0

I have managed servers that I have access to. I requested firewall rules that are location based (like making sure nobody can SSH to a server unless they are connecting from a specific public IP.

I'd like to be able to test from lots of different IP's. How can I test this from a terminal in a economic fashion?

The only way I could think of (that would be expensive and not really efficient) is create servers in DO, Linode, AWS, etc in different regions. Or buy a vpn service that has locations in multiple regions and use it on my Linux machine.

PS: I wasn't sure if this was better suited for Network Engineering (the people likely to know now to test network firewall rules) or Super User.

2
  • Welcome to NE! We hope you become a contributing member. Using a cloud service like AWS or Digital Ocean wouldn't seem to be a big expense, IMO, if all you're doing is testing rules. With some simple scripting, you could automate this fairly easily.
    – Ron Trunk
    Aug 24 '18 at 18:07
  • Thanks Ron, I will probably use the VPN route if there is no better option than what I listed. I'm not sure how to automate spinning up Linux servers in different regions and having them try to SSH to an IP and then spin back down and delete them so we don't get charged for the reserved virtual space (DO and AWS charge for reserves with OS setups). With the VPN method I can create multiple VPN connection profiles and then make a script connect to one, try ssh, disconnect, connect to another, etc. Was hoping to learn of a better way.
    – user49631
    Aug 24 '18 at 22:29
1

I use shell scripts to launch AWS instances for exactly this kind of purpose, but they suffer from a couple of things:

  • latency to launch is typically 30 seconds
  • charging is by the hour, even if it's only a few centimes
  • EDIT: it now seems that billing for Linux instances is per-second ref

If you want tests once a day, this would be okay, but if you want every ten minutes it's expensive for a few ping packets as you'd have to have it running all the time. it might be inconvenient.

Another method would be to use AWS Lambda service, where you write just a few lines. These are charged by the 100 ms, so it's going to cost much less for this kind of task, and have good latency from their triggers.

The (entire) function I just tried was:

import socket
def lambda_handler(event, context):
    skt = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    skt.sendto("lambda", ('1.2.3.4', 12345))
    return 'Hello from Lambda'

You could build something which did your ping/udp/tcp fetches and then sent a syslog message to your loghost.

EDIT: I tried exactly that, 30 lines of python is good for testing non-connection, SSH opening response, timeout, and logging to syslog. If you ask on Stack Overflow happily will post the python; it's definitely out of remit here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy