Discussion between Joseph Kern and George Reith

George Reith

10:00 PM

its a shoddy java console

Joseph Kern

I can tell.

;-)

George Reith

:)

Joseph Kern

Can you paste in the console?

George Reith

sometimes sometimes not

clipboard gets stuck on something

Joseph Kern

Okay I would like you to type the following

sudo /sbin/iptables -P INPUT DROP
sudo /sbin/iptables -P FORWARD DROP
sudo /sbin/iptables -P OUTPUT DROP

This will set the default action for iptables as DROP

(no connection )

George Reith

10:04 PM

ok done

Joseph Kern

Now we need to poke a hole into the chain for ssh.

George Reith

okie dokie lead the way

Joseph Kern

Can you run ifconfig and tell me what your primary connection name is?

Like eth0 or so.

It's the one with your external inet addr: entry

George Reith

venet0 ?

Joseph Kern

Cool does it have your ip address in the listing?

George Reith

10:07 PM

venet0:1

Joseph Kern

Should be right below it.

George Reith

under inet addr

Joseph Kern

Well. Hold on. Now I am confused. :)

It should read like this:

George Reith

venet0:1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr: IP P-t-P: IP Bcast: IP Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

Joseph Kern

You don't have a venet 0:0 ?

George Reith

10:09 PM

oh yeh I do sorry thats wrong IP thats a spare IP i have... venet 0:0 is right

they are in same range I always get confused

Joseph Kern

Which one have you been connecting too with ssh?

George Reith

venet 0:0 one

Joseph Kern

we can call them 0 and 1 from now on.

George Reith

0

Joseph Kern

Okay so you've been connecting with 0.

George Reith

10:10 PM

1 is unused

Joseph Kern

Alright.

The way we are setting up your chains it will disable access to 1.

Unless you rerun these commands later.

I will send you a pastebin link when we are done in case you want to modify it later.

George Reith

ok

Joseph Kern

So 0 is the ip you have your dns record assigned to as well correct?

George Reith

yep

Joseph Kern

Good man!

Alright back to iptables.

iptables -A INPUT -i venet0:0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

Oops

sudo /sbin/iptables -A INPUT -i venet0:0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

That one first.

Did it work?

George Reith

10:14 PM

still typing... copy n paste broken

Joseph Kern

crap

okay get that one finished.

We will have one more then we should be able to switch back to the terminal

George Reith

sudo /sbin/iptables -A INPUT -i venet0:0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCE
PT
Warning: wierd character in interface `venet0:0' (No aliases, :, ! or *).

Joseph Kern

Ah then do this black magic

You didn't type anything else in did you?

George Reith

nope

Joseph Kern

^0:0^0

type that exactly.

wait.

George Reith

10:17 PM

on its own?

Joseph Kern

got that reversed

George Reith

or after venet

Joseph Kern

it should be ^0^0:0

no just type that by itself.

Oh man.

I am too tired. the first one was right.

Hold on.

:-/

lol. So where are we now?

Not building confidence am I?

George Reith

your great mate i'd be lost without ya

Joseph Kern

Okay. So we want to change the 0:0 to 0 and typing ^0:0^0 will change the characters of the last command from 0:0 to 0

George Reith

10:21 PM

it says

oh wait nvm

Joseph Kern

Did it work?

(I am trying to give you a shortcut because of that wonky terminal)

Did it return anything?

George Reith

:18 2012 from 02d99a13.bb.sky.com
Starting PowerConsole v1.1 <> (c)2010 soluslabs ltd.
please wait...
successfully logged in.
entered into CT 6188
[root@s1 /]# ^0:0^0
-bash: !!: event not found
[root@s1 /]# sudo /sbin/iptables -A INPUT -i venet0:0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCE
PT

battling with this terminal

Joseph Kern

yeah

just modify the original command then

George Reith

to sudo /sbin/iptables -A INPUT -i venet0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCE
PT

?

Joseph Kern

type echo $?

George Reith

10:23 PM

$

Joseph Kern

zero?

George Reith

$ returned

Joseph Kern

never mind too late (you need to actually type the question mark)

Next command!

George Reith

oh right 0

sorry =/

Joseph Kern

sudo /sbin/iptables -A OUTPUT -o venet0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

np. type that one in next, there are subtle differences. Type carefully!

