Simple tip

Saturday, September 08, 2012

IP SLA log for Packet loss

Sample Config for IP SLA monitor Link

This config with IOS advsecurityk9-mz.124-15.T13.bin

ip sla logging traps
ip sla 203
icmp-echo 192.168.1.1
tag VPN_Gateway
frequency 10
ip sla reaction-configuration 203 react timeout threshold-type immediate action-type trapOnly
ip sla schedule 203 life forever start-time now

###########sample log##########
Sep 8 2012 19:33:24.110 TH: %RTT-4-OPER_TIMEOUT: condition occurred, entry number = 203
Sep 8 2012 19:33:24.158 TH: %RTT-3-IPSLATHRESHOLD: IP SLAs(203): Threshold Occurred for timeout
Sep 8 2012 19:33:49.492 TH: %RTT-4-OPER_TIMEOUT: condition cleared, entry number = 203
Sep 8 2012 19:33:49.540 TH: %RTT-3-IPSLATHRESHOLD: IP SLAs(203): Threshold Cleared for timeout

Monday, July 09, 2012

How to change google search on linux mint11

change google search firefox on linux mint11

root@linux#vi /usr/lib/firefox-addons/searchplugins/en-US/google.xml

Here sample config file search
###############################################################

Google
Google Search
UTF-8

www.google.com

disable unwant on ubuntu 12.04

ubuntu 12.04

disable guest account

Open /etc/lightdm/lightdm.conf file from your terminal using the following command

sudo gedit /etc/lightdm/lightdm.conf

Add the following line

allow-guest=false

Save and exit the file

After adding the above line you should see similar to the following in lightdm.conf file

[SeatDefaults]
user-session=ubuntu
greeter-session=unity-greeter
allow-guest=false

Finally you have to restart lightdm using the following command from your terminal

sudo /etc/init.d/lightdm restart

=============

disable dnsmasq

If you don’t want a local resolver you can turn it off DNSMASQ using the following procedure

You need to edit /etc/NetworkManager/NetworkManager.conf file

    gksudo gedit /etc/NetworkManager/NetworkManager.conf

and comment out the following line from

    dns=dnsmasq

to

    #dns=dnsmasq

Save and exit the file

Now you need to network-manager using the following command

    sudo /etc/init.d/network-manager restart

Saturday, June 30, 2012

Problem ssh client remote to ssh server version 1 for debian 6.04

How to enable ssh client to support ssh server version 1 and 2

problem

When remote ssh to server version 1 the message will warn like this . because default version of ssh client is version 2.

root@tproxy:/etc# ssh root@192.168.229.1
Protocol major versions differ: 2 vs. 1
root@tproxy:/etc#

ssh software for ssh client

root@tproxy:/etc/ssh# ssh -V
OpenSSH_5.5p1 Debian-6+squeeze1, OpenSSL 0.9.8o 01 Jun 2010
root@tproxy:/etc/ssh#

How to resolve

root@tproxy:/etc# vi /etc/ssh/ssh_config

unmark # in line protocol 2,1 to enable both version 1 and 2

Protocol 2,1

save and restart service ssh by command

root@tproxy:~# /etc/init.d/ssh restart
Restarting OpenBSD Secure Shell server: sshd.
root@tproxy:~#

===========
Test for version 1

root@tproxy:~# ssh cisco@192.168.229.129
The authenticity of host '192.168.229.129 (192.168.229.129)' can't be established.
RSA1 key fingerprint is 6f:37:40:fe:19:ed:67:5a:89:85:e7:e5:8f:9d:a5:09.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.229.129' (RSA1) to the list of known hosts.
cisco@192.168.229.129's password:
R1>sh ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 3
R1>

Test for version 2

root@tproxy:~# ssh cisco@192.168.229.129
WARNING: RSA1 key found for host 192.168.229.129
in /root/.ssh/known_hosts:1
RSA1 key fingerprint 6f:37:40:fe:19:ed:67:5a:89:85:e7:e5:8f:9d:a5:09.
+--[RSA1 1024]----+
|                 |
|                 |
|          .      |
|         o   .. |
|        S o ...o.|
|         . o +=.o|
|          o E..o*|
|         . . o X+|
|              =.o|
+-----------------+

The authenticity of host '192.168.229.129 (192.168.229.129)' can't be established
but keys of different type are already known for this host.
RSA key fingerprint is aa:f8:94:e1:a7:d2:c8:56:44:94:44:37:65:7f:d7:c0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.229.129' (RSA) to the list of known hosts.
Password:

R1>sh ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
R1>

Thursday, February 16, 2012

How to add user via CLI Linux

How to add user via CLI Linux

root@ubuntu:/home# useradd -d /home/ldapadmin -s /bin/bash -m ldapadmin
root@ubuntu:/home# passwd ldapadmin
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

verify

root@ubuntu:/home# ls
ldapadmin ruamit
root@ubuntu:/home# grep ldapadmin /etc/passwd
ldapadmin:x:1001:1001::/home/ldapadmin:/bin/bash
root@ubuntu:/home# grep ldapadmin /etc/group
ldapadmin:x:1001:
root@ubuntu:/home# grep ldapadmin /etc/shadow
ldapadmin:$6$AMNnkWYY$jFbAtB2Lb8/PNbZlKvlyoPf8DhAIBwSpU/5TYlWLZSGkGxUsma.Sq49nfJRhVgnRLE.mU8El/3m.JEdV8M/511:15386:0:99999:7:::
root@ubuntu:/home#
root@ubuntu:/home# ls -al
total 16
drwxr-xr-x 4 root      root      4096 2012-02-16 16:57 .
drwxr-xr-x 22 root      root      4096 2012-02-16 11:26 ..
drwxr-xr-x 2 ldapadmin ldapadmin 4096 2012-02-16 16:57 ldapadmin
root@ubuntu:/home#

sample when login

root@ubuntu:/home# ssh -l ldapadmin localhost
ldapadmin@localhost's password:

