11
Quick guess: You've upgraded the OS and the system has been up for a very long time, or managed to upgrade it without replacing the kernel, because the 4.4.11-v7+ modules have already been removed from Raspbian.
If there is no such directory as /lib/modules/4.4.11-v7+ (look) you should run sudo apt update then sudo apt upgrade to ensure your kernel has been ...
9
You likely don't have issues with iptables, unless you installed and configured it as it is not running on a default Raspbian install. Also the default install will normally open and listen on the required ports. However, if you intend on running a mail server you should install and configure a firewall first, as your server will be a prime target for ...
7
One of those days ... although the pi was recently booted, it seems that it needed a reboot - probably after some update?
When I was troubleshooting, I had
ls /lib/modules/$(uname -r)
ls: cannot access '/lib/modules/4.19.93-v7+': No such file or directory
After more research, I figured maybe a reboot was required, after that I had
# uname -r
4.19.97-v7+
#...
5
iptables -F
iptables -X
should do the trick of cleaning your current setup, or you may use the particular chain name you don't like:
iptables -F INPUT
I'd recommend to add these commands at the top of your script issuing iptables commands, so every time you start from a known situation.
Also, could you please elaborate more about what is your goal? the ...
5
The iptables "rules" commands in secure-rmc are very simplistic:
logger -t iptables "Configuring ip tables for interface $IFACE"
if [ "$IFACE" != "lo" ]; then
NETMASK=$(get_subnet $IFACE)
iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT
iptables -A INPUT -i $IFACE -j DROP
fi
(get_subnet is a function that extracts the subnet of interface $...
5
Right at the top of the raspmc homepage it says:
The firewall that we added in the release can now be enabled and
disabled via Raspbmc Settings.
They claim elsewhere the firewall is iptables and the system is debian based, so if you can't find Settings or it doesn't work, look thru the list returned by service --status-all for "iptables". If it's ...
5
I did some informal testing with a RPi in bridged, routed and NAT configurations using a usb wifi adapter to connect clients to the RPi, and the wired 100 Mbps Ethernet to my Internet router. Connecting directly to the router with wifi, I get 60 Mbps download speeds. With the RPi in the path, it drops to 10 Mbps or less. This was without any iptables ...
5
You went about this the wrong way. If you had simply disabled the service (update-rc.d -f dphys-swapfile) instead, it would be much easier to fix.
You could also have just added:
swapoff --all
dphys-swapfile swapoff
To /etc/rc.local.
Then I want you to read this, and if you then are not convinced that the unfounded and absurd concerns about wearing an SD ...
5
It is a bit unclear how do you want to connect the Laptop to the Raspberry Pi. I will assume that there is no other wifi router as access point running for example to connect to the internet so you want to connect to the RasPi direct by wifi. You tagged a bridge so it is possible to bridge the wired interface eth0 to wifi interface wlan0. If you setup the ...
4
You have to initalize your hostapd interface on e.g. wlan0. After that you can bring up your wlan1 and connect it to your router. Now you can bridge wlan0 and wlan1 like this:
apt-get install bridge-utils
brctl addbr bridge0
brctl addif bridge0 wlan0
brctl addif bridge0 wlan1
ifconfig bridge0 up
You can assign an ip to that bridge with:
dhclient bridge0
...
4
You're going to have to change your default routes.
route del default
route add default gw [WAN gateway/Internet-connected router IP address] [interface]
For example: My internet router's IP address is 192.168.1.1 and it's connected to eth1 on the Pi.
route del default
route add default gw 192.168.1.1 eth1
Don't forget to enable IPV4 (or V6) packet ...
4
Cracked it.
TLDR: Use this line:
tcpflags = syn
instead of this :
tcpflags = syn,ack
Long story:
I found it useful when debugging to run the knockd daemon in interactive mode:
sudo service knockd stop
sudo knockd -D -v
This way the daemon runs in the foreground and prints its configuration and then real-time status messages.
I then tried ...
4
The problem got solved by using the following commands:
sudo apt-get install ufw
sudo ufw allow 22
sudo ufw allow 8090
sudo ufw allow 8092
sudo ufw enable
sudo reboot
And everything was just fine. Also there was just also a little issue with the web app's splash page.
I thank everyone for all recommendations and answers! I will upvote what I can!
Thanks ...
4
If you want a more robust setup, you can try pi-hole. It is an open source software package made to block ads network wide, specifically for a Raspberry Pi. Although it can also run on other platforms. It comes with a management interface and easy updating of the used lists.
