cola's blog

Generally Useful Iptables Rules

2017-03-05T02:21:00.000+08:00

This section includes a variety of iptables commands that will create rules that are generally useful on most servers.

Allow Loopback Connections

To accept all traffic on your loopback interface, run these commands:

sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT

Allow Established and Related Incoming Connections

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow Established Outgoing Connections

sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

Internal to External

sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Drop Invalid Packets

sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Block an IP Address

sudo iptables -A INPUT -s 15.15.15.51 -j DROP

In this example, -s 15.15.15.51 specifies a source IP address of "15.15.15.51". The source IP address can be specified in any firewall rule, including an allow rule.

If you want to reject the connection instead, which will respond to the connection request with a "connection refused" error, replace "DROP" with "REJECT" like this:

sudo iptables -A INPUT -s 15.15.15.51 -j REJECT

Block Connections to a Network Interface
iptables -A INPUT -i eth0 -s 15.15.15.51 -j DROP

This is the same as the previous example, with the addition of -i eth0. The network interface can be specified in any firewall rule, and is a great way to limit the rule to a particular network.

Service: SSH
Allow All Incoming SSH

To allow all incoming SSH connections run these commands:

sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

The second command, which allows the outgoing traffic of established SSH connections, is only necessary if the OUTPUT policy is not set to ACCEPT.
Allow Incoming SSH from Specific IP address or subnet

sudo iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

The second command, which allows the outgoing traffic of established SSH connections, is only necessary if the OUTPUT policy is not set to ACCEPT.
Allow Outgoing SSH

sudo iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Incoming Rsync from Specific IP Address or Subnet

sudo iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT

The second command, which allows the outgoing traffic of established rsync connections, is only necessary if the OUTPUT policy is not set to ACCEPT.

Service: Web Server

Allow All Incoming HTTP

sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming HTTPS

sudo iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming HTTP and HTTPS

sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Service: MySQL
Allow MySQL from Specific IP Address or Subnet

sudo iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow MySQL to Specific Network Interface

sudo iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

PostgreSQL from Specific IP Address or Subnet

sudo iptables -A INPUT -p tcp -s 15.15.15.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow PostgreSQL to Specific Network Interface

sudo iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Service: Mail
Block Outgoing SMTP Mail

sudo iptables -A OUTPUT -p tcp --dport 25 -j REJECT

Allow All Incoming SMTP

sudo iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Note: It is common for SMTP servers to use port 587 for outbound mail.
Allow All Incoming IMAP

sudo iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming IMAPS

sudo iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming POP3

sudo iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow All Incoming POP3S

sudo iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Good luck!

BGP Neighbor States

2016-11-14T11:21:00.003+08:00

- idel

The BGP process either administratively down or awaiting the next retry attempt.

- Connet

The BGP process process is waiting for the TCP connection to be completed. You can not determine from this state information whether the TCP connection can complete.

- Active

The TCP connection has been completed, but no BGP message had been yet sent to your peer

- Opensent

The TCP connection exist, BGP Open message has been sent to the peer, but the matching Open message has not yet been received from the other router.

- Openconfirm

An Open message has been both sent to and received from the other router. The next step is to receive a BFP Keepalive message(to confirm that all neighbor-related parameters match) or a BFP Notification message (to learn that there is some mismatch in neighbor parameters).

- Established

All neighbor parameters match, the neighbor relationship works, and the peers can now exchange Update messages.

Four Year Later.

2016-11-14T11:18:00.000+08:00

I have leave this board for about four year.
Four year before I was working as primary school and study at night. That was a hard period. After study I have quit my school job. I joined for a telecommunication vendor job. Another hard period....
After another two year, I change job again. From past year and half I had worked at next media and now at Gameloft.
Looking forward to me to create better life.

I think I need spend more time for study English. More writing in both Chinese and English. This Gameloft is such a relax working place.

Things to do

2012-09-10T13:47:00.002+08:00

為這次的工作留一個紀念品(正在進行)
為我的學習申請留一個紀念品(正在進行)
重考及更我的証書及報讀新的証書及牌照。這個還未在做

暫時就想到這些，以後再想到就讓我再加上去吧

First Summer Semester at Part time university

2012-06-01T16:35:00.000+08:00

The 2nd of June 2012 this is the summer semester if my study at city University of my topup degree course. This following 12 week i will study for two subject, one of the subject. The Business subject need to work a individual report, This report weight for 100% of the Business subject. I have to hard for it, this is the first time for my study without examination. However my writing skill is regress. I have to do more reading and write for more.