Last login: Thu Feb 16 16:46:24 2012 from 192.168.2.200
ldapadmin@ubuntu:~$
ldapadmin@ubuntu:~$ ls -al
total 28
drwxr-xr-x 3 ldapadmin ldapadmin 4096 2012-02-16 16:46 .
drwxr-xr-x 4 root root 4096 2012-02-16 16:46 ..
-rw-r--r-- 1 ldapadmin ldapadmin 220 2011-04-01 02:26 .bash_logout
-rw-r--r-- 1 ldapadmin ldapadmin 3353 2011-04-01 02:26 .bashrc
drwx------ 2 ldapadmin ldapadmin 4096 2012-02-16 16:46 .cache
-rw-r--r-- 1 ldapadmin ldapadmin 179 2010-09-15 18:41 examples.desktop
-rw-r--r-- 1 ldapadmin ldapadmin 675 2011-04-01 02:26 .profile
ldapadmin@ubuntu:~$

how to delete

root@ubuntu:/home# userdel -r ldapadmin

verify

root@ubuntu:/home# grep ldapadmin /etc/passwd
root@ubuntu:/home# grep ldapadmin /etc/group
root@ubuntu:/home# grep ldapadmin /etc/shadow

root@ubuntu:/home# ls -al
total 12
drwxr-xr-x 3 root   root   4096 2012-02-16 17:01 .
drwxr-xr-x 22 root   root   4096 2012-02-16 11:26 ..
root@ubuntu:/home#

Wednesday, February 08, 2012

Install DHCP on Linux

Install DHCP on Linux

root@servert# apt-get install dhcp3-server

====================================
sample config

root@servert# cat /etc/dhcp3/dhcpd.conf
ddns-update-style none;
log-facility local7;
ignore client-updates;
option domain-name-servers 192.168.2.1, 172.30.0.1;
default-lease-time 600;
max-lease-time 3600;
authoritative;
subnet 192.168.2.0 netmask 255.255.255.0 {
        range 192.168.2.200 192.168.2.229;
        option subnet-mask 255.255.255.0;
        option broadcast-address 192.168.2.255;
        option routers 192.168.2.1;
}

root@servert# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 192.168.2.1
    netmask 255.255.255.0
    network 192.168.2.0
    broadcast 192.168.1.255

root@servert# cat /etc/default/dhcp3-server
# Defaults for dhcp initscript
# sourced by /etc/init.d/dhcp
# installed at /etc/default/dhcp3-server by the maintainer scripts

#
# This is a POSIX shell fragment
#

# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
#    Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACES="eth0"

=======================================================
check lease time

Note:   This time format refer UTC +0 cannot modify any more

root@servert# cat /var/lib/dhcp3/dhcpd.leases
# The format of this file is documented in the dhcpd.leases(5) manual page.
# This lease file was written by isc-dhcp-V3.1.3

lease 192.168.2.200 {
starts 3 2012/02/08 14:08:08;
ends 3 2012/02/08 14:18:08;
tstp 3 2012/02/08 14:18:08;
cltt 3 2012/02/08 14:08:08;
binding state active;
next binding state free;
hardware ethernet 00:50:56:C0:00:08;
uid "\001\350\232\217]4\366";
client-hostname "pc001";
}
lease 192.168.2.200 {
starts 3 2012/02/08 14:13:08;
ends 3 2012/02/08 14:23:08;
cltt 3 2012/02/08 14:13:08;
binding state active;
next binding state free;
hardware ethernet 00:50:56:C0:00:08;
uid "\001\350\232\217]4\366";
client-hostname "vmhost";
}

root@servert#

squid3 tproxy on ubuntu 10.10 How to

tproxy squid3 on ubuntu 10.10 How to

tproxy on ubuntu 10.10 How to
Refer http://wiki.squid-cache.org/Features/Tproxy4

echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
modprobe ip_tables
modprobe iptable_filter
modprobe ipt_TPROXY
modprobe ipt_tproxy

=======================

config on /etc/sysctrl.conf
net.ipv4.conf.default.rp_filter=2
net.ipv4.conf.all.rp_filter=2
net.ipv4.ip_forward=1

=============================

Add in /etc/rc.local

ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 5/sec -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

================================
#squid3 config
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access allow manager
http_access allow !Safe_ports
http_access allow CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_reply_access allow all

http_port 3129 tproxy
tcp_outgoing_address 0.0.0.0
udp_incoming_address 0.0.0.0
udp_outgoing_address 0.0.0.0
icp_port 0

via off
forwarded_for off
log_mime_hdrs off
httpd_suppress_version_string on

ie_refresh on
cache_mem 256 MB
maximum_object_size_in_memory 16 KB
cache_dir ufs /var/spool/squid3/cache1 1000 16 256
cache_dir ufs /var/spool/squid3/cache2 1000 16 256
cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF
minimum_object_size 0 KB
maximum_object_size 40960 KB
mime_table /usr/share/squid3/mime.conf
logformat common %{%Y-%m-%d %H:%M:%S}tl %6tr %>a %Ss/%03>Hs %access_log /var/log/squid3/access.log common
cache_log /var/log/squid3/cache.log
cache_store_log none
logfile_rotate 5
log_mime_hdrs off
shutdown_lifetime 5 seconds
log_icp_queries off

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 1440 20% 14400
cache_mgr webmaster
cache_effective_user proxy
cache_effective_group proxy
pid_filename /var/run/squid3.pid
coredump_dir /var/cache/squid3

