Firewall Suggestions about streisand

[psifertex]

Also: 8888/TCP (tinyproxy), 1701/UDP (L2TP), and some of those ports are random and will be different every time. Of course, that list could be dynamically generated by ansible which would be a good idea. Would be possible to put all but the two dynamic ones in the readme, and the dynamic could go in the generated html or some other doc on the server.

[psifertex]

Here's a prettier list I'll try to update as I figure out the different defaults and services. Done in the style of /etc/services

Services

ssh 22/tcp  OpenSSH
http    80/tcp  not sure, not running on my machine
https   443/tcp nginx
ldaps   636/tcp OpenVPN
l2tp    1701/udp    xl2tpd
http-proxy  8888/tcp    tinyproxy
tor 8443/tcp    tor

[sporkman]

Ah, thanks. I'd picked out quite a few (including some from the generated configs), but Tor was not working with the firewall enabled. I did not realize that some services were using randomly-generated port numbers.

+1 for ansible spitting out a list of ports when it's done running the playbook.

[jlund]

I can make this happen!

FYI ports 80 and 8888 are bound to localhost, so they don't need to be opened up on a firewall. Port 80 is for the Tor Hidden Service, and 8888 is so SSH tunnel users can run applications that support HTTP proxies but that don't support SOCKS.

L2TP/IPsec requires some additional ports as well. I will get a "Firewall Information" link added to the bottom of the Gateway page, and it will include the dynamic Tor ports too.

[psifertex]

So on all the instances I've installed, 8888 most definitely isn't bound to localhost. Maybe you meant 8181 (localhost) or 1080 (tun interface)? If not, might be a bug.

[jlund]

The Tinyproxy role has a task that explicitly sets the Listen address to 127.0.0.1 for the service it runs on port 8888. This appears to be working on Debian but is possibly broken on the Ubuntu 14.04 instances you've started?

[jlund]

The format of the tinyproxy.conf file does not appear to have changed between Debian 7 and Ubuntu 14.04. I will have to dig more into this later, but none of the Streisand servers that I've set up have port 8888 open to the world.

[psifertex]

Strange. After rebooting the VM, it does appear to be correctly listening on loopback. Which is bizzare because I'm quite certain it wasn't before. Odd.

Also, the working image I'm on now is 12.04. I might go back to 14.04 to troubleshoot things there since it would be nice to be on the latest LTS.

[pnegahdar]

For reference my run on AWS opened the following ports in the streisand rule:

Ports   Protocol    Source  streisand-streisand-1 
59896   tcp 0.0.0.0/0   ✔
47578   tcp 0.0.0.0/0   ✔
22  tcp 0.0.0.0/0   ✔
993 tcp 0.0.0.0/0   ✔
8443    tcp 0.0.0.0/0   ✔
636 tcp 0.0.0.0/0   ✔
8530    tcp 0.0.0.0/0   ✔
443 tcp 0.0.0.0/0   ✔

[jlund]

Done! Thanks for the suggestion.