個人網頁。

2012-05-07T13:25:00.000+08:00

其實Blogger也算是個人網頁的一種，真的不用每次都用到全都是完原的才會叫做擁有一個個人的網頁的。Blogger是個個人網誌的一類，它前身是blogger後來給Google收購了現在是Google下的其中一個服務。使用Google 的服務其中一個好處是你只需要使用你的谷歌賬戶就可以用到當中的全套服務了。所以我選擇了這裏Blogger作為我的網誌。如果我要是真的使用像wordpress樣的來架一個網誌的話，我最需要都可能是一個可以長開的伺服器以及一直在線的網絡。要做到這的都需錢，而且自行架設的網誌都不會像Blogger 樣的容易給搜索得到的。

所以我認為，如果沒有特別需要的話都是使用人家的專門服好了！

每天都有的瀏覽人次

2012-03-22T13:50:00.002+08:00

一段時間沒有再作更新了，而且連這裏的控制面版都沒有進來。
整個的blogger都變得有點陌生了，發現這裏每天都會有一到兩次的點擊。
這些是甚麼人來的呢？我不知道。但我的寫作技巧都在退步中…
本來都不是很好的而再在這樣的退步，會不會連小學生的寫水平都比我的好呢？

農曆新年的假期

2012-01-14T22:37:00.000+08:00

三天的農曆新年公眾假期已經過了，
Wrote the start of this essay and save for this line for few month, i have no idea what i am thinking three month ago. i forgot what i have did this Chinese New Year. Just forget about it.
For the holiday of my work place, i have to sleep for a day.
This year i have to go for learn at the 初六.

又再一次要開始了

2012-01-04T21:18:00.002+08:00

一個原本很好的sem break 一早的計劃，原來說好的休息全都給破壞了。
現在還有幾天我的semB又要開始了，接下來的幾個月我都會很忙，很辛苦的呢。
上帝求祢給我力量，智慧…Amen
這幾個月我可以捱過去嗎？
還希望得到大家的支持…

從前的我，現在的我…

2012-01-02T21:31:00.001+08:00

離開學習一年了，回想起以前的一些事情，
自己的存在問題等等，自己在一直使用的blogger也有好一段時間沒有再到這裡更新了。
因為我覺得我自己一直所做的都好像是白費的，根本就沒有人在看我自己的東西「包括我自己」。
EVA、高達、One piece等一些我自己以前看過的追過的，以前所看所喜歡的現在都好像給我放下來了。不知道從甚麼時候開始我好像所有的東西都感不到興趣了。

我的表達能不太好，很多事情我都不能清楚的給人作出正確的解釋，而且我都好像有一段時期沒有使用我的語言技巧及寫作技巧了，開始覺得自己的一些表達的能力都開始衰退了。

自動定位鈴聲靜音

2011-12-31T22:01:00.001+08:00

你有沒有嘗試過在一個安靜的地方如圖書館、辦公室時有來電？然而你卻已經忘記開啓您的手機靜音？你有沒有接到一些惱人的人來電，而影響到你的家人？你有沒有錯過一些重要來電，因為你忘記了取消您的手機靜音嗎？其結果可能會很麻煩。

‘自動定位鈴聲靜音’是你最簡單的解決方案。你只需要在應用程序中維護一份電話號碼黑名單，並在地圖上標記你指定的有效的位置，然後，這個應用程序便會為你做後續的工作。

這個程序會自動攔截來電，並驗證來電號碼是否出現於黑名單中。此外，它會比較您當前的位置與您的預設位置。如果滿足到這兩個條件，手機鈴聲將被即時靜音。你可選擇黑名中的個別電話號碼單是否開啓振動。當電話掛斷後，系統鈴聲會自動恢復。這個程序不會改變任何現有有關聯絡人和鈴聲的設置。當有需要時，您可以很容易地用一個主開關停用或重新啟用這個程序。

PS：這個應用程序不長期駐留在內存。因此，這是沒有必要讓你最的任務管理器上作特別處理。此外，它也不會用到硬件GPS，所以電池的消耗是很小的。

Download

GS2 VOICE CALL Volume

2011-12-22T16:48:00.001+08:00

Enter this number *#*#197328640#*#*#*
This will open the service mode menu.
Select option [5] AUDIO
Select option [1] (VOICE CALL)
Select option [1] HANDSET(聽筒) / [2] HEADSET(耳機)
Select option [1] Volume
Select option [1] SRC Speech RX Volume
Select option [5] 5_lvl : XX
Press the menu button (left side)
Choose Key Input
Enter a value between 0 and 100, with 100 the loudest setting.
Press ok
Then press the menu button and select back this will save (don't use the right side back key you normally use to navigate the phone or you will quit out of the settings).
Keep selecting the menu and back until you exit the service mode menu.

