Maximum Cache TTL Microsoft DNS Server MSDNS

Open up regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters

Create a new DWORD "MaxCacheTtl" with a DECIMAL setting of 300 (for 300 seconds)

Then restart the DNS service (not required)

Negative Caching Microsoft DNS Server MSDNS

Open up regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters

Create a new DWORD "NegativeCacheTime" with a DECIMAL setting of 30 (for 30 seconds)

Then restart the DNS service

IPv6 Supernetting Subnetting Ruby

#!/usr/local/bin/ruby -w
require 'ipaddr' 

# /32 CIDR -> /40's (LONG)
(0..255).each { |x|  puts IPAddr.new("1234:5678:#{sprintf("%02x",x)}00::0").to_i }

# /32 CIDR -> /48's (LONG)
(0..255).each { |x|  puts IPAddr.new("1234:5678:00#{sprintf("%02x",x)}::0").to_i }

IPv6 To PTR RDNS PHP

<?php
$addr = inet_pton($ip);
$unpack = unpack('H*hex', $addr);
$hex = $unpack['hex'];
$arpa = implode('.', array_reverse(str_split($hex))) . '.ip6.arpa';
?>

PHP Function To Convert CIDR To Netmask

<?php
function cidr2mask($cidr) {
     return long2ip(-1 << (32 - (int)$cidr));
}
?>

PHP Function To Convert Netmask To CIDR

<?php
function mask2cidr($mask){
     $long = ip2long($mask);
     $base = ip2long('255.255.255.255');
     return 32-log(($long ^ $base)+1,2);     
}
?>

How To Fix scp: command not found

On the server that will not accept the SCP connection run (assuming CentOS/RHEL):

yum install openssh-clients -y

How To Disable IPv6 On CentOS 6, RHEL 6

Since not everyone has access to IPv6 and leaving it enabled when not in use is a waste of resources, you an disable IPv6 via the following.

Add the following to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

To disable it on a running system, without reboot:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6

How To Disable IPv6 On CentOS 5, RHEL 5

Since not everyone has access to IPv6 and leaving it enabled when not in use is a waste of resources, you an disable IPv6 via the following.

Add the following to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1

To disable it on a running system, without reboot:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6

Block/Discard Traffic IP Addresses on Juniper in JunOS Firewall Using Prefixes Filters and SpamHaus

In dealing with a lot of nefarious traffic on the internet lately, I needed a quick and easy solution for dropping this traffic at my edge. Most of the documentation out there is horribly dry with few examples.

The following example worked great in our MX240's and older M7i's. This will also work in SRX's but I have no way to affirm this.

1) Create the Prefix-Lists inside 'policy-options'

edit policy-options prefix-list block-Manual
set a.b.c.d/CIDR
up
annotate prefix-list block-Manual "Manual Block List"

edit policy-options prefix-list block-spamhaus-edrop
set a.b.c.d/CIDR
[...]
set w.x.y.z/CIDR
up
annotate prefix-list block-spamhaus-edrop "http://www.spamhaus.org/drop/edrop.txt"

You'll need to add the nets you want to block to each prefix list (I've created separate lists on purpose) but this should roughly give you:

[edit policy-options]
/* Manual Block List */
prefix-list block-Manual {
    set a.b.c.d/CIDR;
}
/* http://www.spamhaus.org/drop/edrop.txt */
prefix-list block-spamhaus-edrop {
    a.b.c.d/CIDR;
    w.x.y.z/CIDR;
}

I'm also using the drop list from SpamHaus but at 500+ lines felt it was of no use in this article, however simply create another prefix list, annotate it according and fill it with the contents of http://www.spamhaus.org/drop/drop.txt

2) Create a filter in the firewall

set firewall family inet filter blocked-IP term 1 from prefix-list block-Manual
set firewall family inet filter blocked-IP term 1 then discard
set firewall family inet filter blocked-IP term 2 from prefix-list block-spamhaus-edrop
set firewall family inet filter blocked-IP term 2 then discard
set firewall family inet filter blocked-IP term 99 then accept

...and this gives you:

filter blocked-IP {
    term 1 {
        from {
            prefix-list {
                block-Manual;
            }
        }
        then {
            discard;
        }
    }
    term 2 {
        from {
            prefix-list {
                block-spamhaus-edrop;
            }
        }
        then {
            discard;
        }
    }
    term 99 {
        then accept;
    }
}

3) Apply to an interface

       family inet {
            filter {
                input blocked-IP;
                output blocked-IP;
            }
       }

...and thats all there is to it. Just keep adding new prefix lists (if you want to keep them logically separate) and then add them as terms to the filter ensuring term 99 (accepting traffic) is always last.

