Evoxt, Author at Evoxt

WireGuard One-Click Installation

Evoxt — Sun, 16 Jul 2023 00:03:00 +0000

Set up your very own personal WireGuard server with Evoxt with only a single click with our One-Click Installation Script. WireGuard is another popular virtual private network (VPN) protocol that offers secure and efficient network connections. Similar to OpenVPN, WireGuard encrypts network traffic, protects user privacy, and allows for bypassing restrictions on untrusted networks. In a business setting, WireGuard can be used to establish a secure connection between employees and the company's network, creating a private and encrypted communication channel. With WireGuard, users can also enjoy the benefits of anonymous browsing and secure data transmission while using public Wi-Fi networks. The WireGuard installed with Evoxt's One-Click Installation will be wg-easy made by Emile Nijssen due to its simplicity to configure profiles.

Instruction

Check your email for your VM details. Your VM details are sent to your email inbox. Check your junk/ spam mail just in case. Alternatively, you can also get them by logging in to your Evoxt account and go to the respective VM control panel. Did not see it in your account? Contact us.

Installation

With Evoxt's One-click installation, your WireGuard server is already running and deployed. To create your WireGuard connection profile, simply go to

http://:51821

Can use this command to find your Wireguard password:

cat ~/wireguard-password.log

[root@TEST ~]# cat ~/wireguard-password.log ZmM1MGU5ZWFmNzJlMmNkYm [root@TEST ~]#

Configuration

Because this installation is using wg-easy made by Emile Nijssen. The configuration process is fairly simple, simply login and create clients When new WireGuard profile is created, it will be located in your server's root directory ~/.wg-easy.

Upgrading your WireGuard server

To upgrade your WireGuard server to the latest version, simply execute these commands.

docker stop wg-easy docker rm wg-easy docker pull weejewel/wg-easydocker run -d \ –name=wg-easy \ -e WG_HOST=YOUR_SERVER_IP \ -e PASSWORD=YOUR_ADMIN_PASSWORD \ -v ~/.wg-easy:/etc/wireguard \ -p 51820:51820/udp \ -p 51821:51821/tcp \ –cap-add=NET_ADMIN \ –cap-add=SYS_MODULE \ –sysctl="net.ipv4.conf.all.src_valid_mark=1" \ –sysctl="net.ipv4.ip_forward=1" \ –restart unless-stopped \ weejewel/wg-easy

Deploy your own personal WireGuard server with just a single click!

The post WireGuard One-Click Installation appeared first on Evoxt.

How to enable Qemu Guest Agent for Virtual Machines

Evoxt — Sat, 10 Dec 2022 21:14:39 +0000

Linux Based OS

Install Qemu Guest Agent

CentOS

yum install -y qemu-guest-agent

Ubuntu

apt install -y qemu-guest-agent

Debian

apt install -y qemu-guest-agent

AlmaLinux 8

dnf install -y qemu-guest-agent

RockyLinux 8

dnf install -y qemu-guest-agent

Then, start and ensure the service is persistent

systemctl enable –now qemu-guest-agent

Windows OS

Download these 2 installers in your Windows VM, and install
https://spice-space.org/download/windows/spice-guest-tools/spice-guest-tools-latest.exe
https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-qemu-ga/qemu-ga-win-102.10.0-0.el8_5/qemu-ga-x86_64.msi

the program will start automatically after installation

The post How to enable Qemu Guest Agent for Virtual Machines appeared first on Evoxt.

我买了美国服务器，为什么我得到的是xxx国家的服务器？

Evoxt — Sat, 10 Dec 2022 19:37:15 +0000

有关 IP 地理定位的信息

网站通过您的 IP 地址跟踪您的位置，这通常是使用 IP 地理定位数据库完成的。对于 eBay、Amazon、TikTok 等网站也是如此……

地理定位数据库通常通过跟踪 IP 地址块的 Whois 或等待 ISP 提交 IP 地址地理定位更正来工作。 Whois 数据可以从 RIR 获得。由于这样一个繁琐的过程，一些地理定位数据库可能会过时并且无法获取正确的地理定位数据。当 ISP 或服务提供商刚刚获得 IP 地址并且他们刚刚更新了 IP 地址块的 whois 信息时，这种情况总是会发生

给一个例子，当部署了马来西亚服务器，但在检查 IP 地址地理定位网站时，它将 IP 地址显示为来自英国地区的英国 IP 地址，而不是来自马来西亚地区的马来西亚 IP 地址。在这种情况下，最好咨询不同的地理定位数据库，因为您当前使用的数据库可能已经过时。要知道你的 IP 地址位置，我们强烈建议你使用 ipinfo.io 或 maxmind.com 因为他们是目前最大的 IP 地址地理定位数据库，他们总是花费巨大的努力来确保他们的地理定位数据是正确。