==========
url http://wiki.squid-cache.org/Features/Tproxy4

check squid support
squid 3.1 = squid3 -v | grep "enable-linux-netfilter"
kernel 2.6.35 up
iptable 1.4.1

sample netstat and log

root@ThinkPad:~# tail -f /var/log/squid3/access.log
2012-02-08 17:08:18    267 192.168.2.200 TCP_MISS/200 3410 GET http://l.yimg.com/cv/ae/us/yahoo/111031/120x45liw942fx1.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:18    347 192.168.2.200 TCP_MISS/200 1539 GET http://l1.yimg.com/a/i/ww/met/pa_icons_18/twitter_new_20101222.gif - DIRECT/216.115.100.102 image/gif
2012-02-08 17:08:18     24 192.168.2.200 TCP_HIT/200 3070 GET http://l.yimg.com/a/i/mntl/aut/09q4/def_aa9d6007.jpg - NONE/- image/jpeg
2012-02-08 17:08:19    562 192.168.2.200 TCP_MISS/200 3440 GET http://l.yimg.com/cv/ip/ap/default/120207/bikeman_sec.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:19      1 192.168.2.200 TCP_HIT/200 2577 GET http://l.yimg.com/a/i/ww/met/sprite_videoicon_20100201_ltr.png - NONE/- image/png
2012-02-08 17:08:19    861 192.168.2.200 TCP_MISS/200 5836 GET http://l1.yimg.com/cv/ip/ap/default/120207/moreno2_sm.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:19    886 192.168.2.200 TCP_MISS/200 6500 GET http://l1.yimg.com/cv/ip/ap/default/120207/maria_sm.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:19    913 192.168.2.200 TCP_MISS/200 3467 GET http://l.yimg.com/cv/ip/ap/default/120208/syria_sc.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:19    664 192.168.2.200 TCP_MISS/200 14284 GET http://l.yimg.com/cv/ip/ap/default/120207/engagement110.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:19     13 192.168.2.200 TCP_HIT/200 20904 GET http://l.yimg.com/zz/combo? - NONE/- application/x-javascript
2012-02-08 17:08:20   1667 192.168.2.200 TCP_MISS/200 3853 GET http://l.yimg.com/cv/ip/ap/default/120207/amyduggar_sec.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:20   1688 192.168.2.200 TCP_MISS/200 5862 GET http://l1.yimg.com/cv/ip/ap/default/120207/robertdowney_sm.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:20   1510 192.168.2.200 TCP_MISS/200 2515 GET http://l1.yimg.com/cv/ip/ap/default/120208/romney_sm.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:20   1639 192.168.2.200 TCP_MISS/200 16956 GET http://l.yimg.com/cv/mntl/aut/11q3/img_f21dc41a.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:20      1 192.168.2.200 TCP_HIT/200 5500 GET http://l.yimg.com/cv/mntl/sma/11q3/img_68b0e692.jpg - NONE/- image/jpeg
2012-02-08 17:08:20      3 192.168.2.200 TCP_HIT/200 8529 GET http://l.yimg.com/cv/ae/us/yahoo/120117/92x55l3bd2qfcz.jpg - NONE/- image/jpeg
2012-02-08 17:08:20      1 192.168.2.200 TCP_HIT/200 1256 GET http://l.yimg.com/a/images/ww/met/slimheader/yahoo-logo-sm-png8.png - NONE/- image/png
2012-02-08 17:08:20   2272 192.168.2.200 TCP_MISS/200 5470 GET http://l1.yimg.com/cv/ip/ap/default/120207/beyonce_sm.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:20   1452 192.168.2.200 TCP_MISS/200 11142 GET http://l.yimg.com/cv/ip/ap/default/120207/lizard110.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:21   1119 192.168.2.200 TCP_MISS/200 12522 GET http://l.yimg.com/cv/ip/ap/default/120207/superhero80.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:21   1534 192.168.2.200 TCP_MISS/200 12556 GET http://l.yimg.com/cv/ip/ap/default/120207/chickenpiccata110.jpg - DIRECT/216.115.100.102 image/jpeg
2012-02-08 17:08:21   5072 192.168.2.200 TCP_MISS/200 66296 GET http://www.yahoo.com/ - DIRECT/72.30.2.43 text/html
^C
root@ThinkPad:~# netstat -tuanp | grep squid
tcp        0      0 0.0.0.0:3129            0.0.0.0:*               LISTEN      1805/(squid)
tcp        0      0 110.164.205.140:80      192.168.2.200:51088     ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:47416     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:38141     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:50905     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 110.164.205.143:80      192.168.2.200:51120     ESTABLISHED 1805/(squid)
tcp        0      0 216.115.100.103:80      192.168.2.200:51133     ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:43751     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 110.164.205.143:80      192.168.2.200:51118     ESTABLISHED 1805/(squid)
tcp        0      0 110.164.205.143:80      192.168.2.200:51124     ESTABLISHED 1805/(squid)
tcp        0      0 216.115.100.103:80      192.168.2.200:51139     ESTABLISHED 1805/(squid)
tcp        0      0 110.164.205.143:80      192.168.2.200:51105     ESTABLISHED 1805/(squid)
tcp        0      0 216.115.100.103:80      192.168.2.200:51134     ESTABLISHED 1805/(squid)
tcp        0      0 216.115.100.103:80      192.168.2.200:51135     ESTABLISHED 1805/(squid)
tcp        0      0 118.214.31.139:80       192.168.2.200:51095     ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:56003     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 216.115.100.103:80      192.168.2.200:51142     ESTABLISHED 1805/(squid)
tcp        0      0 110.164.205.149:80      192.168.2.200:51126     ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:33132     216.115.100.102:80      ESTABLISHED 1805/(squid)
tcp        0      0 192.168.2.200:37754     216.115.100.102:80      ESTABLISHED 1805/(squid)

Wednesday, March 02, 2011

ftp server linux with mysql

apt-get install apache2 php5 mysql-server phpmyadmin mysql-client pure-ftpd-mysql

####### config database

mysql -u root -p

CREATE DATABASE pureftpd;
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO 'pureftpd'@'localhost' IDENTIFIED BY 'ftpdpass';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO 'pureftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';
FLUSH PRIVILEGES;

USE pureftpd;
CREATE TABLE ftpd (
User varchar(16) NOT NULL default '',
status enum('0','1') NOT NULL default '0',
Password varchar(64) NOT NULL default '',
Uid varchar(11) NOT NULL default '-1',
Gid varchar(11) NOT NULL default '-1',
Dir varchar(128) NOT NULL default '',
ULBandwidth smallint(5) NOT NULL default '0',
DLBandwidth smallint(5) NOT NULL default '0',
comment tinytext NOT NULL,
ipaccess varchar(15) NOT NULL default '*',
QuotaSize smallint(5) NOT NULL default '0',
QuotaFiles int(11) NOT NULL default 0,
PRIMARY KEY (User),
UNIQUE KEY User (User)
) TYPE=MyISAM;
quit;

cp /etc/pure-ftpd/db/mysql.conf /etc/pure-ftpd/db/mysql.conf_orig
cat /dev/null > /etc/pure-ftpd/db/mysql.conf

#### config ftp
vi /etc/pure-ftpd/db/mysql.conf

MYSQLSocket /var/run/mysqld/mysqld.sock
#MYSQLServer localhost
#MYSQLPort 3306
MYSQLUser pureftpd
MYSQLPassword ftpdpass
MYSQLDatabase pureftpd
#MYSQLCrypt md5, cleartext, crypt() or password() - md5 is VERY RECOMMENDABLE uppon cleartext
MYSQLCrypt md5
MYSQLGetPW SELECT Password FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MYSQLGetUID SELECT Uid FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MYSQLGetGID SELECT Gid FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MYSQLGetDir SELECT Dir FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MySQLGetBandwidthUL SELECT ULBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MySQLGetBandwidthDL SELECT DLBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MySQLGetQTASZ SELECT QuotaSize FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
MySQLGetQTAFS SELECT QuotaFiles FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")

echo "yes" > /etc/pure-ftpd/conf/ChrootEveryone
echo "yes" > /etc/pure-ftpd/conf/CreateHomeDir
echo "yes" > /etc/pure-ftpd/conf/DontResolve
/etc/init.d/pure-ftpd-mysql restart

Insert text by command line linux

sample for insert text on file

sudo echo "127.0.0.1 wordpress.ruamit.co.cc" | sudo tee -a /etc/hosts
sudo echo "127.0.0.1 forums.ruamit.co.cc" | sudo tee -a /etc/hosts
sudo echo "127.0.0.1 support.ruamit.co.cc" | sudo tee -a /etc/hosts

check after insert

mint@mint ~ $ cat /etc/hosts
1.1.1.21 mint # Added by NetworkManager
127.0.0.1 localhost.localdomain localhost
::1 mint localhost6.localdomain6 localhost6
127.0.1.1 mint

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

127.0.0.1 wordpress.ruamit.co.cc
127.0.0.1 forums.ruamit.co.cc
127.0.0.1 support.ruamit.co.cc
mint@mint ~ $

Saturday, February 26, 2011

restrict your router's NTP services.

Refer by Cisco cookbook
You want to restrict your router's NTP services.
Solution

You can use the ntp access-group command to restrict which devices you want your router to allow NTP associations with:

Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#access-list 88 permit host 172.25.1.1
Router(config)#access-list 88 permit host 10.1.1.1
Router(config)#access-list 99 permit 172.25.0.0 0.0.255.255
Router(config)#access-list 99 permit 10.2.0.0 0.0.255.255
Router(config)#clock timezone EST -5
Router(config)#clock summer-time EDT recurring
Router(config)#ntp server 172.25.1.1 version 3
Router(config)#ntp server 10.1.1.1 version 3
Router(config)#ntp access-group peer 88
Router(config)#ntp access-group serve-only 99
Router(config)#end
Router#

Discussion

In this example, the router will allow the internal clock to be synchronized by the two NTP servers listed in access list 88, 172.25.1.1 and 10.1.1.1. The router also allows time requests only from the client devices permitted by access list 99.

By default, NTP has no access controls, and it gives full access to all NTP devices. The ntp access-group command limits this access to various NTP services. In the example above, the peer keyword means that the router will only allow its internal clock to be changed by those remote servers and peers permitted by the access list.

The serve-only keyword specifies the clients permitted to obtain time services from the router. In the above example, the serve-only access list (99) permits two entire subnets, 172.2.0.0 255.255.0.0 and 10.2.0.0 255.255.0.0. This means that any NTP clients residing on either of these two subnets can obtain time services from the local router. Using the same method, you can limit the access list to a single subnet, a group of hosts, or no one. Omitting the ntp access-group serve-only command completely prevents the router from providing time services.

NTP access groups provide excellent granularity of access to time services on a global basis. Used in conjunction with the interface command ntp disable, NTP access groups can form the basis of an effective access control strategy.

