lacrosse1991's questions

I'm trying to reach an HTTPS site from two different servers. On one server wget works perfectly fine, but on the other it will give an SSL related error. Are there any options that I could supply on the client side to get this working correctly?

Working Wget Version:

GNU Wget 1.12 built on linux-gnu.

+digest +ipv6 +nls +ntlm +opie +md5/openssl +https -gnutls +openssl
-iri

Wgetrc:
    /etc/wgetrc (system)
Locale: /usr/share/locale
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
    -DLOCALEDIR="/usr/share/locale" -I. -I../lib -O2 -g -pipe -Wall
    -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector
    --param=ssp-buffer-size=4 -m64 -mtune=generic -fno-strict-aliasing
Link: gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
    -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
    -fno-strict-aliasing -Wl,-z,relro -lssl -lcrypto
    /usr/lib64/libssl.so /usr/lib64/libcrypto.so -ldl -lrt ftp-opie.o
    openssl.o http-ntlm.o gen-md5.o ../lib/libgnu.a

Copyright © 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Nikšić <[email protected]>.
Currently maintained by Micah Cowan <[email protected]>.
Please send bug reports and questions to <[email protected]>.

Working Wget Output:

wget https://xxx.xxxxx.com/NodeBeanService/NodeBean?wsdl
--2017-03-21 15:12:43--  https://xxx.xxxxx.com/NodeBeanService/NodeBean?wsdl
Resolving xxx.xxxxx.com... xxx.xxx.xxx.xxx
Connecting to xxx.xxxxx.com|xxx.xxx.xxx.xxx|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/xml]
Saving to: “NodeBean?wsdl.1”

    [  <=>                                                                                                                                               ] 32,506      89.8K/s   in 0.4s

2017-03-21 15:12:44 (89.8 KB/s) - “NodeBean?wsdl.1” saved [32506]

Non-Working Wget Version:

GNU Wget 1.11.4

Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Niksic <[email protected]>.
Currently maintained by Micah Cowan <[email protected]>.

Non-Working Wget Output:

wget https://xxx.xxxxx.com/NodeBeanService/NodeBean?wsdl
--2017-03-21 15:04:53--  https://xxx.xxxxx.com/NodeBeanService/NodeBean?wsdl
Resolving xxx.xxxxx.com...xxx.xxx.xxx.xxx
Connecting to xxx.xxxxx.com|xxx.xxx.xxx.xxx|:443... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.

SSL Connection Info:

I'm trying to send an ssh command non-interactively to an HP automation server's proxy, and while I can ssh in and enter it interactively perfectly fine, I always get the message "exec request failed on channel 0" when attempting to send the command over non-interactively. Is there anything that I could change on the client side to allow me to send the command over? There's not much that I can change on the server side.

Apparently it's possible, but I just can't get it working on my install (see link: https://community.hpe.com/t5/Network-Automation-Practitioners/Is-there-a-way-to-issue-a-command-to-an-NA-proxy-using-SSH-non/m-p/6935003/highlight/false#M2821)

In case it would help, here are the version details for my OS and openssh version:

OpenSSH_7.2p2, OpenSSL 1.0.2j-fips  26 Sep 2016

NAME="openSUSE Leap"
VERSION="42.2"
ID=opensuse
ID_LIKE="suse"
VERSION_ID="42.2"
PRETTY_NAME="openSUSE Leap 42.2"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:42.2"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"

Thank you

I have exim4 configured on my server as an email forwarder (for example sending an email to [email protected] will result in the email being forwarded to my personal gmail email account).

This setup works perfectly fine, although things start to get annoying when I went to send an email directly from the server using mail. For some reason, mailx always uses @debian as its domain name. I can fix this by manually specifying the sender when using mailx (I usually just do something like echo "yo" | mailx -s "hi there" [email protected]), but that seems unnecessary as I'm able to send emails properly from a friend's server without having to specify the ender email address.

One thing I did notice is that I had forgotten to configure the /etc/hosts file when I initially created the server (had torn down a vps a rebuilt it). So I did that and reconfigured exim just be safe, but that did not have any effect.