如果地理定位数据库显示正确的 IP 位置，但在某些网站上显示不正确，这是因为某些网站选择不经常获取地理定位数据，从而导致网站错误显示您的位置。如果这影响了您的使用，我们建议您联系该网站以获得更新。

一些附加点：
– 一些客户指出这是不对的，您应该从IP地址块的whois中获取此信息以确定这是否是“原始IP”。这是不正确的，BGP.HE.NET 显示的特定 IP 块的 whois 信息将与提供商在 RIR 上设置的信息相同，这就是提供商配置地理定位的方式。

更多加点：
– 一些客户指出 Abuse Contact 起到了地理定位的作用，这是不正确的。滥用联系是我们用来接收滥用报告的方式，例如网络钓鱼投诉、DDoS 投诉、恶意软件传播投诉、版权投诉等。

电子邮件：我们收到大部分滥用投诉的地方
地址：我们可以在哪里接收邮寄的滥用投诉信件
电话：紧急滥用投诉

它们存在的原因不是出于地理定位目的，这可以像 whois 联系方式一样进行编辑，但我们将保持原样，因为这是我们接受滥用投诉的地方。

谷歌地理位置
谷歌不依赖任何地理位置数据库，他们根据用户的活动进行地理定位，我们认为这是一个绝妙的解决方案，但对我们不利。

我们一直在积极向谷歌提交地理位置请求，但由于谷歌对IP的定位方式，地理位置被纠正了，但几周后又改回去了：/更糟糕的是，谷歌不接受任何IPv6纠正请求。

对于这种情况，我们可以做的不多，因为这完全是出于我们的控制范围之外。要解决这个问题，如果您正在使用 IPv6，地理位置可能是错误的，请尝试禁用 IPv6 并使用 IPv4 连接谷歌。否则，最简单的方法是登录到您的谷歌帐户，谷歌将根据您的帐户区域进行地理定位。如果不需要谷歌服务，不会受到任何影响，所有其他网站都应该显示正确的地理位置。

Traceroute 怎么样？
Traceroute 是一种工具，用于显示数据包在通过许多不同网络时的路径。它不包含任何地理位置数据。如果 traceroute 工具显示 IP 地址的位置，这是因为 traceroute 工具正在从地理定位数据中获取 IP 地理，这也是会被过时的地理数据库影响的。如果 traceroute 在该国家/地区显示不正常，这通常是因为 traceroute 工具使用的地理定位数据库是过时的。如果您执行从美国到马来西亚的跟踪路由，您的数据包几乎不可能被路由到新加坡，然后在下一跳到达英国，这表明地理位置数据已过时。

一些误解
我们也从我们的中国客户那里听到了很多关于“原生 IP”的术语，这是一个无效的术语，几乎没有英文翻译。你可以尝试将“原生 IP”翻译成英文，你会得到 native ip, 尝试搜索 native ip，根本没有任何信息。这不存在因为 IP 地址不是“原生 IP”而显示错误位置的网站，大多数情况下，这是因为网站采用的地理位置数据库过时或网站拒绝更新其地理位置数据造成的。

VPN 提供商
在 VPN 提供商的情况下，一些 VPN 提供商甚至使用 IP 地理定位为其客户创建“虚拟位置”。例如，当 VPN 提供商需要开曼群岛位置而他们没有时，他们可以将他们的一些美国服务器的 IP 地址地理定位到开曼群岛，供他们的客户使用。这种做法相当普遍，与实际位于开曼岛上的服务器相比，除了异常延迟外，他们的客户不会意识到太多差异。

我希望这篇文章能消除您对 IP 地址地理定位的疑虑，如果您需要任何进一步的说明，请随时与我们联系。

The post 我买了美国服务器，为什么我得到的是xxx国家的服务器？ appeared first on Evoxt.

I bought a United States server, why did I get a server from xxx country?

Evoxt — Sat, 10 Dec 2022 18:49:03 +0000

Information regarding IP Geolocation

Websites track your location from your IP address, this is usually done using an IP geolocation database. This will be the same for websites such as eBay, Amazon, TikTok, etc…

A geolocation database usually works by tracking the Whois of the IP address block or waiting for ISPs to submit an IP address geolocation correction. Whois data can be obtained from RIRs. Because of such a tedious process, some geolocation databases can be out of date and not fetch the correct geolocation data. This is especially true when an ISP or a service provider just acquired an IP address and they have just updated the IP address block’s whois info.

An example of this is when a Malaysia server is deployed but when checked with an IP address geolocation website, it displays the IP address as a United Kingdom IP address from the United Kingdom region instead of a Malaysia IP address from Malaysia region. In cases like this, it is better to consult a different geolocation database as the current one you are using might be outdated. To know your IP address location, we strongly suggest you use ipinfo.io or maxmind.com as they are currently the biggest IP address geolocation databases and they always spent tremendous efforts just to make sure that their geolocation data is correct.

