Author: miracoin

noob iptables cheat sheet

Notes:

  1. All rules are processed from top to down.  Once a rule is matched (with jump), the rest will be ignored.
  2. Never run iptables -F if the default rules are DROP or your system will be inaccessible.  If possible, set the default rule to ACCEPT and add iptables -A INPUT -j DROP at the end.

List all rules

iptables -L -n -v –line-numbers

Flush all chains (-F) and delete all user-defined chains chains (-X)

Note: Please ensure the default policy is ACCEPT or leave a ssh terminal before issuing

iptables -F

iptables -X

Set default policy (use with care)

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP

Block incoming ip address

iptables -A INPUT -s aa.bb.cc.dd -j DROP

Block outgoing sites

iptables -A OUTPUT -p tcp -d  www.microsoft.co.uk -j DROP

Allow ping from specific ip’s only

iptables -A INPUT -s 1.2.3.0/24   -p icmpicmp-type echo-request -j ACCEPT

iptables -A INPUT -p icmpicmp-type echo-request -j DROP

Allow ssh from specific ip’s only

iptables -A INPUT -s 1.2.3.0/24   -p tcp —dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp —dport 22 -m state –state NEW,ESTABLISHED -j DROP

Block incoming web access

iptables -A input -p tcp —dport 80 -j DROP

Port forward

Forward incoming connection to another internal host (aa.bb.cc.dd:22)

iptables -t nat -A PREROUTING -I eth0 -p tcp —dport 1022 -j DNAT –to aa.bb.cc.dd:22

iptables -A FORWARD -p tcp -d aa.bb.cc.dd dport 22 -m state –state NEW,ESTABLISH -j ACCEPT

Delete a rule

iptables -L -n -v –line-numbers

iptables -D input {line-number}

 Download PDF

iptables-cheat-sheet

Advertisements

Snappy Ubuntu Core on Hyper-V

Do you want to test drive the Snappy ubuntu core on hyper-v? Here are some simple steps.

1. Download the ova file from the official ubuntu website

https://developer.ubuntu.com/en/snappy/start/#ova
http://cloud-images.ubuntu.com/ubuntu-core/15.04/core/stable/current/core-stable-amd64-cloud.ova

2. Use 7-zip (Windows) or tar (Linux) to untar the ova file
3. Use a image file converter (like virtualbox) to convert the vmdk file to vhd file.

e.g. VBoxManage.exe clonemedium core-stable-amd64-cloud-disk1.vmdk core-stable-amd64-cloud-disk1.vhd –format VHD

4. You can use standard cloud-init way to setup the system (not discuss here) or;

5. mount the VHD file in any linux machine, modify the /etc/shadow (in partition 3) to clear the root password;

6. Create a ubuntu-core machine in hyper-v and mount the vhd image.

7. Start the machine and enjoy.

Little Windows Batch to get yyyymmdd (year, month, day of month)

Do you need to write a windows batch and need to get yyyymmdd?  It is a nightmare if you deploy your batch file to multiple machines (e.g. different windows version, different locale setting, etc).

Unlike linux, windows build-in date command will output different format for different Windows version (e.g. xp, 2003, 2012) or different localized version.  And the user can also customize the output format.

In the old days, I’ll write a little program to do this.  But now there is a little tool, yyyymmdd.bat, https://github.com/litalidev/yyyymmdd which seems to work on different Windows versions.

Step by Step Guide on Setting Up git Server in Arch Linux (pushable)

Warning: This guide will create a git server readable/writable by everyone. That is no user/authentication control

# Login as root
pacman -S git

# If you want to push to the repository, do the following (2 steps).
vi /usr/lib/systemd/system/git-daemon\@.service
# Append –enable=receive-pack to the line of ExecStart

systemctl start git-daemon.socket

# If you want the git server starts on every reboot, do the following step
systemctl enable git-daemon.socket

cd /srv
mkdir git
chown git:git git
cd git

# Create a repository named project1.git
git –bare init project1.git
chown -R git:git project1.git

# at the working station (can be linux or windows machine), not root is required
# cd to your project base folder and clone the project1.git to local folder
cd /projects
git clone git://git_server_hostname_or_ipaddress/prject1.git cloned_project1
cd cloned_project1
git push origin master
# Now, you can do anything to the project (E.g. create a file file1.txt)
vi file1.txt
git commit -a
git push

Openwrt sysupgrade on x86 (barrier breaker)

WARNING: Before upgrading, you should backup the system first!!!

Disclaimer: This is just my experience.  It is not guarantee the steps listed will work on your system.

 

Openwrt upgrade on x86 can be very tricky in the old days.  However, it becomes an easy task starting from attitude adjustment (12.09) and onward.

The following lists the steps to upgrade to the latest snapshot (barrier breaker).  You should change the image to be downloaded in step 4 for the desired version.

  1. Do a full system backup to avoid any lost.  This is very import!!!
  2. login the system as root
  3. cd /tmp
  4. wget http://downloads.openwrt.org/snapshots/trunk/x86/openwrt-x86-generic-combined-ext4.img.gz
  5. sysupgrade -v /tmp/openwrt-x86-generic-combined-ext4.img.gz

Image

Openwrt in Hyper-V

Want to add a openwrt machine in hyper-v for testing?  Sadly, the openwrt did not include the hyper-v device driver for the network device.

(Un)luckily there is a legacy network driver in hyper-v that can be used in openwrt.

Steps to add openwrt machine inside hyper-v:

  • In hyper-v, add a machine with 64-128MB ram, legacy network device.
  • Copy the openwrt image to the virtual hard disk.
  • Mount the virtual hard disk (mount /dev/sda2 /mnt) and copy the tulip driver to the hard disk.
  • Boot the openwrt machine.
  • Inside the openwrt machine, add the tulip driver (cd /; opkg install kmod-tulip_3.3.8-1_x86.ipk)
  • ifconfig -a to check the name of the network device.
  • Modify /etc/config/network as usual and restart the network (or reboot).

Installation of ssh server for debian-in-android (gnuroot)

Update (2014-11-20): After rebooting the phone, the the sshd (openssh-server) failed to start again (some error message like “chroot /var/run/sshd” failed). So the reliable way is still using dropbear.

Update (2014-11-06): I can install openssh-server successfully under gunroot.  No special tricks (don’t why it failed in my first trial) except changing the port to > 1024 (/etc/ssh/sshd_config) and chmod og-rwx /etc/ssh/*.  After the modification, issue /etc/init.d/ssh start

Unlike traditional debian machine, you cannot install/run openssh-server inside a debain-in-android (gnuroot).  However, dropbear can be used instead.

Steps:

– Install android app GNURoot.

– Install android app, GNURoot Wheezy.

– Inside Debian terminal, install dropbear (apt-get intall dropbear).

– Modify /etc/default/dropbear and change the DROPBEAR_PORT to anything > 1024.

– (Update on 2014-07-04) Start the dropbear: /etc/init.d/dropbear start