4
Your process is listening on IPv6 address ::1 (that's the IPv6 equivalent of IPv4 127.0.0.1 (aka localhost)).
You need it to listen on :: (which is IP6ADDR_ANY as that's the IPv6 equivalent of IPv4 INADDR_ANY (0.0.0.0)).
Don't use nc -l localhost 5001
If you want to connect from any other machine on your LAN. Use nc -l -p 5001 or nc -l -6 -p 5001 or nc -...
3
I would like to block all scanners
Then disconnect it from the internet. You cannot have it accessible on any port and still hide it from a scanner. The only way to hide it from a scanner and have it online would be to just set:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
And nothing else. In which case there is no point in ...
3
Change the vpn configs to both have dev tun and change your iptables to use:
*mangle
:PREROUTING ACCEPT
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
COMMIT
*raw
:PREROUTING ACCEPT
:OUTPUT ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
*filter
:INPUT ...
3
It's not recommended to mess around with a process' affinity. If you really have the urge, use taskset but you have been warned. The best you might do is kill people hurt performance (sic).
What I'd recommend is simply fire up multiple instances of OpenVPN, using different configuration files. You'll want to do something along the lines of
/usr/local/sbin/...
3
You can make firewall rules like this;
iptables --flush
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -d 0/0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j REJECT
...
3
Why use iptables at all if you want a ssh reverse tunnel?
Use
ssh -g -f -N -T -R22222:192.168.1.192:80 user@myvps.com
Assuming that 192.168.1.192:80 is the address of your camera and port 22222 is the port to listen on the remote server. No iptables, no forwarding needed for this.
You may need to allow the option -g on the server, see sshd_config, set ...
3
I've found a solution and created a script to share it. This script will download a list of known domains and block them by using dnsmasq. Those lists will be updated daily.
Run ./adblocker.sh --install|--start|--stop to install, start or stop it.
The script:
#!/bin/bash
installAB () {
if [[ "$(crontab -l | grep adblocker.sh)" =~ adblocker.sh ]]; then
...
3
I've solved the problem.
UPDATE: The main issue appears to be in the kernel drivers. Problem solved by upgrading the kernel from 4.14.50-v7+ to the latest stable version (currently 4.14.79-v7+) using sudo apt-get install raspberrypi-kernel, and rebooting. The steps outlined below are no longer necessary. (reference).
UPDATE 2: Bad drivers on the client ...
2
I found that this command will give you the IP address only:
$ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'
To output it to a file:
$ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' > "/var/www/ipadress.txt"
2
The newer Fedora versions (after 18) use firewalld as a default solution instead of iptables.
So all the configuration files are in /etc/firewalld
You can read extensively about firewalld configuration options here .
Since you effectively want to stop the firewall service just do systemctl stop firewalld.service or to make it permanent systemctl disable ...
2
Goldilocks solution did not work for me.
But here is my solution :
I added this line to the end of the /etc/network/if-up.d/secure-rmc :
sudo /sbin/iptables --flush
2
You want to use "DNAT" for this. You do DNAT in the PREROUTING nat table.
Probablly something along the lines of
iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <destination ip>
2
As it turns out, I was really close to getting it right. Thanks to the awesome guys over at the raspberry pi forum, I got it working.
What I did was changing the gateway on the pi zero to the ip of the pi 2:
allow-hotplug usb0
iface usb0 inet static
address 10.0.1.2
netmask 255.255.255.0
gateway 10.0.1.1 #<-- I changed this
And ...
2
You may be able to create a network bridge. This essentially lets your Pi act as a network switch between the Wi-fi and wired networks.
sudo apt-get install bridge-utils
sudo ifconfig eth0 0.0.0.0
sudo ifconfig wlan0 0.0.0.0
sudo brctl addbr br0
sudo brctl addif br0 eth0
sudo brctl addif br0 wlan0
sudo dhclient br0
Note that not all Wi-fi devices will ...
2
! is a special bash character for history expansion and has to be escaped.
The exclamation mark needs to be escaped in single quotes ' and the position is before the interface name, not before the argument.
So your command becomes
sudo iptables -t nat -A POSTROUTING -i '!'eth0 -o wlan+ -j MASQUERADE
Note that POSTROUTING and -i don't work together, so it ...
2
For me:
sudo ufw allow 9999
works, where 9999 is the port number i want to open.
Debugging:
In case ufw is not installed:
sudo apt-get install ufw
In case ufw is not running (check with sudo ufw status):
sudo ufw enable
Question already answered?
i asked on meta: Should i place a second answer if question title vs answer differ?.
Only top voted, non community-wiki answers of a minimum length are eligible