If the geolocation database is showing a correct IP location but on some specific websites this is showing incorrectly, this is due to some websites choosing to fetch geolocation data infrequently, which causes the website to show your location incorrectly. If this affected your usage, we suggest contacting the website in order to get this updated.

How about Traceroute?

Traceroute is a tool used to display the path of a packet as it travels through many different networks. It does not have any geolocation data included. If a traceroute tool is showing the location of the IP address, this is because the traceroute tool is fetching IP geolocation data from geolocation databases which are susceptible to outdated geolocation data. If a traceroute is showing an irregularity in the country, this is usually the sign of an outdated geolocation database used by the traceroute tool. If you are performing a traceroute from the United States to Malaysia, there is almost no way your packet will be routed to Singapore and then ends in the United Kingdom the next hop, this is a sign of outdated geolocation data.

Some misconceptions

We have also heard a lot of terms from our China-based customers regarding “原生 IP”, this is an invalid term used as there is literally no English translation for this, try translating the term to English and you will get “native IP”, try Googling native IP and there will be no information on this at all. There is no such thing as a website showing an incorrect location due to the IP address not being a “原生 IP”, most of the time, this is due to the geolocation database that the website is using is outdated or websites that refuse to update their geolocation data.

Some add-on points:

– Some customers pointed out that this is not right, you are supposed to get this info from the whois of the IP address block to determine if this is a “原生 IP”. This is incorrect, the whois info for a specific IP block that BGP.HE.NET displays will be the same as what providers set on RIR, this is how providers configure geolocation.

More add-on points:

– Some customers pointed out that the Abuse Contact plays a role in geolocation, which is incorrect. Abuse contact is what we use to receive abuse reports, such as phishing complaints, DDoS complaints, malware spreading complaints, copyright complaints / etc.

Email: Where we receive most of the abuse complaints
Address: Where we can receive mailed physical letters of abuse complaints
Phone: For emergency abuse complaints

The reason they exist is not for geolocation purposes, this can be edited just like whois contact, but we will leave it as it is because that is where we are open to receiving abuse complaints.

Google Geolocation

Google doesn't rely on any geolocation databases and they are geolocating depending on their users' activity which we believe is a brilliant solution but it is bad for us.

We are always actively submitting a geolocation request to Google, but because of how Google geolocate the IPs, the geolocation was corrected but changed back a few weeks later :/ To make things worst, Google does not accept any IPv6 correction requests.

There is not much we can do in cases like this as this is completely out of our control. To resolve this, if you are on IPv6 the geolocation is probably incorrect, try disabling IPv6 and connecting to Google using IPv4. Otherwise, the easiest way will be just to sign in to your Google account, Google will then geolocate depending on your account region. If Google services are not required, nothing will be affected, and all other websites should show the correct geolocation.

VPN Providers

In some cases of VPN providers, some VPN providers are even using IP geolocation to create a “Virtual Location” for their customers. For example, when VPN providers require a Cayman Island location and they don’t have any, they can geolocate some of their US server’s IP address to Cayman Island for their customers. This practice is fairly common, their customers will not realize much difference besides the unusual latency compared to a server that is actually located on Cayman Island.

I hope this read clears up your doubt about IP address geolocation, do not hesitate to contact us if you require any further clarification on this.

The post I bought a United States server, why did I get a server from xxx country? appeared first on Evoxt.

How to increase swap memory on a Windows machine

Evoxt — Fri, 16 Sep 2022 10:52:11 +0000

Google Chrome ran out of memory? "Google Chrome ran out of memory while trying to display this web page", or your server ran out of memory while trying to run a task?

If upgrading your VM plan is not an option, try increasing the swap space of your server.

To increase your Windows server's Swap memory,

Option 1

Go to > Control Panel > System and Security > System > Advanced

Click on Advanced system settings

Option 2

Alternatively, you can go to windows search > Run and type in SystemPropertiesAdvanced.exe and click ok.

Setting the swap space

On the performance tab, click settings

On the Settings tab. Click on Advanced.

Then, on the Advanced tab, click change to set a fixed amount of swap memory manually.

Key in a swap size that you need, and click Set and Ok

You will be prompted to do a restart

Proceed to restart your Windows VM and your Swap memory will be increased.

The post How to increase swap memory on a Windows machine appeared first on Evoxt.

How to downgrade from LiteSpeed Enterprise to OpenLiteSpeed

Evoxt — Mon, 12 Sep 2022 18:18:03 +0000

Accidentally upgraded to LiteSpeed Enterprise or wanted to test some features on LiteSpeed Enterprise but realized that this is not worth the money. Then realized that you can't downgrade from LiteSpeed Enterprise to OpenLiteSpeed without a complete reinstall?

No worries. We got you covered.

This is how to downgrade from LiteSpeed Enterprise back to OpenLiteSpeed.

If you are running on Fedora/ CentOS based OS, use this command to list the available OpenLiteSpeed version.

yum –showduplicates list openlitespeed

If you are running on Debian/ Ubuntu based OS, use this.

apt-cache policy openlitespeed

Here is some example from CentOS Distro

[root@TEST misc]# yum –showduplicates list openlitespeed
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Last metadata expiration check: 1:45:46 ago on Sun 11 Sep 2022 04:58:40 PM EDT.
Installed Packages
openlitespeed.x86_64 1.7.16-1.el8 @@System
Available Packages
openlitespeed.x86_64 1.6.21-2.el8 litespeed-update
openlitespeed.x86_64 1.7.14-2.el8 litespeed-update
openlitespeed.x86_64 1.7.15-1.el8 litespeed
openlitespeed.x86_64 1.7.15-2.el8 litespeed-update
openlitespeed.x86_64 1.7.15-3.el8 litespeed-update
openlitespeed.x86_64 1.7.16-1.el8 litespeed

Then downgrade to OpenLiteSpeed.
If you are running on Fedora/CentOS-based OS, use this command below.

yum downgrade openlitespeed

If you are running on Debian/Ubuntu-based OS, use this command below.

apt install openlitespeed=(OpenLiteSpeed version from command above)
Example: apt install openlitespeed=1.7.16-1+focal

[root@TEST misc]# yum downgrade openlitespeed
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/litespeed.repo; Configuration: OptionBinding with id "failovermethod" does not exist
Last metadata expiration check: 1:45:52 ago on Sun 11 Sep 2022 04:58:40 PM EDT.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing dependencies:
lsphp73-imap x86_64 7.3.33-1.el8 litespeed 40 k
lsphp73-mbstring x86_64 7.3.33-1.el8 litespeed 571 k
lsphp73-mysqlnd x86_64 7.3.33-1.el8 litespeed 142 k
lsphp73-opcache x86_64 7.3.33-1.el8 litespeed 203 k
lsphp73-pecl-mcrypt x86_64 1.0.3-1.el8.7.3 litespeed 27 k
Downgrading:
openlitespeed x86_64 1.7.15-3.el8 litespeed-update 24 M

Transaction Summary
================================================================================
Install 5 Packages
Downgrade 1 Package

Total download size: 25 M
Is this ok [y/N]: y
Downloading Packages:
(1/6): lsphp73-imap-7.3.33-1.el8.x86_64.rpm 192 kB/s | 40 kB 00:00
(2/6): lsphp73-mysqlnd-7.3.33-1.el8.x86_64.rpm 1.0 MB/s | 142 kB 00:00
(3/6): lsphp73-mbstring-7.3.33-1.el8.x86_64.rpm 1.2 MB/s | 571 kB 00:00
(4/6): lsphp73-opcache-7.3.33-1.el8.x86_64.rpm 1.5 MB/s | 203 kB 00:00
(5/6): lsphp73-pecl-mcrypt-1.0.3-1.el8.7.3.x86_ 354 kB/s | 27 kB 00:00
(6/6): openlitespeed-1.7.15-3.el8.x86_64.rpm 20 MB/s | 24 MB 00:01
——————————————————————————–
Total 21 MB/s | 25 MB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : lsphp73-pecl-mcrypt-1.0.3-1.el8.7.3.x86_64 1/7
Installing : lsphp73-opcache-7.3.33-1.el8.x86_64 2/7
Installing : lsphp73-mysqlnd-7.3.33-1.el8.x86_64 3/7
Installing : lsphp73-mbstring-7.3.33-1.el8.x86_64 4/7
Installing : lsphp73-imap-7.3.33-1.el8.x86_64 5/7
Running scriptlet: openlitespeed-1.7.15-3.el8.x86_64 6/7
Downgrading : openlitespeed-1.7.15-3.el8.x86_64 6/7
warning: /usr/local/lsws/admin/conf/htpasswd created as /usr/local/lsws/admin/conf/htpasswd.rpmnew
warning: /usr/local/lsws/admin/conf/jcryption_keypair created as /usr/local/lsws/admin/conf/jcryption_keypair.rpmnew

Running scriptlet: openlitespeed-1.7.15-3.el8.x86_64 6/7
Generating a RSA private key
…………………………..+++++
……………………………………………………………………….+++++
writing new private key to '/usr/local/lsws/admin/conf/webadmin.key'
—–

