Astron's questions

In AWS we have 3 instances in the same subnet/VPC. We would like to have the client instance make a DNS request to a second analysis instance, which will then forward the request to a third instance running a DNS service. The DNS service should then provide a response to the analysis instance, which should then respond to the client.

The purpose is so the Analysis instance can intercept the traffic between the Client and DNS instances for analysis purposes.

Client instance -> Analysis instance (NAT) -> DNS instance

The current setup allows the Client instance to send a DNS request through the Analysis instance to the DNS instance. The DNS instance responds to the Analysis instance per tcpdump but the Client instance never receives a response from the Analysis instance.

We have source/destination checks in AWS for the Analysis instance performing NAT turned off.

We first enabled forwarding on the Analysis instance:

sudo sysctl -w net.ipv4.ip_forward=1

We then add the following IPTables rules to the Analysis instance

sudo iptables -A FORWARD -p udp --dport 53 -d 192.168.1.151 -j ACCEPT
sudo iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination 192.168.1.151
sudo iptables -t nat -A POSTROUTING -d 192.168.1.151 -s 192.168.1.156 -p udp --dport 53 -j SNAT --to 192.168.1.213

Other POSTROUTING rules such as the following were tried as well

sudo iptables -t nat -A POSTROUTING -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -p udp -d 192.168.1.151 --dport 53 -j SNAT --to-source 192.168.1.213
sudo iptables -t nat -A POSTROUTING -p udp -d 192.168.1.151 --dport 53 -j MASQUERADE

All with the same result, Client instance never receives a DNS answer. Thoughts on what might be preventing the analysis instance from returning a response?

Existing functionality: try_files along with rewrite are being used to allow requests for foo.html and foo/ to redirect to foo.

Problem: If I specify try_files $uri.html $uri @noextension =404;, then a request to domain.com/ redirects to a 404 page but a request to domain.com/index works.

Problem 2: If try_files $uri.html $uri @noextension /index.html is used instead, the site root will return but requests for non-existent pages will also redirect to the site root instead of a 404 error.

Problem 3: The following also results in requests to / failing but /index working:

location / {
    try_files $uri @noextension;
}

# redirect /foo/ to /foo
rewrite ^(/.+)/$ $1 permanent;
# redirect /foo.html to /foo
rewrite ^(/.+)\.html$ $1 permanent;

location ~ \.html$ {
    try_files $uri =404;
}

All of the other site pages are fine, only requests to the site root are affected. How might I go about getting the index and 404 pages to correctly respond?

server {
    listen       80;
    server_name  localhost;

    root   /usr/share/nginx/html;
    index  index.html;

    location / {
        try_files $uri.html $uri @noextension =404;
    }

    # redirect /foo/ to /foo
    rewrite ^(/.+)/$ $1 permanent;
    # redirect /foo.html to /foo
    rewrite ^(/.+)\.html$ $1 permanent;

    location @noextension {
        # allow for domain.com rather then domain.com/index to respond
        rewrite ^(.*)$ $1.html last;
    }

    error_page  404              /404;

Nginx is returning the site root index instead of a 404 response for non-existent files, i.e. attempting to rewrite files that do not exist which is undesired. While I see the topic was answered here, I do not see how it applies to my configuration and thought using IF statements in Nginx is evil?

The object of this is to redirect /bar.html and /bar/ requests to /bar. The data being served are from bar.html. A request for /bar.random will return the sites /index.html content instead of a 404. A request for a file that does not exist should return a 404 error page.

root   /usr/share/nginx/html;
index  index.html;

location / {
    try_files $uri $uri.html /index.html @extensionless-html =404;
}

rewrite ^(/.+)/$ $1 permanent;
rewrite ^(/.+)\.html$ $1 permanent;

location @extensionless-html {
    rewrite ^(.*)$ $1.html last;
}

I have also tried the following which resulted in the same reponse:

location / {
    try_files $uri $uri.html /index.html @extensionless-html =404;

if (-f $request_filename) {
    # redirect /foo/ to /foo
    rewrite ^(/.+)/$ $1 permanent;
    # redirect /foo.html to /foo
    rewrite ^(/.+)\.html$ $1 permanent;
}
}

location @extensionless-html {
    rewrite ^(.*)$ $1.html last;
}

Is it possible to setup a server with a host-based adapter (HBA) directly to a Dell/EMC CX3-40f disk-array enclosure (DAE) which only has fiber connections, taking the storage-processor out of the equation? Would something like Openfiler have this capability? Can it be done without Openfiler?

Note sure how the drives could be provisioned for RAID but even having direct access to the drives could be useful for OpenStack or similar.

