Em chào mọi người.
Em mới làm công việc sysadmin được 1 thời gian ngắm, kinh nghiệm có rất ít.
Em đang gặp khó khăn với việc cấu hình cho pfsense.
Hệ thống của em như sau:
Pfsense có 2 interface:
-1WAN: 210.x.x.Y
-1LAN: 10.0.2.1
Server Centos 6.3 có 2 interface:
-1WAN: 210.x.x.Z
-1LAN: 10.0.2.243
-default gateway: 10.0.2.1
Từ ngoài internet em ping 210.x.x.Z thì ok.
Địa chỉ internet ping là: 118.x.x.x
Nhưng khi telnet vào 210.x.x.Z:3306 thì không được
(Connecting To 210.x.x.Y...Could not open connection to the host, on port 3306: Connect failed)

<snip>
 

tmp hiện đang trống trơn  

Nếu dùng Nginx làm Webserver rồi thì cần gì Nginx làm Reverse Proxy nữa ? 

Cái này đã được thảo luận cách đây hơn 2 năm rồi. =]]. requests mà chạy thẳng vào apache là website đơ luôn.


/hvaonline/posts/list/29851.html
 

Qualsys Security Labs researcher Sergey Shekyan has created a proof-of-concept tool that could be used to essentially shut down websites from a single computer with little fear of detection. The attack exploits the nature of the Internet's Transmission Control Protocol (TCP), forcing the target server to keep a network connection open by performing a "slow read" of the server's responses.

The Slow Read attack, which is now part of Shekyan's open-source slowhttptest tool, takes a different approach than previous "slow" attacks such as the infamous Slowloris—a tool most notably used in 2009 to attack Iranian government websites during the protests that followed the Iranian presidential election. Slowloris clogs up Web servers' network ports by making partial HTTP requests, continuing to send pieces of a page request at intervals to prevent the connection from being dropped by the Web server.

Slow Read, on the other hand, sends a full request to the server, but then holds up the server's response by reading it very slowly from the buffer. Using a known vulnerability in the TCP protocol, the attacker could use TCP's window size field, which controls the flow of data, to slow the transmission to a crawl. The server will keep polling the connection to see if the client—the attacker—is ready for more data, clogging up memory with unsent data. With enough simultaneous attacks like this, there would be no resources left on the server to connect to legitimate users.

Shekyan said in his post about the tool that this type of attack could be prevented by setting up rules in the Web server's configuration that refuse connections from clients with abnormally small data window settings, and limit the lifetime of an individual request.  

Bạn thử đẩy cái
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
lên phía server hoặc http xem.