KNIGHTS OF CYDONIA LYRICS

2011-12-22T15:59:00.001+08:00

Come ride with me
Through the veins of history
I'll show you how god
Falls asleep on the job

And how can we win
When fools can be kings
Don't waste your time
Or time will waste you

No one's gonna take me alive
The time has come to make things right
You and I must fight for our rights

You and I must fight to survive

No one's gonna take me alive
The time has come to make things right
You and I must fight for our rights
You and I must fight to survive

No one's gonna take me alive
The time has come to make things right
You and I must fight for our rights
You and I must fight to survive

moomin II

2011-12-20T15:41:00.002+08:00

The warm winter with love

Grand Theft Auto III

2011-12-19T14:35:00.003+08:00

Welcome to Liberty City. Where it all began.

Rockstar Games celebrates the 10th anniversary of one of the most influential games of all time. The critically acclaimed blockbuster Grand Theft Auto III comes to mobile devices, bringing to life the dark and seedy underworld of Liberty City. With a massive and diverse open world, a wild cast of characters from every walk of life and the freedom to explore at will, Grand Theft Auto III puts the dark, intriguing and ruthless world of crime at your fingertips.

With stellar voice acting, a darkly comic storyline, a stunning soundtrack and revolutionary open-world gameplay, Grand Theft Auto III is the game that defined the open world genre for a generation.

Grand Theft Auto III is now available on:
Android Phones: HTC Rezound, LG Optimus 2x, Motorola Atrix 4G, Motorola Droid X2, Motorola Photon 4G, Samsung Galaxy R, Samsung Galaxy S2, Sony Ericsson Xperia Play, T-Mobile G2x
Android Tablets: Acer Iconia, Asus Eee Pad Transformer, Dell Streak 7, LG Optimus Pad, Motorola Xoom, Samsung Galaxy Tab 8.9 and 10.1, Sony Tablet S, Toshiba Thrive
Coming soon to Samsung Galaxy Nexus

Features:
· Visually stunning updated graphics, character and vehicle models

* HD quality resolution
* Gameplay optimized for touch screen devices
* Custom controls for the mobile platform
* Countless hours of gameplay
* Gamepad Support for select USB controllers

Port developed by War Drum Studios
http://www.wardrumstudios.com

Download

點擊率

2011-12-18T15:50:00.000+08:00

重新改了我的blogger用了一個新的底色，(其實是星期五改的)
一些ADsense都成功的在運作了…
星期五因為在改這個的面板令到這個點擊數都多了，但好像都是我自己的到訪…
(以前不是不會計自己的到訪的嗎？)

Galaxy Nexus

2011-12-16T17:30:00.002+08:00

Galaxy Nexus 已經在早前幾天在香港可以購買得在，我都在這天買了一支，現在的感覺都良好。相機的速度如廣告所說的一樣的快速，UI方面都和之前所用過的Android很不同，需要時間去適應，使用上都有明顯的進步。最令我興奮的就是原生的NFC support(不明白Google都推出了兩部NFC的手機但其他的廠都是沒有)不過在香港NFC的功能就只是用作market上的八達通reader這個真令我(百看不厭)一方面可以說是方便，一這個apps更發輝了NFC在香港小有的作用！

moomin

2011-12-16T13:00:00.001+08:00

.
姆明是真的lillprinsBus們的最愛！他有一個動物標本，繪畫，睡衣和書籍。他將聽取 intort看電影一而再，再而唱快樂！里爾從來沒有顯示，在兒童節目或電視都絲毫興趣，幾次我們試圖和我們有很少的時候，他是軟化下去，但前段時間我把一個在YouTube姆明電影剪輯，他一直在尋找悄悄地為15分鐘，偶爾會指著屏幕說：“MUNE，MUNE”！（Mumin，姆明）所以現在我們有兩個姆明電影裡，我們會盡力的到來。我覺得這很有趣，他很喜歡 Moomins時我也想到了非常精緻的小巨魔！
Everyday fine!

HKEPC

2011-12-15T10:04:00.003+08:00

昨天上了HKEPC問了我的難題，但換來的答複就是有點答非所問

多數人都是在落井下石，而最令人驚雅的就更是多數我覺是幫我的都是那些初級會員，

而那些高級會員，不知是因為他們不會怕被投訴的呢，最奇怪的更是那些版主級的人也在留下一些沒帶關係的言論。這是不是這個網站正在死忘呢！

好奇怪，一個在我中學時期所經常到的網站。當年的我也是一個不懂表達自己的人，是一個完全都不知自己所想的人，看到有人看過自己所問的，所想的，所寫的都有人在看，有人在回答自己，感覺自己再不是自己一個，自己的存在感都回來了。

現在也在變得太過沒人情味了，可能當年的我並不知道甚麼是人情味，在我的文章裏有人作出回複就覺得有人留意我，令我感到一時的快樂。想回來，那個網站的人都只是會說說笑，從來都沒有覺得他們有認真過，我從來就可能不應該在那個地方認真，而我可能在另一些應該認真的地方而沒有認真。這可能是我這些年來最遺憾的呢…
記得數年前在這個HKEPC中的的爭執，而有人就是惡人先告狀，但那人和那人的分身都得到這個網站的管理員幫着，對我就作出無理的處罰我。那件事令我覺得他們只是自己圍內的人互相勾結，只為錢作怪，討論區只是一個假的平台，那些所謂的管理員只幫那些人在找大倍份"會員"的着數，賣假耳機等所有事都不了了之。而大倍份人都沒有去指証他們，難怪那些高的人都這樣討厭他們呢…

最近這些事以後，我學到了我應該在任何事上都要更加小心，不可以懶惰，可能我會因為太累而有所鬆懈，但我都要盡自己的努被免再成為欺凌的對象…

SDM 10%going

2011-12-06T20:09:00.001+08:00

reviewing of the SDM for examination current one out of ten to go.

trouble is leaving on by one

2011-12-04T22:02:00.001+08:00

Form last Saturday i have receive many of trouble and today i have solve some of these trouble.
but there still two of trouble need to be solve, the first and the priority is my examination in my school. This being trouble is that last saturday i didn't have opportunity to maintenance for my summarize revision on my class, that is the second trouble to affect it. Furthermore the second trouble is i have slander by the police, last saturday i have some accident in the sopping mall, the staff help me to call the emergent service, however there have some police in here, they are working on investigate a fight case(they didn't tole me) three of they are follow me to the hospital and they slander me were the guy who fight in the shopping mall. I have no idea, but he said if i not sign on his i may go to jail. I didn't have choose and i sign on it.
I didn't have idea to doing on this.

二零一一年十一月二十六日

2011-11-30T21:47:00.001+08:00

學會原諒別人，也是給自己機會。
這道理我深深的體驗到！

希望我今次被屈的事可以平安的過渡吧！
Amen

deadline

2011-11-15T23:19:00.001+08:00

多份project 都接近deadline這個星期我都在一直的做着這些的功課，還有individual的也要做呢，但是這些的進度都是十分的慢呢。

今天的晚上我開始了做我的individual work 但是我只是做了開頭，看來我都是要明天用一天時間來想一想如何下筆吧。

希望自己一切都順利吧！

生日周

2011-11-04T20:46:00.002+08:00

今個星期是我的生日周，因為我的生日是我的十一月二日而這天剛好是我要到醫院複診的日期，感覺良好。

今個星期一我返工做嘢事覺得我的手開始有點不協調，我的手在打中文和英文的速度都有所下降，一直到今天都是這樣呢！我也不知點算好呢。
星期一收工時，媽媽今天放假，也是她的生日呢，所以這天晚上我們上街吃！(開心)

星期二…我本想今天要帶小朋友出外打羽毛球的，我到了運動場才發覺原來今天都沒有場地，我白走了一回。不過這樣還好我可以十時才開在學坐。這天晚喵仔找了我吃飯！！

星期三(生日)早上複診，下午喝茶，晚上魚蝦蟹及蛋糕。

星期四我都是反工，我好快咁做好晒啲嘢再做吓自己嘢，自己的功課自己在作文。

星期五的今天我在剛剛上班時，我發覺我整個星期都是用電腦有點困難呢，打字不斷的出錯，我也不知為甚麼，總是覺得是慢過一至兩個月之前的呢！

明天星期六我又要到帶足球班，希望可以平安無事吧（求主幫幫我吧）
同埋我明天放工後要到尖沙咀上課願我可以有足夠的體力及智慧去應付這些！

Windows 8 Bata

2011-11-03T17:42:00.001+08:00

The Windows 8 bata download link
http://msdn.microsoft.com/en-us/windows/apps/br229516