Problem - UI is available from outside

dror

Hello,
I have set my Rpi2 with RA. I dont have a router so my entire home machines are connected to one switch, which is connected to a cable modem.
The problem is, when I set my android browser to the Rpi IP, I get to the RuneUI, even when I am not connected via my local Wifi, just from the cellular network no matter where I am. This means anyone can set to that IP get access.

How can I prevent this?

Thanks..

hondagx35

Hi dror,

I dont have a router so my entire home machines are connected to one switch, which is connected to a cable modem.

I can not believe this. Because if this is true, all your machines would be accessible by public.

Please tell us a bit more about your installation (modem brand and type).

Frank

dror

It is names ARRIS
cant tell the model though..

guess I need to hang up the Rpi now...

nic

Surely you must be hanging off the wifi ? I don't think you can vpn in without dynamic dns , besides that if you are accessing using a class C ip , it can't be from outside your network . Your best bet is to walk a few hundred yards down the road and retry

Nic

dror

Hmm well.. I was maybe 8 km away. And doubled checked now from home. When wifi off, I can access RuneUI.
this seems to be a serious problem.

My setup is :
Cable modem
|
Switch ---------- PC (connected to switch)
|
------------------- Rpi (connected to switch) --- Wifi dongle(AP)

dror

Edit: one thing I can think of (not sure if its related) is that I kill "wpa_supplicant -B" pid on startup in order to make my AP accessible.

utschu

I don't know of anybody who connects it's devices neither directly nor via switch behind a cable modem, as you would leave doors and windows wide open for any suspecious individuum tryind to get into your system.

This could only be brought to a higher risky level by posting the IP address somewhere in a forum.

I wonder wy millions of poeple are buying routers if they are not needed at all.

Beelzebassie

Back in the days, more than 10 years ago, I had a similar setup:

2+ computers with spoofed MAC-addresses (all identical) connected to the internet through a switch connected to a cable modem. Never had any problem whatsoever... The domestic adaptation of WiFi has made routers commonplace, and I would indeed not recommend a switch-only setup nowadays.

dror

Isn't my OS level firewall supposes to prevent those intrusions? (for the PC machine)
I have check with online tools and it seems I'm protected...

Edit:
checking
iptables -L via ssh, it seems all policies are set to "ALLOWED"

dror

well..

no one of the devs cares Runeaudio receives connections it should have dropped !?

schinken

Easiest solution is to get a cheap router and divide your home network from the outside world.

dror

Thats a walkaround.
Let me explain, the internet cable spot (only one in the house) is localed in a basement where WIFI can't get out ( basement with thick walls), so I want to avoid using WIFI there.

dror

OK

this is what I added:

iptables -A OUTPUT -o eth0 -j ACCEPT # allow all outputs
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # allow inputs for ESTABLISHED,RELATED only
iptables -A INPUT -i eth0 -p icmp -j ACCEPT # allow ping inputs (including NEW)
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT # allow SSH inputs (including NEW)
iptables -A INPUT -i eth0 -s XX.XX.XXX.XXX -j ACCEPT # for specific IP allow all (this is my PC)
iptables -A INPUT -i eth0 -j DROP # drop everything else

works fine for now, and I can no longer connect to web UI when I'm not on my PC or wlan0 interface

frengo

Hello.

I was very puzzled by what I've read on this topic.

I just need the contrary, to reach Runeaudio UI from the mobile web with non static IP devices (possibly just me, not all people, unless you are using at least one user name and password).

You recommended to use Open VPN or you could use the Dror problem for my purpose (hi) ?

Security, frankly I do not care, it would be interested ease to reach Runeaudio from the mobile web, via the UI using a PC with Windows XP or smartphone with Android.

I read that Open VPN runs on Windows and Linux platforms.

Has anyone tried to install Open VPN on RuneAudio OS in order to reach and control RuneAudio from mobile web (as if it were on the local LAN)?

Thanks in advance.

frengo

dror

Hello

I don't know what openVPN is, but if you have my configuration (see earlier posts) then you can set IPTABLES rules for specific MAC address:

iptables -A INPUT -i eth0 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT # for specific MAC allow all

and use the phone's MAC address. Haven't tested this though.
Also I'm not sure for security issues, but I think it should be fine.

dror

hondagx35

Hi dror,

to get your RuneAudio puplic available you have to do:

- change your network profile to statis IP address
- go to your routers config page
- forward port 80 to your PI (static IP address)
- search for your public IP address 1)
- open your mobile browser
- navigate to
http://your-public-IP
- enjoy your public available RuneAudio

1) you can use something like noip to get a fixed URL for your network (so called "Dynamic DNS")

Further readings:
https://en.wikipedia.org/wiki/Port_forwarding
http://www.noip.com/support/knowledgebase/general-port-forwarding-guide/

WARNING: From here your Pi is available for everyone who finds out your public IP!

: public-RA.png (89.49 KiB) Viewed 1740 times

Frank

dror

Hi Frank,

First, it's frengo's question

Second, I thing he didn't ask for his Rune to be public available, only available to his phone

Dror

hondagx35

Hi dror,

First, it's frengo's question

Sorry

Second, I thing he didn't ask for his Rune to be public available, only available to his phone

What is the difference?
Maybe i miss understood his question.

to reach Runeaudio from the mobile web

For me "from the mobile web" means from outside his local network.

Frank

dror

Frank,

I referred to this :

frengo wroteHello.
I just need the contrary, to reach Runeaudio UI from the mobile web with non static IP devices
(possibly just me, not all people, unless you are using at least one user name and password).

he asked for his access only if possible, while his IP is non-static.
I answered he can filter using iptables rules for MAC address

cheers,
dror