Running scriptlet: openlitespeed-1.7.16-1.el8.x86_64 7/7
Cleanup : openlitespeed-1.7.16-1.el8.x86_64 7/7
Running scriptlet: lsphp73-pecl-mcrypt-1.0.3-1.el8.7.3.x86_64 7/7
Running scriptlet: openlitespeed-1.7.15-3.el8.x86_64 7/7
Running scriptlet: openlitespeed-1.7.16-1.el8.x86_64 7/7
Verifying : openlitespeed-1.7.15-3.el8.x86_64 1/7
Verifying : openlitespeed-1.7.16-1.el8.x86_64 2/7
Verifying : lsphp73-imap-7.3.33-1.el8.x86_64 3/7
Verifying : lsphp73-mbstring-7.3.33-1.el8.x86_64 4/7
Verifying : lsphp73-mysqlnd-7.3.33-1.el8.x86_64 5/7
Verifying : lsphp73-opcache-7.3.33-1.el8.x86_64 6/7
Verifying : lsphp73-pecl-mcrypt-1.0.3-1.el8.7.3.x86_64 7/7

Downgraded:
openlitespeed-1.7.15-3.el8.x86_64
Installed:
lsphp73-imap-7.3.33-1.el8.x86_64
lsphp73-mbstring-7.3.33-1.el8.x86_64
lsphp73-mysqlnd-7.3.33-1.el8.x86_64
lsphp73-opcache-7.3.33-1.el8.x86_64
lsphp73-pecl-mcrypt-1.0.3-1.el8.7.3.x86_64

Complete!
[root@TEST misc]#

You should be now running on OpenLiteSpeed now instead of LiteSpeed Enterprise.

That should be it.

Deploy a server with Evoxt now!

The post How to downgrade from LiteSpeed Enterprise to OpenLiteSpeed appeared first on Evoxt.

Evoxt Loadbalancer Guide

Evoxt — Tue, 06 Sep 2022 18:14:19 +0000

Downtimes and server overloading are very costly. If your server's resources are getting overloaded due to receiving a lot of traffic and vertical scaling is not what you prefer, a load balancer is what you are searching for.

A load balancer is a reverse proxy that can distribute traffics across servers, acting as a single point of contact for your clients. When a client connects to your load balancer, the load balancer will forward them to other servers depending on your configuration. Hence, load balancing. By configuring a load-balanced setup, this can improve your website or application's availability and prevents server overloading which can destroy users' experience.

With Evoxt's Loadbalancer, you can choose to load balance on layer 4 (TCP and UDP), or you can configure the load balancer to load balance on layer 7 (HTTP and HTTPS).

Getting started with Evoxt's load balancer

To deploy a load balancer. Go to Deploy a Load Balancer

Deploying a load balancer is easy with Evoxt. Simply choose a region, enter a name or use the default hostname, and you can proceed with the load balancer deployment.

After payment, go to your load balancer's control panel. It will take around 10 – 15 minutes for our system to set up your load balancer.

When this is done, you will be presented with the load balancer dashboard.

Configuring your Load Balancer

Click on Configuration to configure your load balancer.

There are only several simple configurations needed to get your load balancer up and running.

Change Load Balancer Algorithm

Load balancer algorithm determines how the traffics are distributed across the backend nodes.

Round Robin – Round robin will randomly distribute traffic or load to all the backend nodes equally.
IPhash – IPhash algorithm will distribute traffic or load to the backend node based on client's IP address. If a client is passed to backend node 1, the client will not be passed to another backend node unless the client's IP address is changed, removed from the load Balancer node cluster, or when backend node 1 is down. This is useful for sessions or when client needs to login into your website.
Least Connections – Least connections algorithm will distribute traffic or load to the node that has the least connection.

Load Balancer Listening Port

This is the load balancer's listening port configuration. A listening port listens to the port for communications, acting like an endpoint for communication.

If you are setting up a load balancer for a website, you will most likely configure the load balancer to listen to the default HTTP port (Port 80) or the default HTTPS port (Port 443).

Selecting HTTP or HTTPS will make the load balancer operate on Layer 7 while selecting TDP or UDP will make the load balancer operate on Layer 4.

Note: HTTPS load balancing is disabled by default until a valid SSL certificate is added. To do that please go to the SSL tab.

Health Check

Enabling health check will set load balancer to monitor the status of the backend nodes, this is a passive health check. If the load balancer detects a backend node is down, it will stop distributing traffic or load to the specific backend node for 30 seconds and recheck the backend node's status once 30 seconds is over and repeat until the backend node is up again.

Node Configuration

This is where you configure the backend node that the load balancer sends traffic to.

Node IP Address – Node IP address is where you key in the backend node IP address. Please use Private IP for zero bandwidth consumption as we do not account for any bandwidth usage for all the traffics communicating through our private network.
Node Port – This will be the backend node's listening port or your backend node's application communication endpoint.
Node Weight – This is for how the percentage of traffic is distributed. The bigger the weight, the more traffic the node will receive.

For example
3 servers. Server 1, Server 2, and Server 3.
and the weighting is set to 3, 1, and 1 respectively.