How to troubleshoot SSH error on cisco router

Error %SSH-3-PRIVATEKEY Unable to retrieve RSA private key

Feb 24 2011 14:39:56.539 TH: %SSH-3-PRIVATEKEY: Unable to retrieve RSA private key for R4.ruamit.co.cc
-Process= "SSH Process", ipl= 0, pid= 4
-Traceback= 81037CC0 81034670 81035D38 8020D9E8 8021117C
Feb 24 2011 14:39:58.963 TH: %SSH-3-PRIVATEKEY: Unable to retrieve RSA private key for R4.ruamit.co.cc
-Process= "SSH Process", ipl= 0, pid= 4
-Traceback= 81037CC0 81034670 81035D38 8020D9E8 8021117C
Feb 24 2011 14:46:05.540 TH: %SSH-3-PRIVATEKEY: Unable to retrieve RSA private key for R4.ruamit.co.cc
-Process= "SSH Process", ipl= 0, pid= 4
-Traceback= 81037CC0 81034670 81035D38 8020D9E8 8021117C
Feb 24 2011 15:02:01.306 TH: %SSH-3-PRIVATEKEY: Unable to retrieve RSA private key for R4.ruamit.co.cc
-Process= "SSH Process", ipl= 0, pid= 4

Resolve By solution below

1 - Remove ssh or disable by command " crypto key zeroize rsa"
2 - Generate key again by command " crypto key generate rsa"

If still cannot login ssh check by command " sh crypto key mypubkey rsa"
and chose key to used by command " ip ssh rsa keypair-name "

sample error when login

root@ssh-server:~$ ssh -l cisco 192.168.1.1
Disconnecting: Corrupted check bytes on input.
root@ssh-server:~$

example

R4#show crypto key mypubkey rsa
% Key pair was generated at: 00:04:12 UTC Mar 1 2002
Key name: R4.ruamit.co.cc
Usage: General Purpose Key
Key is not exportable.

key name is R4.ruamit.co.cc

router (config)# ip ssh rsa keypair-name R4.ruamit.co.cc

Wednesday, January 05, 2011

flow accounting vyatta

sample monitor flow via command line vyatta

[edit]
ruamit@Core-BKK02# edit system
[edit system]
[edit system]
ruamit@Core-BKK02# set flow-accounting interface eth0
[edit system]
ruamit@Core-BKK02# set flow-accounting interface eth2
config
ruamit@Core-BKK02# show flow-accounting
interface eth0
interface eth2
[edit system]
ruamit@Core-BKK02#

Check Flow command
ruamit@Core-BKK02# run show flow-accounting
flow-accounting for [eth0]
Src Addr Dst Addr Sport Dport Proto Packets Bytes Flows
218.107.216.54 192.168.26.4 80 37666 tcp 169 228481 1
216.131.84.113 192.168.26.4 80 52190 tcp 146 192031 1
216.131.84.113 192.168.26.4 80 54542 tcp 119 146697 1
216.131.84.113 192.168.26.4 80 42359 tcp 101 119101 1
216.131.84.113 192.168.26.4 80 35811 tcp 94 116388 1
216.131.84.113 192.168.26.4 80 38051 tcp 105 115260 1
216.131.84.113 192.168.26.4 80 56465 tcp 95 104146 1
216.131.84.113 192.168.26.4 80 55010 tcp 74 102579 1
216.131.84.113 192.168.26.4 80 34760 tcp 59 58314 1
216.131.84.113 192.168.26.4 80 46918 tcp 39 44855 1
66.220.158.32 192.168.26.4 80 51976 tcp 8 3965 1
66.220.149.11 192.168.26.4 80 41444 tcp 8 3651 1
72.14.203.113 192.168.26.4 80 47088 tcp 11 3230 1
69.63.180.48 192.168.26.4 80 38182 tcp 14 2121 1
68.169.43.123 192.168.26.4 80 57355 tcp 3 1506 1
203.144.207.29 192.168.26.4 53 54391 udp 7 1174 4
72.14.203.102 192.168.26.4 80 59484 tcp 6 1046 1
209.85.231.104 192.168.26.4 80 54087 tcp 4 529 1

Total entries: 18
Total flows : 21
Total pkts : 1,062
Total bytes : 1,245,074

flow-accounting for [eth2]
Src Addr Dst Addr Sport Dport Proto Packets Bytes Flows
192.168.201.1 192.168.201.253 1688 8080 tcp 8 4064 2
192.168.201.1 192.168.201.253 1682 8080 tcp 58 4061 2
192.168.201.1 192.168.201.253 1667 23 tcp 91 3703 0
192.168.201.1 192.168.201.253 1691 8080 tcp 8 3572 3
192.168.201.1 192.168.201.253 1535 8080 tcp 6 3192 2
192.168.201.1 192.168.201.253 1686 8080 tcp 6 2015 2

Total entries: 6
Total flows : 11
Total pkts : 177
Total bytes : 20,607

[edit system]
ruamit@Core-BKK02#

sample send netflow to netflow server

ruamit@Core-BKK02# show flow-accounting
interface eth0
interface eth2
netflow {
sampling-rate 1
server 192.168.201.1 {
port 9996
}
}
[edit system]

Tuesday, January 04, 2011

Sample QoS Vyatta

i've 2 network. One is wireless and one is LAN line

scope

lan line limit traffic 15mbit used http https dns pop3 minimum 60% other minimum 20%
wiless limit 5mbit used http https dns pop3 minimum 60% other minimum 20%

here is sample config

set traffic-policy shaper 5m bandwidth '5120kbit'
set traffic-policy shaper 5m class 2 bandwidth '60%'
set traffic-policy shaper 5m class 2 ceiling 100%
set traffic-policy shaper 5m class 2 match dns ip protocol 'udp'
set traffic-policy shaper 5m class 2 match dns ip source port '53'
set traffic-policy shaper 5m class 2 match http ip protocol 'tcp'
set traffic-policy shaper 5m class 2 match http ip source port '80'
set traffic-policy shaper 5m class 2 match https ip protocol 'tcp'
set traffic-policy shaper 5m class 2 match https ip source port '443'
set traffic-policy shaper 5m class 2 match pop3 ip protocol 'tcp'
set traffic-policy shaper 5m class 2 match pop3 ip source port '110'
set traffic-policy shaper 5m class 2 queue-type 'fair-queue'
set traffic-policy shaper 5m default bandwidth '20%'
set traffic-policy shaper 5m default ceiling 100%
set traffic-policy shaper 5m default queue-type 'fair-queue'

set traffic-policy shaper 15m bandwidth '15mbit'
set traffic-policy shaper 15m class 2 bandwidth '60%'
set traffic-policy shaper 15m class 2 ceiling 100%
set traffic-policy shaper 15m class 2 match dns ip protocol 'udp'
set traffic-policy shaper 15m class 2 match dns ip source port '53'
set traffic-policy shaper 15m class 2 match http ip protocol 'tcp'
set traffic-policy shaper 15m class 2 match http ip source port '80'
set traffic-policy shaper 15m class 2 match pop3 ip protocol 'tcp'
set traffic-policy shaper 15m class 2 match pop3 ip source port '110'
set traffic-policy shaper 15m class 2 match https ip protocol 'tcp'
set traffic-policy shaper 15m class 2 match https ip source port '443'
set traffic-policy shaper 15m class 2 queue-type 'fair-queue'
set traffic-policy shaper 15m default bandwidth '20%'
set traffic-policy shaper 15m default ceiling 100%
set traffic-policy shaper 15m default queue-type 'fair-queue'
commit

set interfaces ethernet eth0 traffic-policy out '15m'
set interfaces wireless wlan0 traffic-policy out '5m'
commit

Note Wireless work well as kernel 2.6.32 last or used lasted vyatta iso file

Thursday, December 30, 2010

limit traffic Vyatta

การ limit traffic การใช้งานของ Vyatta

shaper = outbount
limiter = inbound

ตัวอย่าง

set traffic-policy limiter 15m default bandwidth '15mbit'
set traffic-policy shaper 20m default bandwidth '20mbit'

commit

set interfaces ethernet eth0 traffic-policy in '15m'
set interfaces ethernet eth0 traffic-policy out '20m'

commit

ตรวจสอบ config

ruamit@core-bkk01# show traffic-policy limiter
15m {
default {
bandwidth 15mbit
}
}
[edit]
ruamit@core-bkk01# show traffic-policy shaper
20m {
default {
bandwidth 20mbit
}
}
[edit]
ruamit@core-bkk01# show interfaces ethernet eth0
address 192.168.1.100/24
address 172.16.0.1/24
hw-id 00:1c:23:00:69:4b
traffic-policy {
in 15m
out 20m
}

การตรวสอบว่า ตรงหรือไม่อาจจะต้องใช้ program STG เพื่อจับ traffic หรือ ลง iptraf เพื่อ monitor traffic อีกที เนื่องจาก กรณี show interface จะไม่บอก bitrate ที่วิ่ง จะแสดงเฉพาะ packet เนื่องจากเป็น base linux

Wednesday, December 29, 2010

port forword on juniper SRX with adsl

ตัวอย่างการ set port fwd สำหรับ adsl เช่น remote เข้ามาที่ wan pp0.0 port 23ให้ forword ไปที่ 172.16.0.99 port 23

set security nat destination pool telnet-host address 172.16.0.99/32
set security nat destination pool telnet-host address port 23
set security nat destination rule-set nat-static from interface pp0.0
set security nat destination rule-set nat-static rule port-forword match destination-address 0.0.0.0/0
set security nat destination rule-set nat-static rule port-forword match destination-port 23
set security nat destination rule-set nat-static rule port-forword then destination-nat pool telnet-host

หมายเหตุ destination-address 0.0.0.0/0 เนื่องจาก adsl เป็น dynamic ip จึงไม่สามารถระบุ ip ที่แน่นอนได้ จึงระบุเป็น class ใหญ่

อย่าลืม allow zone policy ด้วยน่ะครับ

set security policies from-zone untrust to-zone trust policy port-fwd match source-address any
set security policies from-zone untrust to-zone trust policy port-fwd match destination-address ip_172.16.0.99
set security policies from-zone untrust to-zone trust policy port-fwd match application junos-telnet
set security policies from-zone untrust to-zone trust policy port-fwd then permit

Tuesday, December 28, 2010

Juniper and tacac+

config บน Juniper เพื่อคุยกับ tacacs+ server

set system authentication-order tacplus
set system authentication-order password

set system tacplus-server 192.168.26.4 port 49
set system tacplus-server 192.168.26.4 secret "$9$G-Uqf3nC0BEz3A0O1rlxNds4ZjHmQ39"
set system tacplus-server 192.168.26.4 single-connection

set system accounting events login
set system accounting events change-log
set system accounting events interactive-commands
set system accounting destination tacplus

account สำหรับ tacacs+ คุยกับ router

set system login user view full-name TACACS_ACCOUNT_OPERATOR
set system login user view uid 2002
set system login user view class operator

set system login user admin full-name TACACS_ACCOUNT_ADMIN
set system login user admin uid 2001
set system login user admin class super-user

ตัวอย่าง config บน tacac+ server เพื่อคุยกับ juniper หมายเหตุ version tacacs+ F4.0.4.19 บน linux

# Group Account
group = admin {
default service = permit
service = junos-exec {
local-user-name = admin
allow-commands = "all"
}
group = viewer {
default service = deny
service = junos-exec {
local-user-name = view
deny-commands = "clear|rquest|restart|"
}
}

#user admin
user = nmc {
login = cleartext "nmc1234"
member = admin
}

#user operator
user = test01 {
login = cleartext "test1234"
member = viewer
}

PPPOE on Juniper SRX

การ set PPPoE บน juniper SRX

interface ge-0/0/1 ผมเลือกเป็น uplink เชื่อมกับ modem โดยให้ modem เป็น bridge

set interfaces ge-0/0/1 description PPPOE_INTERFACE
set interfaces ge-0/0/1 unit 0 encapsulation ppp-over-ether