Here is what I currently have in my update-exim4 file:

dc_eximconfig_configtype='internet'
dc_other_hostnames='NoneOfYourBusiness.org;NotForYourEyes.me'
dc_local_interfaces=''
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname='false'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

Would any have suggestions for correcting this behavior? Thank you

I am trying to setup a VM using Linux KVM for a F5 BIG-IP VE deployment (used in a lab) https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ve-kvm-setup-11-3-0/_jcr_content/pdfAttach/download/file.res/BIG-IP®_Virtual_Edition_Setup_Guide_for_Linux_KVM.pdf.

This VM requires 3 different network interfaces (management, external connection, and internal connection)

I have been trying to setup these connections in /etc/network/interfaces with the following configuration:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet dhcp
# This is an autoconfigured IPv6 interface
iface eth0 inet6 auto

auto br0
iface br0 inet dhcp
   pre-up ip tuntap add dev tap0 mode tap user root
   pre-up ip tuntap add dev tap1 mode tap user root
   pre-up ip tuntap add dev tap2 mode tap user root
   pre-up ip link set tap0 up
   pre-up ip link set tap1 up
   pre-up ip link set tap2 up
   bridge_ports all tap0 tap1 tap2
   bridge_stp off
   bridge_maxwait 0
   bridge_fd      0
   post-down ip link set tap0 down
   post-down ip link set tap1 down
   post-down ip link set tap2 down
   post-down ip tuntap del dev tap0 mode tap
   post-down ip tuntap del dev tap1 mode tap
   post-down ip tuntap del dev tap2 mode tap

Although whenever I go to configure the VM, only one of the tap interfaces will show up as being associated with the bridge. I spent 4-5 hours just trying to get those interfaces working and did not have any luck. What am I doing wrong here?

Is there a way to reboot a Linux system (Debian in particular) without rebooting the hardware?

I have a RAID controller that takes a bit to get itself running before the OS starts up, and I would like it if there was a way to quickly reboot the Linux OS without having to go through the whole reboot process of restarting the RAID controller, etc.

I ran across two entries in a linux routing table that both have the same destination, but have different gateways. How would this traffic be routed? I've been searching around online for additional information, as it seems like this type of setup would be common, although I am having a difficult time tracking down any information on this (might be wording it incorrectly). I am assuming that the route with a gateway of 12.12.12.12 would automatically be used, or would traffic be load balanced over the two routes instead?

11.11.11.11    12.12.12.12    255.255.248.0   UG        0 0          0 eth1
11.11.11.11    0.0.0.0         255.255.248.0   U         0 0          0 eth1

Thank you

Is there a way where I can prevent myself from being logged out of a cisco nexus switch/router (or any other cisco device) after a period of inactivity?

I get this message after being kicked off:

Inactive timeout reached, logging out.

I have the following in ~/.ssh/config (have tried specifying via command line flag as well:

Host *
  ServerAliveInterval 120

Which does not seem to do the trick as I am still logged out after 10-15 mins. If there is a way to do this, I would need to it via something on the client-side, not in the cisco configuration.

I recently noticed that BIND has been producing a large amount of logs in /var/syslog relating to one particular server (ezdns)

Jun  3 03:29:24 overlook named[6586]: success resolving 'ns0.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns4.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns4.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns2.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns2.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.ms/A' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns0.ezdns.pm/AAAA' (in 'ezdns.pm'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:26 overlook named[6586]: success resolving 'ns3.ezdns.yt/AAAA' (in 'ezdns.yt'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:26 overlook named[6586]: success resolving 'ns1.ezdns.pl/A' (in 'ezdns.pl'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns0.ezdns.it/AAAA' (in 'ezdns.it'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns1.ezdns.la/AAAA' (in 'ezdns.la'?) after disabling EDNS
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns0.ezdns.yt/AAAA' (in 'ezdns.yt'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:28 overlook named[6586]: success resolving 'ns0.ezdns.sx/AAAA' (in 'ezdns.sx'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:29 overlook named[6586]: success resolving 'ns5.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:29 overlook named[6586]: success resolving 'ns2.ezdns.pl/A' (in 'ezdns.pl'?) after disabling EDNS
Jun  3 03:29:30 overlook named[6586]: success resolving 'ns0.ezdns.sx/AAAA' (in 'ezdns.sx'?) after disabling EDNS
Jun  3 03:29:30 overlook named[6586]: success resolving 'ns0.ezdns.yt/AAAA' (in 'ezdns.yt'?) after disabling EDNS
Jun  3 03:29:31 overlook named[6586]: success resolving 'ns0.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:33 overlook named[6586]: success resolving 'ns0.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS

What can I do to prevent these logs from appearing? Why would this server be the only server that is causing BIND to produce these logs?