On 10 requests,
Server 1 will receive 6 requests,
Server 2 will receive 2 requests,
and Server 3 will receive 2 requests.

Note: If a balanced distribution is required, use the same weight on all the backend nodes.

You can add up to 99 backend nodes with Evoxt's Load Balancer.

SSL

To enable HTTPS load balancing, you will need to add SSL certificates.

The certificates required are SSL Public Key and Private Key.

Here is an example of an SSL public key; notice that a public key starts with —-Public Key—–

PLEASE DO NOT USE THIS PUBLIC KEY, THIS IS FOR DEMO PURPOSES ONLY.

—–BEGIN CERTIFICATE—–
MIIFITCCBAmgAwIBAgISBI0qitknRDJsD+beNz+ppuIQMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjA5MDcyMTU1NDhaFw0yMjEyMDYyMTU1NDdaMBkxFzAVBgNVBAMT
DnRlc3QuZXZveHQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
j9P481H0s7kOVCoYuI+fXWluCBrSFMAA0iMEmSyqOqQ/XmNMOBUS8MoHflrR+e9h
uN2gybhPjMu8Nm4OFR8HtMiG7ZstcmZENAJLOK6wONQYktsedPK9/5FPMzwIN3Yx
VoD+L/+fUP+sVOTzF9ap2fgK15QnUeRIEumjKJPL0gbt2t2I1Uf2eRQSZOWiW/ob
LXeW2xvo1xoGsmyVf8dPhohC8rL/JptXLcdFpTnViXUY/jmrohgfH9eOIwOtdEIl
LgBUFMSzc3FPT1q/GpyA1lNhrrCifDkobnve88FMMvVyHexsI4Gd3N+H7+9hiop9
vk1EYp0u7BjzqjZo7/WF3QIDAQABo4ICSDCCAkQwDgYDVR0PAQH/BAQDAgWgMB0G
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1Ud
DgQWBBRNxP8iOxQyx1TxYWiwjDkMFH+/HjAfBgNVHSMEGDAWgBQULrMXt1hWy65Q
CUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9y
My5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iub3Jn
LzAZBgNVHREEEjAQgg50ZXN0LmV2b3h0LmNvbTBMBgNVHSAERTBDMAgGBmeBDAEC
ATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNl
bmNyeXB0Lm9yZzCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1ACl5vvCeOTkh8FZz
n2Old+W+V32cYAr4+U1dJlwlXceEAAABgxoqrvIAAAQDAEYwRAIgejcP27oQ7rWf
O01X8brQZY7uhTn7xNExeCTcnhv3eIACIGZ2MsJwevZydYZYSCFGkDyziYFq3G9m
kMJ7Gx+CNPAZAHYAQcjKsd8iRkoQxqE6CUKHXk4xixsD6+tLx2jwkGKWBvYAAAGD
Giqw/wAABAMARzBFAiEAxjVxflse/arsL43L9oIe60ZgpCnPlEXJ5BywECSVoBEC
IDZE6MOAQVkmT7yBXjWiLb56fTcZ0eBcqrneyfwQnxZqMA0GCSqGSIb3DQEBCwUA
A4IBAQA4rsNOpZLACLgIa64Y/bLKpYw6ZNhv0hFt96oejRpz47wd1gLsI2iqoKkT
13T+i8XjZXXOxmPOc7An/uMdG6ZKYYbDxgTqVTLRfCB4dbgm7xgMG8PFkesAa62Q
3ofra6SYnlObk8XEN3o30erySiglStNz2Df5aeXXjGt90nlTGOxGgeBPNyD3qJFZ
gCpeeC6p7yY9XBgSgtGWfsJqRAsGFbJokNOW72jyKq6DlZ7MQxQdzy1LPT60/9bY
sHnnwRxwHbLvnFz+3WoYpBuj0iwd+yJkUmbWptDB166gbd+aIf5x8XbTq0s3MCAF
cSwRPLf21bptACXDyaxDK5ruLLuZ
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
—–END CERTIFICATE—–

Here is an example of an SSL private key; notice that a public key starts with —-Private Key—–

PLEASE DO NOT USE THIS PRIVATE KEY. THIS IS FOR DEMO PURPOSES ONLY.

