Trace:

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
efw:settings [2017/11/08 11:03] – Bernard Condrauefw:settings [2025/07/30 15:57] (current) – [Phishtank] Bernard Condrau
Line 1: Line 1:
 ====== Settings ====== ====== Settings ======
  
-===== Settings ===== +===== Configuration =====
   - Run //Network configuration// in Menu **System**. Make sure you assign the correct red interface which is passed to the vm from the physical Server.   - Run //Network configuration// in Menu **System**. Make sure you assign the correct red interface which is passed to the vm from the physical Server.
   - //Edit hosts// in Menu **Network**. Add all hosts with static IPs here.   - //Edit hosts// in Menu **Network**. Add all hosts with static IPs here.
Line 12: Line 11:
   - Disable the Outgoing firewall in //Outgoing traffic//.   - Disable the Outgoing firewall in //Outgoing traffic//.
  
-==== Interesting articles ====+===== SSH Server ===== 
 +You need to enable the SSH Server to be able to login remotely without password. 
 +  - run ssh-keygen on your host 
 +  - copy the id_rsa.pub file to a USB stick, then attach the stick to the box, or use SCP file transfer 
 +  - copy the host's id_rsa.pub file to /root/.ssh/authorized_keys 
 +  - in the box' web interface, set __Allow public key based authentication__ only in //SSH access// in Menu **System**
  
-[[http://www.endian.com/fileadmin/documentation/efw-admin-guide/en/efw-admin-guide.html|Administrative Guide]]+===== Phishtank ===== 
 +You might want to disable phishtank to avoid false positives, for example on www.google.com 
 +  - Disable //Proxy --> DNS --> Anti-Spyware// in efw settings via web interface, then clear the proxy cache if proxy was enabled in //Proxy --> HTTP --> Cache-Management// 
 +  - Modify the script which downloads the malware definitions from phishtank, add the following before the script code:<code>vim /usr/local/bin/getblackholedns 
 +import sys 
 +sys.exit(0)</code>The script normally gets invoked once a day through an entry in /etc/anacron.daily. Removing that entry does not help, as it is reestablished after a reboot. 
 +  - Delete the malware definitions file, or modify the file to avoid the false positives:<code>rm /var/signatures/dnsmasq/phishtank.csv</code> 
 +  - Remove the content of the conf file for dnsmasq. This file will be overwritten at next reboot, but because of the missing phishtank.csv it will be empty, however, it's necessary for a successful start of dnsmasq:<code>vim /var/signatures/dnsmasq/blackholedns.conf 
 +:d9999d 
 +:wq</code>
  
-===== Firewall (iptables) =====+===== Firewall ===== 
 +==== SSH port forwarding ==== 
 +  * add hosts to be accessed from within the LAN to //Custom hosts// in menu //Network// 
 +  * port forwards from RED to GREEN work for hosts behind a fixed ip address on RED when accessed from LAN 
 +  * port forwards from RED to GREEN do not work for hosts behind a ddns ip address on RED when accessed from LAN. Make sure incoming and forward port range is the same to allow access from within the LAN. 
 +==== iptables ==== 
 +Check whether the firewall is set and hit on a specific port with:<code>iptables -t nat -L -v -n</code>
  
-Check whether the firewall is set and hit on a specific port with: +===== Links ===== 
-  iptables -t nat -L -v -n+  * [[http://www.endian.com/fileadmin/documentation/efw-admin-guide/en/efw-admin-guide.html|Administrative Guide]] 
 +  * [[http://www.yougetsignal.com/tools/open-ports/|Port Forwarding Tester]]
  
-Check open ports: http://www.yougetsignal.com/tools/open-ports/ 

Know How

© 2007-2025 Bernard Condrau - Powered by DokuWiki