<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>So I added those two lines and then could still not install nano:<br></div>
<div> </div>
<div><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><b><span class="colour" style="color: #0000ff">yum install nano</span></b></span><span class="colour" style="color: #0000ff"><br></span></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff">* * * [cut] * * *</span></span></b><br></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff"><b><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><span class="colour" style="color:rgb(0, 0, 255)">Trying other mirror.</span></span></b><br></span></span></b></div>
<div><a href="http://mirrors.kernel.org/centos/6.6/os/x86_64/Packages/nano-2.0.9-7.el6.x86_64.rpm"><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff">http://mirrors.kernel.org/centos/6.6/os/x86_64/Packages/nano-2.0.9-7.el6.x86_64.rpm</span></span></b></a><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff">: [Errno 14] PYCURL ERROR 6 - "Couldn't resolve host 'mirrors.kernel.org'"<br></span></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff">Trying other mirror.<br></span></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff">Error Downloading Packages:<br></span></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><span class="colour" style="color: #0000ff"> nano-2.0.9-7.el6.x86_64: failure: Packages/nano-2.0.9-7.el6.x86_64.rpm from base: [Errno 256] No more mirrors to try.</span></span></b><span class="colour" style="color: #0000ff"><br></span></div>
<div> </div>
<div>I did some googling and was told to check the <b><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif">ifcfg-eth0</span></b> file, which I had never messed with:<br></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">[root@vslaw2 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 | more<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">DEVICE='eth0'<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">TYPE=Ethernet<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">BOOTPROTO=none<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">ONBOOT='yes'<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">HWADDR=04:01:50:5d:bd:01<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">IPADDR=104.131.31.216<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">NETMASK=255.255.192.0<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">GATEWAY=104.131.0.1<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">NM_CONTROLLED='yes'<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">DNS1=8.8.8.8<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">DNS2=8.8.4.4<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">[root@vslaw2 ~]#</span></b><br></div>
<div> </div>
<div>Do I still have iptables wrong? Maybe this is a result of the still-unifixed ppp0 issue?<br></div>
<div> </div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">[root@vslaw2 ~]# iptables -L -nv<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">Chain INPUT (policy DROP 8 packets, 379 bytes)<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> pkts bytes target prot opt in out source destination<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 244 18832 ACCEPT tcp -- * * 107.132.57.128 0.0.0.0/0 tcp dpt:22 state NEW,ESTABLISHED<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 1 40 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443<br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">Chain FORWARD (policy DROP 0 packets, 0 bytes)<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> pkts bytes target prot opt in out source destination<br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">Chain OUTPUT (policy DROP 1176 packets, 80892 bytes)<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> pkts bytes target prot opt in out source destination<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT all -- * ppp0 0.0.0.0/0 0.0.0.0/0<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 212 30848 ACCEPT tcp -- * * 0.0.0.0/0 107.132.57.128 tcp spt:22 state ESTABLISHED<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"> 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443<br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">[root@vslaw2 ~]#<br></span></b></div>
<div> </div>
<div> </div>
<div> </div>
<div>On Wed, May 13, 2015, at 16:50, Steve VanSlyck wrote:<br></div>
<blockquote type="cite"><div>So . on the first issue . I need to add these two out rules?<br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow outbound http traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT# Allow </span><b><span class="colour" style="color:rgb(255, 0, 0)">out</span></b><span class="colour" style="color:rgb(255, 0, 0)">bound http traffic</span></b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow </span><b><span class="colour" style="color:rgb(255, 0, 0)">out</span></b><span class="colour" style="color:rgb(255, 0, 0)">bound https traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT# Allow </span><b><span class="colour" style="color:rgb(255, 0, 0)">out</span></b><span class="colour" style="color:rgb(255, 0, 0)">bound https traffic</span></b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Allow inbound http traffic?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT# Allow inbound http traffic</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Allow inbound https traffic?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT# Allow inbound https traffic</b></span><br></div>
<div> </div>
<div> </div>