กำ profile ppp และ interface ppp เพื่อเชื่อมต่อกับ DSLAM

set access profile ppp authentication-order password

set interfaces pp0 unit 0 description PPP_TO_TRUE_ADSL
set interfaces pp0 unit 0 ppp-options pap access-profile ppp
set interfaces pp0 unit 0 ppp-options pap local-name "adslaccout@truehisp"
set interfaces pp0 unit 0 ppp-options pap local-password "$9$P5T3CA0EclFnEy"
set interfaces pp0 unit 0 ppp-options pap passive

set interfaces pp0 unit 0 pppoe-options underlying-interface ge-0/0/1.0
set interfaces pp0 unit 0 pppoe-options auto-reconnect 30
set interfaces pp0 unit 0 pppoe-options client

set interfaces pp0 unit 0 family inet mtu 1492
set interfaces pp0 unit 0 family inet no-redirects
set interfaces pp0 unit 0 family inet negotiate-address

เปิด ping กับ telnet สำหรับ ทดสอบและ remote หรือจะ on service ssh ก็ได้ตามสะดวก แต่ว่า WAN อยู่ใน zone untrust น่ะครับ

set security zones security-zone untrust interfaces pp0.0 host-inbound-traffic system-services telnet
set security zones security-zone untrust interfaces pp0.0 host-inbound-traffic system-services ping

หลัง config เสร็จ interface pp0.0 ได้รับ IP แต่ทำไม default route ไม่มา แก้ไขโดย กำหนด default route

set routing-options static route 0.0.0.0/0 next-hop pp0.0

หลังจากปรับ เสร็จ พบว่า เปิดเว็บไม่ได้บางเว็บ งง สิหล่ะงานนี้ แก้ไขโดย ปรับ tcp adjust mss สูตร mtu ลบ header 40 byte

set security flow tcp-mss all-tcp mss 1452

ตัวอย่าง show config บางส่วนข้างต้น

test@srx# show interface ge-0/0/1
description PPPOE_INTERFACE;
unit 0 {
encapsulation ppp-over-ether;
}
}

test@srx# show interface pp0
unit 0 {
description PPP_TO_TRUE_ADSL;
ppp-options {
pap {
access-profile ppp;
local-name "adslaccout@truehisp";
local-password "$9$P5T3CA0EclFnEy"; ## SECRET-DATA
passive;
}
}
pppoe-options {
underlying-interface ge-0/0/1.0;
auto-reconnect 30;
client;
}
family inet {
mtu 1492;
no-redirects;
negotiate-address;
}
}
}

test@srx# show security-zone untrust
screen untrust-screen;
interfaces {
pp0.0 {
host-inbound-traffic {
system-services {
ssh;
ping;
}
}
}
}
}

test@srx# show routing-options
static {
route 0.0.0.0/0 {
next-hop pp0.0;
}
}
}

test@srx# show security flow
tcp-mss {
all-tcp {
mss 1452;
}
}

Zone policy Vyatta

zone policy ของ Vyatta คล้ายๆ กับของ juniper SRX แฮะ 555

ruamit@vyatta# show zone-policy
zone DMZ {
interface eth3
}
zone local {
default-action drop
from trust {
firewall {
name from_internal
}
}
from untrust {
firewall {
name to-router
}
}
local-zone
}
zone trust {
default-action drop
description LAN_interface
interface eth2
}
zone untrust {
default-action drop
description WAN
from trust {
firewall {
name tcp-out
}
}
interface eth0
}
[edit]

Sunday, December 26, 2010

Vyatta PPPOE VPN and NAT with firewall protect wan

PPPOE interface WAN to internet

set interfaces ethernet eth0 address '192.168.1.100/24'

set interfaces ethernet eth0 duplex 'auto'

set interfaces ethernet eth0 hw-id '00:1c:23:00:69:4b'

set interfaces ethernet eth0 pppoe 0 default-route 'auto'

set interfaces ethernet eth0 pppoe 0 mtu '1492'

set interfaces ethernet eth0 pppoe 0 name-server 'auto'

set interfaces ethernet eth0 pppoe 0 password 'admintest'

set interfaces ethernet eth0 pppoe 0 user-id 'testpppoe@truehisp'

ruamit@vyatta# show interfaces

ethernet eth0 {

address 192.168.1.100/24

hw-id 00:1c:23:00:69:4b

pppoe 0 {

default-route auto

password admintest

user-id testpppoe@truehisp

}

NAT

set service nat rule 2 outbound-interface 'pppoe0'

set service nat rule 2 source address '172.16.0.0/24'

set service nat rule 2 type 'masquerade'

set service nat rule 20 description 'Port-Forword-PPTP_1723'

set service nat rule 20 destination port '1723'

set service nat rule 20 inbound-interface 'pppoe0'

set service nat rule 20 inside-address address '172.16.0.1'

set service nat rule 20 inside-address port '1723'

set service nat rule 20 protocol 'tcp_udp'

set service nat rule 20 type 'destination'

ruamit@vyatta# show service nat

nat {

rule 2 {

description NAT_POOL

outbound-interface pppoe0

source {

address 172.16.0.0/24

}

type masquerade

}

rule 20 {

description Port-Forword-PPTP_1723

destination {

port 1723

}

inbound-interface pppoe0

inside-address {

address 172.16.0.1

port 1723

}

protocol tcp_udp

type destination

}

Limit Bandwidth

set traffic-policy shaper 10m default bandwidth 10mbit

set traffic-policy limiter 5m default bandwidth 5mbit

set interfaces ethernet eth1 traffic-policy out 10m

set interfaces ethernet eth1 traffic-policy in 5m

ruamit@vyatta# show traffic-policy

limiter 5m {

default {

bandwidth 5mbit

}

shaper 10m {

default {

bandwidth 10mbit

}

[edit]

ruamit@vyatta# show interfaces ethernet eth1

address 172.16.0.1/24

description internal_network

hw-id 00:0c:29:00:9e:07

traffic-policy {

in 5m

out 10m

}

[edit]

ruamit@vyatta#

VPN PPTP

set vpn pptp remote-access authentication local-users username vyattaadmin password 'cisco123'

