gilangvperdana

Nginx Reverse Proxy for SSH

Use Case

• 10.10.10.50 is Target VM will to SSH
• We will expose this to localhost:32

Configuration

• Make upstream conf :

nano /etc/nginx/conf.d/stream.conf.ssh

gilangvperdana

Fix SSH Key are too open on Windows 11

If you want to login with your key, but you see an error permission windows 11 "SSH key are too open" do this :

• Make sure you was regenerate your key from puttygen to OpenSSH Key format
• Open your Windows PowerShell then :

$path = ".\path\to\your\key.pem"
icacls.exe $path /reset
icacls.exe $path /GRANT:R "$($env:USERNAME):(R)"
icacls.exe $path /inheritance:r

gilangvperdana

All About Apache / Httpd

Baremetal

• Installation

apt install -y apache2

• Configuration on /etc/apache2/

gilangvperdana

Note about IPTables on Linux

Commands

• Flush existing ruleset:

iptables -F
iptables -t nat -F

• Set reasonable policy defaults (that is, these are "reasonable" for an exposed firewall; you may decide that an input policy of ACCEPT is, well, acceptable in this particular scenario):

gilangvperdana

Local Forwarding

If you want to locally access a cloud application that has the address 192.168.100.2:82 and can only be reached by your VM, you can use the technique below. That way you can access your local localhost:80.

ssh -L LocalPortAccess:AppsIPAddresses:AppsPortAddresses user@VPSPublicIP -pXXXX
ssh -L 80:127.0.0.1:30001 student@lab4.btech.id -p10013

Remote Forwarding

If you want to access your local application with the application address 127.0.0.1:30001 then you can access it on your VPS on port 80 you can use the technique below:

gilangvperdana

DevStack with Magnum & Heat local.conf Template

Installaion

Provisioning with DevStack can be seen Here

Local.conf Configuration

nano local.conf

gilangvperdana

General

If you want to block port node exporter access from outside you can use this command

iptables -A INPUT -p tcp -s 10.7.0.0/24 --dport 9100 -j ACCEPT
iptables -A INPUT -p tcp -s localhost --dport 9100 -j ACCEPT
iptables -A INPUT -p tcp --dport 9100 -j DROP

• 10.7.0.0/24 & localhost are IP ALLOWED to access port 9100

gilangvperdana

Check Public IP on Linux CLI

curl ifconfig.me
curl -4/-6 icanhazip.com
curl ipinfo.io/ip
curl api.ipify.org
curl checkip.dyndns.org
dig +short myip.opendns.com @resolver1.opendns.com
host myip.opendns.com resolver1.opendns.com
curl ident.me

gilangvperdana

Expose Nginx Ingress on K8s with OpenVPN

Expose to world your Apps on K8s On-Premises with Nginx Ingress + Metallb + OpenVPN

Goals

• You can access your apps with Ingress URL on your K8s on-prem to the World!

Markdown

• 192.168.17.50 are Nginx Ingress External IP Generated by MetalLB.
• res.bignetlab.com are Domain for this case.
• This default.conf are Nginx on Host (not on K8s stack).

gilangvperdana

Multi Port Reverse Proxy on Nginx Configuration

This tutorial are suitable for you if you want to reverse multi endpoint with one domain different port.

Goals

• You can access on localhost:8443 to access localhost:9200
• You can access on localhost:8442 to access localhost:5601

Configuration

nano /etc/nginx/sites-enabled/default