<div> </div>
<div>On Wed, May 13, 2015, at 16:20, Rick Hornsby wrote:<br></div>
<blockquote type="cite"><div> </div>
<div><blockquote type="cite"><div>On May 13, 2015, at 15:02, Steve VanSlyck <<a href="mailto:s.vanslyck@postpro.net">s.vanslyck@postpro.net</a>> wrote:<br></div>
<div> </div>
<div><div>I cannot figure out why yum is being blocked. I understood it requried only ports 80 and 443. The below is from my script:<br></div>
</div>
</blockquote><div>...<br></div>
<div><blockquote type="cite"><div><div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow http traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT</span></b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow https traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</span></b></span><br></div>
</div>
</blockquote><div> </div>
</div>
<div>Looks like your INPUT and OUTPUT are backwards.<br></div>
<div> </div>
<div>You need to allow OUTBOUND traffic to ports 80 and/or 443 to access remote yum repositories. But you are also using a paranoid DROP policy on your output chain.<br></div>
<div> </div>
<div>Something else I noticed -<br></div>
<div> </div>
<div><blockquote type="cite"><div><div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A OUTPUT -o ppp0 -j ACCEPT</b></span><br></div>
</div>
</blockquote></div>
<div> </div>
<div>It looks like you're only allowing all outbound traffic on the interface ppp0, which is not normally what I'd expect to see unless you're using some kind of dialup or VPN *outbound* to provide the host connectivity. Usually if an interface is being specified, I'd expect to see eth0, or in the case of CentOS 7 something along the lines of enp0s3. Either changing this, or fixing the two rules that you highlighted will probably do the trick.<br></div>
<div> </div>
<div> </div>
<div>one other note - at least for testing purposes you might want to use REJECT instead of DROP. When you use DROP the firewall does exactly what the word implies - it silently drops the packets to the floor and the application has no idea anything is wrong. It is forced to time out waiting for a response that will never come. With REJECT iptables sends an ICMP response immediately. That should help speed up your development and troubleshooting greatly.<br></div>
<div> </div>
<div><a href="http://ipset.netfilter.org/iptables.man.html">http://ipset.netfilter.org/iptables.man.html</a><br></div>
<div> </div>
<div> </div>
<blockquote type="cite"><div><div><div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Flush all current rules?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -F</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Accept connections to the loopback interface (localhost)?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -i lo -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Accept connections from the loopback interface (localhost)?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A OUTPUT -o lo -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Allow outgoing connections?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A OUTPUT -o ppp0 -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Drop all pings?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -p icmp --icmp-type echo-request -j DROP</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Accept requested inbound traffic?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Accept new and established ssh from specified IP?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -p tcp -s 107.132.57.128 --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Allow established ssh to specified IP?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A OUTPUT -p tcp -d 107.132.57.128 --sport 22 -m state --state ESTABLISHED -j ACCEPT</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Drop all other ssh attempts?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -A INPUT -p tcp --dport ssh -j DROP</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow http traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT</span></b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">read -p "Allow https traffic?"</span></b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b><span class="colour" style="color:rgb(255, 0, 0)">iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</span></b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Set policy: Drop forwarding connections?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -P FORWARD DROP</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Set policy: Drop other incoming connections?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -P INPUT DROP</b></span><br></div>
<div> </div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>read -p "Set policy: Drop outgoing connections?"</b></span><br></div>
<div><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"><b>iptables -P OUTPUT DROP</b></span><br></div>
</div>
<div>_______________________________________________<br></div>
<div>colug-432 mailing list<br></div>
<div><a href="mailto:colug-432@colug.net">colug-432@colug.net</a><br></div>
<div>http://lists.colug.net/mailman/listinfo/colug-432<br></div>
</div>
</blockquote></div>
<div> </div>
<div><u>_______________________________________________</u><br></div>
<div>colug-432 mailing list<br></div>
<div><a href="mailto:colug-432@colug.net">colug-432@colug.net</a><br></div>
<div><a href="http://lists.colug.net/mailman/listinfo/colug-432">http://lists.colug.net/mailman/listinfo/colug-432</a><br></div>
</blockquote><div> </div>
</blockquote><div> </div>
</body>
</html>