test please delete

[HeliCraig]

The firewall at Amazon's end imposes a very strict security model. As far as I can tell, if you open a port (e.g. 3306 for MySQL) you have to specify an IP address or range, not a hostname - and obviously I don't want to open the database server up to a range of randomly-assigned Virgin IP addresses, even though there's only a minimal chance of some random bot on some local loser's machine trying to break into MySQL and happening across my server. So, when my IP changes, I have to close off the old IP address and open things up for the new one. Still, the Elasticfox FF extension makes that part pretty easy.

The MySQL server checks privileges for the incoming user and host combination, but when it does a reverse DNS lookup on the IP address the hostname it gets is something like cpc1-town8-0-0-cust666.twn5.cable.ntl.com, which also changes when the IP address changes. Once I SSH in (which uses keypairs) and use the MySQL command line to grant the requisite privileges to 'user'@'123.123.123.12', I'm then able to use the GUI-based MySQL admin tools on my laptop to connect and get rid of the old hostnames associated with 'user'. I could grant those privileges to 'user' for any host, but again that's potentially risky if some bot or hacker is trying the door handles (despite my very secure password).

The real problem was that this is the first time my IP address has changed since I set this lot up, so when a connection profile that worked yesterday suddenly stopped working, it took me a while to work out what was going on

All sounds a bit complicated to me.... could you get a static IP from Virgin instead? (NB: You may have to p@y. Sorry to swear!).

[HeliCraig]

That's a bit pants - what Netgear model is it?

My Netgear router supports port forwarding: it's in the admin interface under "Advanced". It's a WPN824v2, for what that's worth.

Its a DG834.

I might have another look then - couldn't see it with a cursory glance yesterday!

[voodooflux]

My Netgear router supports port forwarding: it's in the admin interface under "Advanced". It's a WPN824v2, for what that's worth.

It's called something completely different on the web interface for mine (a Thompson box rebranded by Be*), something like "Application & Game Sharing". I really must have a go with the CLI at some point - the Web UI is appalling.

[HeliCraig]

Makes me appreciate the static IP I get from Be*

I just found an advantage of living in the Red Ditch.

If I put my phone number in Be*'s website I get:
Unfortunately Be is not available in your area yet.

Which is a shame. They must not like us barn dwelling incestuous country side folk. Shame, we are nice people really. Well, everyone apart from me.

[voodooflux]

All sounds a bit complicated to me.... could you get a static IP from Virgin instead? (NB: You may have to p@y. Sorry to swear!).

A mate of mine enquired about this a while ago, but they couldn't provide one at the time. Not sure whether that has changed.

[voodooflux]

Its a DG834.

I might have another look then - couldn't see it with a cursory glance yesterday!

This any good?

Maybe not: at a cursory glance it seems to indicate that ports can be forwarded, but not remapped to a different port number.

[NickFitz]

All sounds a bit complicated to me.... could you get a static IP from Virgin instead? (NB: You may have to p@y. Sorry to swear!).

Nope - they don't do them. Still, what can you expect from a company that, when you phone it to report a broadband fault, suggests you look on their web site for help

[HeliCraig]

This any good?

Maybe not: at a cursory glance it seems to indicate that ports can be forwarded, but not remapped?

Yes and No.

Thats what I got working yesterday. Thing is that it does not port translation - so if you want something to arrive on the host at port 5900 it must arrive on the WAN interface on port 5900 too. Rubbish.

I normally have things set up so that externally I use a random port number and have the router map this back to a 192.168.x.x:5900. Keeps the port scanners guessing.

Just don't want to open a well publicised port like VNC on my WAN interface which maps back to my main computer!

[voodooflux]

Time for food

[HeliCraig]

Nope - they don't do them. Still, what can you expect from a company that, when you phone it to report a broadband fault, suggests you look on their web site for help

Hmm... did they suggest it from the safe distance of the sub continent by any chance?

And then, when they haven't resolved anything, but have repeated the script 10x, ask "Is there anything else I can(t) do for you today?".

</rant>