Show Total Number Of SYN_RECV Connections Using Netstat For SYN Flood DDOS Denial Of Service Detection

netstat -an | grep :80 | grep -i syn | wc -l

Protect Against SYN Flood DDOS/DOS Denial Of Service Attacks

There are a few baseline variables you can set in the Linux kernel to help protect your server against SYN Floods.

echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo 3 > /proc/sys/net/ipv4/tcp_synack_retries

To make these persist across reboots, enter the following into /etc/sysctl.conf

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3

It is also recommended you install CSF firewall to help your servers' security. CSF also includes SYN Flood mitigation at the firewall iptables/firewall level.

Use NMAP To Port 80 Check An IP Or Block Of IP's

nmap -p 80 --unprivileged [single IP or spaced CIDR-notated blocks, e.g. 192.168.0.0/24]

Use NMAP To Ping Test An IP Or Block Of IP's

nmap -sP --unprivileged [single IP or spaced CIDR-notated blocks, e.g. 192.168.0.0/24]

Add IP Range To Windows Network Adapter From Command Line

for /L %a in (1,1,32) do netsh int ip add address "Local Area Connection" 192.168.0.%a 255.255.255.255

This will add 192.168.0.1 - 192.168.0.32 to the network adapter named "Local Area Connection"

You may need to change the adapter name to suite your specific adapter names.

Enable Windows RDP Through Windows Firewall From Command Line

netsh firewall set portopening TCP 3389 microsoft-rdp

Block Outbound Port 25 SMTP Traffic Cisco Catalyst Switch ACL

Log into to your switch, enter "enable" mode, then "configure terminal" mode:

access-list 199 deny tcp any any eq smtp
access-list 199 permit ip any any

Now, on any interface that you want to deny outbound port 25 SMTP traffic to:

ip access-group 199 in

Write out the changes and you're done

Create Setup BGP Blackhole Community In Juniper Junos

Before you start, you'll want to have spoken with your upstreams and ensured you are enrolled in their BGP Blackhole program and that your BGP session(s) are currently given access to the communities.

The first thing you'll need to do is log into your Juniper and hop into edit mode.

Next, you need to create a new policy-statement inside your policy options:

edit policy-options
set policy-statement provider_blackhole 
edit policy-statement provider_blackhole 
set term match_666 from protocol static
set term match_666 from tag 666
set term match_666 then origin igp
set term match_666 then community set provider_blackhole
set term match_666 then accept

To check your work, type show and you should see:

policy-statement provider_blackhole {
    term match_666 {
        from {
            protocol static;
            tag 666;
        }
        then {
            origin igp;
            community set provider_blackhole;
            accept;
        }
    }
}

Now we have to create that actual community:

edit policy-options
set community provider_blackhole members AS###:COM###;

...replace AS### with the providers ASN number, and replace COM### with the community tag your provider gave you for the BGP blackhole.

Next we have to update the BGP group for this provider so we are announcing the community:

edit protocols bgp group provider
set export provider_blackhole

...one VERY important thing to note is that export ordering MATTERS. The most specific routes are announced left to right, so always ensure your blackhole export is listed first.

The very last thing to do is actually route IP's to this blackhole:

edit routing-options static
set route a.b.c.d/cidr discard
set route a.b.c.d/cidr tag 666

...that's it.

So what we've done here is:
1) Added a static route that is discarded and tagged "666"
2) Our policy-statement then grabs all static routes with a tag of "666" and then assigns them to the BGP blackhole community.
3) Our BGP group announces that community within the BGP session to the provder
4) The provider then drops all traffic to the IP's announced in that community.

You can use whatever "tag" number you want so long as it's being used consistently.

You can also have multiple policy-statements for multiple providers matching the tag and pushing to multiple communities (you may even want to condense them down into one policy-statement by setting multiple communities)

Turn Off And Disable IPv6 In Linux

touch /etc/modprobe.d/disable-ipv6
echo "options ipv6 disable=1" >> /etc/modprobe.d/disable-ipv6

You'll also want to set "NETWORKING_IPV6" to "NO" in this file:

/etc/sysconfig/network

...and then reboot.

Enable TUN/TAP With OpenVZ Or Virtuozzo Containers For OpenVPN

On the masternode, perform the following:

lsmod | grep tun

If that yields no results, you have to load it into the kernel:

modprobe tun

Next, you'll want to ensure this module is loaded across system reboots so you can do either of the following:

echo 'modprobe tun' >> /etc/rc.local

--- OR ---

echo 'modprobe tun' >> /etc/rc.modules

...whichever you are accustom to.

Next we have to allow the container access to the TUN/TAP device:
(use your container ID in place of CT_ID)

vzctl set CT_ID --devices c:10:200:rw --save
vzctl set CT_ID --capability net_admin:on --save

Lastly, we have to create the device and assign the proper permissions to it:
(use your container ID in place of CT_ID)

vzctl stop CT_ID
vzctl exec CT_ID mkdir -p /dev/net
vzctl exec CT_ID mknod /dev/net/tun c 10 200
vzctl exec CT_ID chmod 600 /dev/net/tun
vzctl start CT_ID

Your container should now be able to install OpenVPN or other VPN software.