-default up
ip a | grep veth
6: veth-default@if5:
link/ether 56:78:d4:a5:8f:55 brd ff:ff:ff:ff:ff:ff link-netns netns0
inet 10.0.3.1/24 scope global veth-default
valid_lft forever preferred_lft forever
ip netns exec netns0 ip link set veth-netns0 up
ip netns exec netns0 ip addr add 10.0.3.2/24 dev veth-netns0
ping 10.0.3.2
PING 10.0.3.2 (10.0.3.2) 56(84) bytes of data.
64 bytes from 10.0.3.2: icmp_seq=1 ttl=64 time=0.102 ms
64 bytes from 10.0.3.2: icmp_seq=2 ttl=64 time=0.062 ms
64 bytes from 10.0.3.2: icmp_seq=3 ttl=64 time=0.062 ms
^C
--- 10.0.3.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2082ms
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -o eno0 -i veth-default -j ACCEPT
iptables -A FORWARD -i eno0 -o veth-default -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.3.2/24 -o eno0 -j MASQUERADE
ip netns exec netns0 route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 veth-netns0
ip netns exec netns0 ip route add default via 10.0.3.1
ip netns exec netns0 ping srv24x7.com
PING srv24x7.com (93.115.28.151) 56(84) bytes of data.
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=1 ttl=58 time=1.19 ms
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=2 ttl=58 time=1.47 ms
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=3 ttl=58 time=1.65 ms
^C
--- srv24x7.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 1.190/1.437/1.649/0.189 ms
ip netns list
netns0 (id: 0)
iptables forward traffic to another ip
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.0.100:80
iptables -t nat -A POSTROUTING -j MASQUERADE
ip link show errors
2: eno0:
link/ether 70:71:bc:0c:59:52 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun mcast
133273256 117186 0 0 0 11
TX: bytes packets errors dropped carrier collsns
10051321 56565 0 0 0 0
send UDP packets
echo "Test message" > /dev/udp/127.0.0.1/3333 Test it: ncat -l 3333 --udp Test message
QUIC
Quick UDP Internet Connections (QUIC) is, as its name states, a transport layer protocol based on multiplexed UDP connections. In fact, QUIC uses a combination of TCP + TLS + SPDY over UDP with several enhancements with respect to the current HTTP/2 over TCP implementation.
Error: any valid prefix is expected rather than
You can not set IP out of IP range:
The reason each number can only reach up to 255 is that each of the numbers is really an eight digit binary number (octet).
sudo ip addr add 192.168.256.100/24 dev tap1 # Bad
sudo ip addr add 192.168.255.100/24 dev tap1 # OK
ip route flush cache
ip route flush table main
firewalld MASQUERADE
firewall-cmd --zone=public --add-masquerade
Restarting network (via systemctl): Job for network.service canceled
service network restart
Restarting network (via systemctl): Job for network.service canceled.
[FAILED]
systemctl restart network
Job for network.service canceled.
If cyberpanel server network is down (venet0:
vi /etc/fstab
#/usr/.tempdisk /tmp ext4 loop,rw,noexec,nosuid,nodev,nofail 0 0
#/tmp /var/tmp none bind 0 0
service network restart
Restarting network (via systemctl):
[ OK ]
monitor and block syn flood
Can help prevent SYN flood DDoS attack
[Mon Nov 4 17:35:53 2019] possible SYN flooding on ctid 0, port 465. Sending cookies.
[Mon Nov 4 19:23:41 2019] possible SYN flooding on ctid 0, port 25. Sending cookies
cat > SYN_RECV.sh << "END"
#!/bin/bash
netstat -natp | grep SYN_RECV | sort | awk '{ print $5 }' | sort | cut -d ":" -f1 | uniq -c | awk '{if ($1>100) system("iptables -I INPUT -s "$2" -j REJECT")}'
END
#ANsible copy and add to cron:
ansible -i inv.txt cpa -m copy -a "src=SYN_RECV.sh dest=/root/bin/SYN_RECV.sh mode=755 owner=root group=root"
ansible -i inv cpa -m cron -a "name=SYN_BLOCK job=/root/bin/SYN_RECV.sh user=root"
find not https url on webpage
parts of page are not secure
Find url without SSL: wget -q https://www.srv24x7.com -O - | tr "\t\r\n'" ' "' | grep -i -o '<a[^>]\+href[ ]*=[ \t]*"\(ht\|f\)tps\?:[^"]\+"' | sed -e 's/^.*"\([^"]\+\)".*$/\1/g' | sort | uniq | grep -v https
dynamic SSH port forwarding
ssh -f -N -D 1080 [email protected]
curl -x socks5h://localhost:1080 http://www.srv24x7.com/
WARNING: cannot stat file ‘ta.key’: No such file or directory (errno=2)
openvpn –genkey –secret /etc/openvpn/ta.key
openvpn server.conf
masquerade iptables
iptables -t nat -A POSTROUTING -j MASQUERADE