I've search around google and have found a few different solutions for hiding these logs, but I would like to know why this one server is so troublesome

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, for instance, if I ran "nano hello", it would log "nano" without the argument, but if I were log out and log back, "nano hello" would then show up in the auth log. Please see below for an example of what I am talking about

20. 16/03/14 07:01:05 113 0 ? 57 nano <^X> (user logs out and then in again)
21. 16/03/14 07:01:12 116 0 ? 57 bash ,,"nano hello",,,,

Is this normal behavior for pam tty audit?

I was wondering if there is a way to make screen display a message to a user when they attach to a screen session? For instance, if it is preferred that a user does not use a shared screen session for their personal activities "Please do not use this session for personal activities" could be displayed when the user attaches to the screen. I have tried putting an echo command in my screenrc file, but it did not result in anything being displayed (see below).

Thanks for your help, it is much appreciated!

for some reason I keep on getting the following log event repeatedly in my apache logs:

Jun 11 20:48:59 ruby apache_cvrugby_access_rsys: 77.78.104.50 - - [11/Jun/2013:20:48:58 -0400] "GET /server-status HTTP/1.0" 200 306923 "-" "-"

(with different times, etc, same ip though)

here is a screenshot of what I am talking about, though this has been going on all day so there is much more than what is shown:

Should I be worried about such activity (person sending requests may be up to no good, etc), or is this normal behavior? This is the first time I've seen such a thing in my logs. Thanks for your help!

I've recently noticed that my android phone (droid dna, although the thunderbolt that I had before did the same exact thing) is rapidly requesting dhcp info my dhcp server (isc-dhcp-server on debian squeeze). I had initially just thought it was the thunderbolt that was doing it, although I had recently noticed that the droid dna was doing the same thing. These 2 phones are the only things on the network that do this (only android phones afaik), nothing else ever does this. Right now the setup consists of the server which handles routing, dhcp, etc, which then connects to a 24 port switch (tplink, un-managed) which then goes to any ethernet connections and 2 linksys e4200 wireless routers as well (in bridge/ap mode). This happens every time the phone connects to the network. This also happens on a different network as well, which has dchp3-server, a dell powerconnect 8 port un-managed switch and a tplink 1043nd wireless router in access point mode. Here is a screenshot of the log activity itself:

My config file for the isc-dhcp-server consists of the following:

option domain-name "kingston.org";

subnet 192.168.1.0 netmask 255.255.255.0 {
max-lease-time 909200;
default-lease-time 604800;
#authoritative;
option routers 192.168.1.1;
option broadcast-address 192.168.1.210;
option domain-name-servers 192.168.1.1;
option subnet-mask 255.255.255.0;
 range 192.168.1.2 192.168.1.200;
 }

host duxbury {
  hardware ethernet 00:24:8c:ea:f0:7d;
    fixed-address 192.168.1.111;
}

host lancaster {
  hardware ethernet 00:21:5e:56:aa:a4;
      fixed-address 192.168.1.160;
}

Having said all of that, would anyone be able to offer any suggestions as to what I could do to help out with this issue or prevent it? I've honestly no clue what to do at this point in time and it is very irritating, thanks for your help!

edit:

also here are the lines that show up when I start the dhcp server (did not have a "lease time" setup for a while, the network probably has 12-15 devices devices active on average):

Mar 30 17:04:00 Kingston dhcpd: Wrote 0 deleted host decls to leases file.
Mar 30 17:04:00 Kingston dhcpd: Wrote 0 new dynamic host decls to leases file.
Mar 30 17:04:00 Kingston dhcpd: Wrote 88 leases to leases file.