—–BEGIN PRIVATE KEY—–
MIIEuQIBADANBgkqhkiG9w0BAQEFAASCBKMwggSfAgEAAoIBAQCP0/jzUfSzuQ5U
Khi4j59daW4IGtIUwADSIwSZLKo6pD9eY0w4FRLwygd+WtH572G43aDJuE+My7w2
bg4VHwe0yIbtmy1yZkQ0Aks4rrA41BiS2x508r3/kU8zPAg3djFWgP4v/59Q/6xU
5PMX1qnZ+ArXlCdR5EgS6aMok8vSBu3a3YjVR/Z5FBJk5aJb+hstd5bbG+jXGgay
bJV/x0+GiELysv8mm1ctx0WlOdWJdRj+OauiGB8f144jA610QiUuAFQUxLNzcU9P
Wr8anIDWU2GusKJ8OShue97zwUwy9XId7GwjgZ3c34fv72GKin2+TURinS7sGPOq
Nmjv9YXdAgMBAAECgf5KnGCKFepDTTXJk6bywbFtVz6L+bzQiU52FlhQrsCE6qBA
thx5+PqBDZqKl7N++g2ak+EMJiRfPSkiWhldUIKT3XJPIIaEyVJ19UZTsQN5wpfA
OhoQd3E+kMvg1dcPVDxfZvm3E5mtynucBeaRCv6X2e2aF6hheNNbx9LWzqKv4Y+t
Nu3FUz9ArcDzdPFhpeEFRXNcS4dAFRRDGBYf61p3bm6gXpg7tvMdGHLx8oDqBogL
5drg6yeynM6vXEQE8RYCx5Gywy1Z1SO2syyO19Mtv/NVZGzxPnP8CdffJQGiGI/b
q2dAvbWBs37yruvp29i6HqzIecd+qzCv7ocMyQKBgQC4Dg06MR4mx1EXV9I0vq19
jqXI6swGcJL9IWNmOX+5fqCrF4mkkcRNmHJKn5C/Ff0BuVBjh3eXrH19pHLZniwK
oAN9gJUSdrzmfAhgcSWZvwv3njNmHn3cE9yjpbqvYToDuaq3RBNECAwQ/PdlkJic
yWC483SJ1dgHb/wnA/bN1QKBgQDIDIKvZOJiXPniHBvOn4qKPPtCVEREs4b2xLVv
cKaWfGKdUdr3ZspCFwMwTI3ohxXPZY9jVRM9g4uT3e+JEV6YqCtqKg7QdNiY+Y/y
gJ+HiAoJ/QMCaMGPYlwnWTLnaKvobFRWikoxVoK6wfJdhi6FX58vCb+RPP8lLBVX
Jafz6QKBgFDw9QYzVZQuMU43s9y4QimmUugRwdnPJgUl6sWo4a+crWGwfzqdVBvf
v9trYsd2Dwb0DRNIHuLX23Qmns9vDOU7S22k32n4R8iAoVpwR93eM5AYxXfSTv06
ytw45Ol9s3qx6w6fZG2VsGDELrQ+q66/rMaJYiW/ojpbGCO8TYxlAoGAfL3gV8JO
sAtN/kKMzGELoHu6KXgmQbi4tfOfN2hFWJ0jWPoL0i2UfXWgFWQHMTHa1cJ8kPIh
1z/Jr2C61vuvwv1KZR7ose/KiElGC29NCtQ3flb4o23zFJe+4wJqDYZle77hMD13
WiCZ0B7UJKFhLOWde1VW0Rf5+ZHtlLP0cNECgYB3+UytXQfAEWZoXPKzX1tcm7DF
7tSYmN8hb/T42r4EoC+mUFce/aGG1ncODUSRfBQfnbypihrtymHZ13XGQRwWAqwO
glUaXMhpiY67NsQg4xXo9J/RseHSVuQRoK+JWmdb8I4Cvjj6h5jdpZpmfEaPy4Cf
gbqC3DEKCXAZ5Hrs+w==
—–END PRIVATE KEY—–

To get your SSL certificate, you can either purchase an SSL certificate from issuing authority (paid) or generate them with Let's Encrypt (Free)

Enable HTTP to HTTPS redirection

By switching this on, Evoxt's Load balancer will automatically accept HTTP traffic (port 80) and automatically redirect it to HTTPS (port 443)

And that's it for all the configurations.

More info about the backup node

Evoxt's Load Balancer works by setting up two load balancer nodes. The main node and the backup node, the backup node exist to ensure that your load balancer will get the highest possible uptime. The load balancer IP address will connect to the main node by default, and the backup node will only be used when the main node is down. When the main node is down, the main node's IP address will be assigned to the backup node. This is done automatically without needing any of your manual intervention. The status of the backup node can be monitored on your Load Balancer dashboard. In cases where you notice that the backup node is down, please contact us to check on this for you.

Some Extra Notes

IP Transparency

If IP transparency is required, you will have to configure the load balance to run on layer 7. The client IP address will only be passed on layer 7 (HTTP or HTTPS).

The connecting client's IP will be passed in the X-Forwarded For Header.

Nginx Guide to configure server to read X-Forwarded For header
Apache Guide to configure server to read X-Forwarded For header

WordPress WP-ADMIN or WP-LOGIN through Evoxt's Load Balancer

Logging into WordPress's WP-Admin can be troublesome through a Load Balancer. There are multiple reasons for this:

Reason 1: Mismatch salt keys in WordPress server.
Mismatch salt will cause login issues when connecting to a different backend node.