George Reith

10:25 PM

nothing returned

Joseph Kern

Good!

George Reith

should I have done the dport one also?

Joseph Kern

Yes!

One is Destination and the other is Source.

:D

George Reith

Couldn't load target `ACCE':/lib/iptables/libipt_ACCE.so: cannot open shared object file: No su
ch file or directory

Joseph Kern

Wait.

What just happend?

George Reith

10:27 PM

from the dport command

Joseph Kern

no.

George Reith

I wasnt sure about venet0 so I hadnt run it yet

Joseph Kern

Alright.

:D

Let me look through our chat log.

Ah i see what happened.

Okay, so you see where you had two lines for your dport command?

George Reith

yes

Joseph Kern

the line ends with ACCE and the next line is PT

(I missed that the first time)

George Reith

10:29 PM

the console does that

doesnt seem to fit

Joseph Kern

It's just one line.

You tell that console who's boss!

So you will need to get that dport line working again.

sudo /sbin/iptables -A INPUT -i venet0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

George Reith

ok done

Joseph Kern

Did it work this time?

George Reith

yep nothing returned

told that console whos boss

Joseph Kern

Damn straight!

Now fire up your terminal and try to ssh.

(crosses fingers)

George Reith

10:32 PM

im scared...

Joseph Kern

Don't close your console :-)

ip?

yes for now.

we're in baby!

BOOOM!

Cool now for the rest!

George Reith

10:33 PM

*highfive

Joseph Kern

*highfive

Now lets add the rules for your web server

sudo /sbin/iptables -A INPUT -i venet0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo /sbin/iptables -A OUTPUT -o venet0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

Copy pasta one then the other.

George Reith

done ... i love my terminal :)

kicks consoles ass

Joseph Kern

:') don't we all!

sudo /sbin/iptables -A OUTPUT -o venet0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo /sbin/iptables -A INPUT -i venet0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Now these. This will allow you to ssh FROM your server into another.

George Reith

ok done

Joseph Kern

(this is just for completeness)

okay now we need to save these rules.

Hey one qq.

George Reith

10:36 PM

mhhm

Joseph Kern

You're not running email from this are you?

Or https?

George Reith

I recieve email to my domain, I edited my MX records at my DNS to bounce it to gmail... wil this effect it?

Joseph Kern

I don't think it will.

George Reith

cool

Joseph Kern

your MX should bounce regardless.

George Reith

10:37 PM

I do keep getting a message about new email in something root

but i ignore it :)

Joseph Kern

We can handle that in a min.

George Reith

your a machine!

Joseph Kern

okay so the next command is /sbin/service iptables save

sudo /sbin/service iptables save

George Reith

Saving firewall rules to /etc/sysconfig/iptables: [ OK ]

Joseph Kern

Does your website work?

George Reith

10:40 PM

ha ha

website not working :(

Joseph Kern

Even by ip address?

George Reith

yar

Joseph Kern

Yar? Not working by ip address?

George Reith

yep not working anyway

Joseph Kern

It worked before?

George Reith

10:41 PM

yup

Joseph Kern

Okay let's go through a few of the same things.

George Reith

the domain and the IP point to two different areas though, using an NGINX vhost

Joseph Kern

Can you explain more about your domain and ip?

So hold on.

You have two vhost

one with a domain name

and one with ip address from venet0:0

George Reith

one vhost with the domain name

ip goes to NGINX web root

Joseph Kern

can you ping your domain name from your mac?

George Reith

10:44 PM

its pinging

different ip though 0.0

Joseph Kern

nice!

That means it's your nginx config.

George Reith

its not even in same range though is that right?

Joseph Kern

Oh it's not the same as your current IP?

George Reith

nope

its cloudflare

=/

Joseph Kern

ah they just have you put in their ip and route it around to your server?

(I am reading their docs one minute)

George Reith

10:47 PM

I use their nameservers in the DNS thats all I know, it's a CDN

if I try to ping my IP it timesout

Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5

Joseph Kern

Well we didn't open ICMP on your iptables. :D

George Reith

:D

i like the sound of that

Joseph Kern

sudo /sbin/iptables iptables -A INPUT -p icmp -j ACCEPT

George Reith

Bad argument `iptables'

maybe iptables once?

Joseph Kern

Lol wat. Yes that would be better.