set vpn pptp remote-access authentication mode 'local'

set vpn pptp remote-access client-ip-pool start '172.16.0.100'

set vpn pptp remote-access client-ip-pool stop '172.16.0.110'

set vpn pptp remote-access dns-servers server-1 '203.144.207.49'

set vpn pptp remote-access outside-address '172.16.0.1'

ruamit@vyatta# show vpn

pptp {

remote-access {

authentication {

local-users {

username vyattaadmin {

password cisco123

}

mode local

}

client-ip-pool {

start 172.16.0.100

stop 172.16.0.110

}

dns-servers {

server-1 203.144.207.49

}

outside-address 172.16.0.1

}

set snmp

set service snmp community public authorization 'ro'

set service snmp community public client 172.16.0.100

ruamit@vyatta# show service snmp

snmp {

community public {

authorization ro

client 172.16.0.100

}

telnet ssh

ruamit@vyatta# set service telnet

ruamit@vyatta# set service ssh

set system login user nmc authentication plaintext-password nmc1234

set system login user nmc level 'operator'

set system login user ruamit authentication plaintext-password admin1234

set system login user ruamit level 'admin'

ruamit@vyatta# show system login

user nmc {

authentication {

encrypted-password $1$uaLO3jod$Dnzwb7CeYPvviNnjZTNgV0

plaintext-password ""

}

level operator

}

user ruamit {

authentication {

encrypted-password $1$KeWhiX1f$s2bnIdWba6bYDT8X8eVEa0

plaintext-password ""

}

NTP & timezone

set system time-zone 'Asia/Bangkok'

set system ntp-server 'time.navy.mi.th'

set system name-server '8.8.8.8'

set system name-server '8.8.4.4'

webproxy (only cache no filter)

set service webproxy cache-size '200'

set service webproxy default-port '8080'

set service webproxy 'disable-access-log'

set service webproxy listen-address '172.16.0.1'

ruamit@vyatta# show service webproxy

cache-size 200

default-port 8080

disable-access-log

listen-address 172.16.0.1 {

}

dynamic dns

set service dns dynamic interface pppoe0 service dyndns host-name 'ssl-vpn.dyndns-ip.com'

set service dns dynamic interface pppoe0 service dyndns login 'abcsd'

set service dns dynamic interface pppoe0 service dyndns password 'xxxxxx'

ruamit@vyatta# show service dns

dynamic {

interface pppoe0 {

service dyndns {

host-name ssl-vpn.dyndns-ip.com

password xxxxx

}

firewall filter on wan PPPOE

set firewall name to-external default-action 'accept'

set firewall name to-external rule 1 action 'drop'

set firewall name to-external rule 1 destination port '600-65535'

set firewall name to-external rule 1 protocol 'udp'

set firewall name to-external rule 1 source address '0.0.0.0/0'

set firewall name to-external rule 2 action 'drop'

set firewall name to-external rule 2 destination port '135,137-139,445'

set firewall name to-external rule 2 protocol 'tcp_udp'

set firewall name to-router default-action 'drop'

set firewall name to-router rule 1 action 'accept'

set firewall name to-router rule 1 destination port '22'

set firewall name to-router rule 1 protocol 'tcp'

set firewall name to-router rule 1 source address '117.121.208.0/24'

set firewall name to-router rule 2 action 'accept'

set firewall name to-router rule 2 description 'SSH'

set firewall name to-router rule 2 destination address '0.0.0.0/0'

set firewall name to-router rule 2 protocol 'icmp'

set firewall name to-router rule 2 source address '0.0.0.0/0'

set firewall name to-router rule 3 action 'accept'

set firewall name to-router rule 3 log 'disable'

set firewall name to-router rule 3 protocol 'all'

set firewall name to-router rule 3 state established 'enable'

set firewall name to-router rule 3 state invalid 'disable'

set firewall name to-router rule 3 state new 'disable'

set firewall name to-router rule 3 state related 'enable'

set firewall name to-router rule 4 action 'accept'

set firewall name to-router rule 4 description 'SNMP'

set firewall name to-router rule 4 destination port '161-162'

set firewall name to-router rule 4 protocol 'udp'

set firewall name to-router rule 4 source address '0.0.0.0/0'

set firewall name to-router rule 5 action 'accept'

set firewall name to-router rule 5 description 'PPTP'

set firewall name to-router rule 5 destination port '1723'

set firewall name to-router rule 5 protocol 'tcp_udp'

set interfaces ethernet eth0 pppoe 0 firewall local name 'to-router'

set interfaces ethernet eth0 pppoe 0 firewall out name 'to-external'

ruamit@vyatta# show firewall

name to-external {

default-action accept

rule 1 {

action drop

destination {

port 600-65535

}

protocol udp

source {

address 0.0.0.0/0

}

rule 2 {

action drop

destination {

port 135,137-139,445

}

protocol tcp_udp

}

name to-router {

rule 1 {

action accept

destination {

port 22

}

protocol tcp

source {

address 117.121.208.0/24

}

rule 2 {

action accept

description SSH

destination {

address 0.0.0.0/0

}

protocol icmp

source {

address 0.0.0.0/0

}

rule 3 {

action accept

log disable

protocol all

state {

established enable

invalid disable

new disable

related enable

}

rule 4 {

action accept

description SNMP

destination {

port 161-162

}

protocol udp

source {

address 0.0.0.0/0

}

rule 5 {

action accept

description PPTP

destination {

port 1723

}

protocol tcp_udp

}

send-redirects disable

syn-cookies disable

}

ruamit@vyatta# show interfaces ethernet eth0

address 192.168.1.100/24

hw-id 00:1c:23:00:69:4b

pppoe 0 {

default-route auto

firewall {

local {

name to-router

}

out {

name to-external

}

password admintest

user-id testpppoe@truehisp

}