in addition here is the output of brctl show (I have a wifi card that is setup with hostapd, though that is not currently active as it did not provide enough coverage, the two e4200's are setup on opposite sides of the house). Also the other network setup (the one with dhcp3-server, etc) does not use a bridge

bridge name     bridge id               STP enabled     interfaces
br0             8000.000d9d571396       no              eth1
                                                        wlan0

I am trying to find a reliable way to view all of the host/machine names on a local network, so for instance "Jim's Ipad" or "Austi's IMac". At the moment the only way I can do it is by looking through the dhcp request logs which usually shows the names, although I was wondering if there was a way to simply list all of the names on a network at once? I've tried nmap -sP 192.168.1.*, which only seemed to give the manufacturer of the machines instead of the actual machine/domain name:

MAC Address: 00:1D:BA:40:14:31 (Sony)
Host 192.168.1.109 is up (0.00073s latency).
MAC Address: 00:50:94:C8:1C:02 (Pace Micro Technology PLC)
Host 192.168.1.111 is up (0.00011s latency).
MAC Address: 00:24:8C:EA:F0:7D (Asustek Computer)
Host 192.168.1.112 is up (0.0054s latency).
MAC Address: 00:18:71:5C:D2:BA (Hewlett Packard)
Host 192.168.1.117 is up (0.0049s latency).

I've also tried tried nmap -sL 192.168.1.*, which does not seem to work at all, it just lists all of the IPs and says they are not scanned, no additional information or anything of the sort. I am running these commands from a debian server that is acting as a router/gateway for the network. Any help would be much appreciated, thanks!

I am trying to block all traffic that is both coming and going to an internal IP address (this server acts as a router for the network). so far I have tried the following: iptables -A INPUT -s 192.168.1.111 -j DROP & iptables -A OUTPUT -d 192.168.1.111 -j DROP, with 192.168.1.111 being the IP address I am trying to block traffic from. The local area network connects to br0. Here is my current iptables setup (I've removed port forwards, etc to make it easier to go through):

# Generated by iptables-save v1.4.8 on Sat Feb 16 21:21:16 2013
*nat
:PREROUTING ACCEPT [184556:41149689]
:POSTROUTING ACCEPT [13698:835740]
:OUTPUT ACCEPT [77252:6378101]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Feb 16 21:21:16 2013
# Generated by iptables-save v1.4.8 on Sat Feb 16 21:21:16 2013
*filter
:INPUT DROP [10054:2687428]
:FORWARD ACCEPT [1377:76856]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 192.168.1.0/24 -i br0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -s 127.0.0.1/32 -j ACCEPT
-A FORWARD -i eth0 -o Br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
COMMIT
# Completed on Sat Feb 16 21:21:16 2013

How could I go about blocking all traffic to and from an IP with this current setup? Im not the best in the world with iptables, so any help would be much appreciated, thanks!

I have a debian server that acts as a router for a network, and I am planning on making it so I am able to block network access for certain computers, what do you think would be the best way to do it? I was thinking mac address filtering, although that could be spoofed. I was also thinking of IP filtering, but that could be avoiding just as easily. A few pages on google suggested doing something with arp tables, but im not sure how to go about doing that. Any help is much appreciated, thanks!

I am trying to setup stunnel to encrypt traffic from rsyslog (using the relp protocol), but whenever I try starting stunnel and sending logs to the remote server, i get the following:

    Remote socket (FD=13) closed
    Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Local socket (FD=3) closed
    Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Service [ssyslog] finished (0 left)
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316320512]: Service [ssyslog] accepted (FD=3) from 127.0.0.1:42481
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Service [ssyslog] started
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Waiting for a libwrap process
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Acquired libwrap process #0
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Releasing libwrap process #0
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Released libwrap process #0
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Service [ssyslog] permitted by libwrap from 127.0.0.1:42481
Feb 15 01:25:55 ruby stunnel: LOG5[26750:140598316271360]: Service [ssyslog] accepted connection from 127.0.0.1:42481
Feb 15 01:25:55 ruby stunnel: LOG6[26750:140598316271360]: connect_blocking: connecting 98.235.203.58:60514
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: connect_blocking: s_poll_wait 98.235.203.58:60514: waiting 10 seconds
Feb 15 01:25:55 ruby stunnel: LOG5[26750:140598316271360]: connect_blocking: connected 98.235.203.58:60514
Feb 15 01:25:55 ruby stunnel: LOG5[26750:140598316271360]: Service [ssyslog] connected remote server from 78.46.65.138:43235
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: Remote socket (FD=13) initialized
Feb 15 01:25:55 ruby stunnel: LOG7[26750:140598316271360]: SNI: host name: xx.xx.xx.xx
Feb 15 01:25:55 ruby stunnel: LOG3[26750:140598316271360]: SSL_connect: Peer suddenly disconnected
Feb 15 01:25:55 ruby stunnel: LOG5[26750:140598316271360]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket

over and over again in rapid succession, would anyone know how I could figure out what is causing this to happen? I've been trying to figure this out for the last few hours, but have not clue what to do at this points

I am trying to setup snort to act as an ids, on a debian machine that also functions as a router. Ideally I would like to setup snort in such a way so that I would not have to purchase an additional network adapter just to have it listen to the same traffic that the debian machine is already handling. Having said that, what would be the best way to mirror traffic from an interface, and then send the mirrored traffic over to snort? Or would you recommend that I go along a different route? I was thinking a bridge could possibly work, but I am not sure if that would be the correct solution, any help would be appreciated, thanks!

I currently have a debian server that is running an openvpn server. I also have a dns server (bind9) that I would like give allow access to by the connected openvpn clients, but I am unsure as of how to do this, I already known how to send dns options to the clients using

push "dhcp-option DNS x.x.x.x"

but I am just unsure how give the clients access to the dns server that is located on the same machine as the vpn server, so if anyone could point me in the right direction I would really appreciate it. Also in case this would have anything to do with adding rules to iptables, this is my current configuration for iptables

# Generated by iptables-save v1.4.14 on Thu Oct 18 22:05:33 2012
*nat
:PREROUTING ACCEPT [3831842:462225238]
:INPUT ACCEPT [3820049:461550908]
:OUTPUT ACCEPT [1885011:139487044]
:POSTROUTING ACCEPT [1883834:139415168]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Oct 18 22:05:33 2012
# Generated by iptables-save v1.4.14 on Thu Oct 18 22:05:33 2012
*filter
:INPUT ACCEPT [45799:10669929]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45747:10335026]
:fail2ban-apache - [0:0]
:fail2ban-apache-myadmin - [0:0]
:fail2ban-apache-noscript - [0:0]
:fail2ban-ssh - [0:0]
:fail2ban-ssh-ddos - [0:0]
:fail2ban-webserver-w00tw00t - [0:0]
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-myadmin
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-webserver-w00tw00t
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-noscript
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fail2ban-apache -j RETURN
-A fail2ban-apache-myadmin -s 211.154.213.122/32 -j DROP
-A fail2ban-apache-myadmin -s 201.170.229.96/32 -j DROP
-A fail2ban-apache-myadmin -j RETURN
-A fail2ban-apache-noscript -j RETURN
-A fail2ban-ssh -s 76.9.59.66/32 -j DROP
-A fail2ban-ssh -s 64.13.220.73/32 -j DROP
-A fail2ban-ssh -s 203.69.139.179/32 -j DROP
-A fail2ban-ssh -s 173.10.11.146/32 -j DROP
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-ddos -j RETURN
-A fail2ban-webserver-w00tw00t -s 217.70.51.154/32 -j DROP
-A fail2ban-webserver-w00tw00t -s 86.35.242.58/32 -j DROP
-A fail2ban-webserver-w00tw00t -j RETURN
COMMIT
# Completed on Thu Oct 18 22:05:33 2012

also here is my openvpn server configuration

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group users
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
push "redirect-gateway def1"
push "dhcp-option DNS 213.133.98.98"
push "dhcp-option DNS 213.133.99.99"
push "dhcp-option DNS 213.133.100.100"
client-to-client

I was wondering if it possible to setup local area network domain names, so for instance if I asked for local-server.org, the dns server would automatically send me to 192.168.1.111 (it would "take over" if there is actually a local-server.org out on the internet). I would imagine that I would do this through bind (bind9 to be exact), but im not sure how to go about doing it unfortunately