LinuxPld linuxpld

IP Tables (iptables) Cheat Sheet

IPTables is the Firewall service that is available in a lot of different Linux Distributions. While modifiying it might seem daunting at first, this Cheat Sheet should be able to show you just how easy it is to use and how quickly you can be on your way mucking around with your firewall.

Resources

The following list is a great set of documentation for iptables. I used them to compile this documentation.

How-To Geek: The Beginner’s Guide to iptables, the Linux Firewall: https://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/
IPTables Essentials: Common Firewall Rules and COmmands https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands

Checking status of the cluster:

clustat
clustat -m -> Display status of and exit
clustat -s -> Display status of and exit
clustat -l -> Use long format for services
cman_tool status -> Show local record of cluster status
cman_tool nodes -> Show local record of cluster nodes
cman_tool nodes -af
ccs_tool lsnode -> List nodes
ccs_tool lsfence -> List fence devices

Configure Git Server on CentOS 7

Server

$ yum install git-core
$ sudo useradd git
$ sudo passwd git

Common Options

-#, --progress-bar Make curl display a simple progress bar instead of the more informational standard meter.

-b, --cookie <name=data> Supply cookie with request. If no =, then specifies the cookie file to use (see -c).

-c, --cookie-jar <file name> File to save response cookies to.

	global
	maxconn 16384
	log 127.0.0.1 len 8192 local0
	log-send-hostname
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

	server {
	listen 80 default_server;
	server_name domain.com;
	rewrite ^ https://$server_name$request_uri? permanent;
	}

	server {
	listen 443 default_server;

	server_name domain.com;

	Install WireGuard via whatever package manager you use. For me, I use apt.

	$ sudo add-apt-repository ppa:wireguard/wireguard
	$ sudo apt-get update
	$ sudo apt-get install wireguard

	MacOS
	$ brew install wireguard-tools

	Generate key your key pairs. The key pairs are just that, key pairs. They can be

	# ------------------------------------------------
	# Config files are located in /etc/wireguard/wg0
	# ------------------------------------------------

	# ---------- Server Config ----------
	[Interface]
	Address = 10.10.0.1/24 # IPV4 CIDR
	Address = fd86:ea04:1111::1/64 # IPV6 CIDR
	PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Add forwarding when VPN is started
	PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE # Remove forwarding when VPN is shutdown

	# Configuration file for runtime kernel parameters.
	# See sysctl.conf(5) for more information.

	# See also http://www.nateware.com/linux-network-tuning-for-2013.html for
	# an explanation about some of these parameters, and instructions for
	# a few other tweaks outside this file.

	# See evil packets in your logs.
	net.ipv4.conf.all.log_martians = 1