For example, have a host with two dual-port fiber-channel (FC) cards, connect to four-SPE's therefore giving that host access to 60 drives (15/SPE).

Does iptables have the ability to specify first or last matching on rules? If so how?

Secondly, when rules are specified, is there an implicit drop, or does the following only provide that functionality?

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

I am having trouble port-forwarding on an Cisco ASA from a host on the internet to a host on the internal network. The outside interface of the ASA is assigned via DHCP. Is there something else that has to be done in order to make this work correctly?

update to problem

(outside) to (outside) source dynamic VPN_NETWORK interface

per:

https://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_rules.html

(outside) to (outside) after-auto source dynamic VPN_NETWORK interface

packet-tracer:

# packet-tracer input outside tcp 74.x.x.x 1025 71.x.x.x 555

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   71.x.x.x    255.255.255.255 identity

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

running-config

ASA Version 8.4(2) 
!
hostname asa
enable password ***** encrypted
passwd ***** encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.16.1.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute 
!
boot system disk0:/asa842-k8.bin
ftp mode passive
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network VPN_NETWORK
 subnet 192.168.1.0 255.255.255.192
object network VM
 host 172.16.1.100
access-list dynamic-filter_acl extended permit ip any any 
access-list VM-IN extended permit tcp any host 172.16.1.100 eq 555 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPN-DHCP-POOL 192.168.1.10-192.168.1.50
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645-206.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static any any destination static VPN_NETWORK VPN_NETWORK no-proxy-arp route-lookup
nat (outside,outside) source dynamic VPN_NETWORK interface
!
object network obj_any
 nat (inside,outside) dynamic interface
object network VM
 nat (inside,outside) static interface service tcp 555 555 
access-group VM-IN in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL 
aaa authentication ssh console LOCAL 
http server enable
http 172.16.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto ikev1 enable inside
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 172.16.1.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
console timeout 0

dhcp-client client-id interface outside
dhcpd auto_config outside
!
dhcpd address 172.16.1.100-172.16.1.200 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd option 3 ip 172.16.1.1 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-filter enable interface outside classify-list dynamic-filter_acl
dynamic-filter drop blacklist interface outside 
ssl encryption des-sha1
webvpn
group-policy EdgeAccess internal
group-policy EdgeAccess attributes
 dns-server value 8.8.8.8 8.8.4.4
 vpn-tunnel-protocol ikev1 
username user password ***** encrypted
tunnel-group EdgeAccess type remote-access
tunnel-group EdgeAccess general-attributes
 address-pool VPN-DHCP-POOL
 default-group-policy EdgeAccess
tunnel-group EdgeAccess ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
privilege show level 0 mode configure command filter
privilege cmd level 0 mode configure command filter
privilege cmd level 0 mode config-group-webvpn command filter
privilege cmd level 0 mode config-username-webvpn command filter
prompt hostname context 
no call-home reporting anonymous
: end

McAfee VirusScan is not retaining settings that are specified in the client for more than roughly five minutes, for example, I have enabled prevent mass mailing worm but after a short time has passed and the interface is reopened, the settings are unchecked. The client does obtain updates and configuration parameters from ePO, does that mean that setting specified in the clients will not remain permanent.

Is there a way to determine the policy setting via command line or some other means on the client to determine if ePO is pushing out a requirement not to retain settings?

Is there a way to include the Special:AllPages on another MediaWiki page, i.e. I would like to list Special:AllPages at the bottom of the main page.

I would like to specify the date via CLI when running robocopy so that the destination folder includes the date.

robocopy C:\folder\ Z:\folder_DATE /E /ZB /COPYALL /NP /V /LOG:F:\backup_log.txt

Where DATE is the current date. Is this possible or would I have to resort to power shell?

I found this Stack Overflow article but am looking to keep it simpler.

Currently the NAT host and respective clients are able to access any service. I like the NAT host (the device running IPTABLES) to only be able to access HTTP(S), DNS and send/respond to ICMP requests.

I would like the internal clients behind $INTIF to only access HTTP(S) and DNS. I tried multiport but I had little luck. I'm open to other suggestions.

*nat
-A POSTROUTING -o "$EXTIF" -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -p tcp -i eth1 --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT
-A INPUT -i "$INTIF" -p udp --dport 53 -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "input denied: " --log-level 7

-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -m multiport -p tcp --dports 80,443 -j ACCEPT
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "forward denied: " --log-level 7

-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "output denied: " --log-level 7
COMMIT

How can I allow HTTP access to $EXTIF?

*nat
-A POSTROUTING -o "$EXTIF" -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0] #If this is changed to DROP than clients cannot connect out.
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -j LOG
-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -j LOG
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -j LOG
COMMIT