To solve this, double check all the backend nodes has a matching salt key set configured.

Reason 2: Force HTTPS on, usually the load balancer will be connecting to your backend nodes through an HTTP connection ( port 80 ). WordPress might get an issue detecting the SSL status.
is_ssl()

To solve this, add this line to your wp-config.php

$_SERVER['HTTPS']='on';

Pointing a domain to a Load Balancer

To point a domain to the load balancer, set your domain's A record to the load balancer IP.

What Load Balancer region to choose

For the best performance and bandwidth savings, please choose the same load balancer region as all your other VMs. When they are in the same region as the backend nodes, add the backend node's private IP to connect through Evoxt's private network. All traffic that goes through the private network will not be accounted for in bandwidth calculation.

HTTPS/ SSL

If you are hosting a website, there are multiple ways to set up HTTPS on your website through your load balancer.

Easier method (CloudFlare)
Use Cloudflare, follow this guide.
Set the A record to your Loadbalancer's IP address. Then enable SSL on Cloudflare which will allow Cloudflare to proxy the traffic on your domain to your load balancer. This will also enable DDoS protection for your website through Cloudflare. If IP transparency is needed, please follow this guide from Cloudflare.

Harder method (Let's Encrypt)
If Cloudflare is not your thing, install Certbot on your server to generate a Let's Encrypt free SSL certificate.

Use the following codes below to install Certbot on your server, we are using AlmaLinux on this demo. Use the specific package installer on your distro.

dnf install epel-release -y
dnf install snapd
systemctl enable snapd –now
ln -s /var/lib/snapd/snap
sudo snap install core; sudo snap refresh core
sudo snap install –classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Source: https://eff-certbot.readthedocs.io/en/stable/using.html#manual

After installing Certbot, use this command to generate a Let's Encrypt SSL certificate.

certbot certonly –manual –preferred-challenges dns

[root@TEST /]# certbot certonly –manual –preferred-challenges dns
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): test.evoxt.com
Requesting a certificate for test.evoxt.com- – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Please deploy a DNS TXT record under the name:

_acme-challenge.test.evoxt.com.

with the following value:

OvPXx9eTzmA1uSRTSSIIM57RhnR8yUZ1BFnjmVDG4hg

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.test.evoxt.com.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Press Enter to Continue

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/test.evoxt.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/test.evoxt.com/privkey.pem
This certificate expires on 2022-12-06.
These files will be updated when the certificate renews.

NEXT STEPS:
– This certificate will not be renewed automatically. Autorenewal of –manual certificates requires the use of an authentication hook script (–manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Once this is done, copy the cert to the LoadBalancer SSL tab, and your server will run on HTTPS.

TCP Passthrough
Set the load balancer to listen on port 443 TCP with the backend node on HTTPS 443. The load balancer will not process any information and passes the encrypted data directly to the client. With this setup, you will only need to configure the SSL on your backend nodes. Your backend server will handle all the data encryption.

The downside with this is that IP transparency will not work because no data will be processed on the load balancer.

The post Evoxt Loadbalancer Guide appeared first on Evoxt.

Evoxt IP Management Tool Guide

Evoxt — Fri, 12 Aug 2022 22:49:24 +0000

Evoxt's IP Management tool provides you with more control of your servers and easier management of your servers. With the ability to reassign IP, remove IP, add extra floating IP and swap IPv4 addresses between servers. With these IP management tools, you can easily switch between development and live servers, minimize downtime with Evoxt's Floating IP address, and more!

Evoxt's IP Management tools mainly focus on IPv4 at this moment. This will be Assign IPv4 Tools and Swap IPv4 Tools

Accessing Assign IP tool

To access the Assign IP tool, go to the VM control panel.

Then click on the IP Management on the top bar, as shown in the image below.

You are now at the Assign IP tool.

Assign IPv4 Guide

Here is a screenshot that helps you with understanding the Assign IPv4 tool. Each option and thing to note in the screenshot is labeled with numbers.
Please note that you can only assign IP from the same region, if you wish to move server to another region, please open a support ticket.

1, 2 & 3 – These are the currently assigned and active IP addresses in the server.
4s – Set as Primary button. Use this button to set the specific IP address as the primary IP address
5 – "Primary" indicates that this IP address is the primary IP address. All servers must have a primary IP address.
6 – "Main Server IP (Sticky)" indicates that this IP address is the IP address that comes with this server. Sticky IP cannot be removed. Please use the Swap IP feature if you need to move this to another server.
7s – Remove button. Use this button to remove the specific IP address from the server.
8 – This dropdown box list all the extra IP address that can be assigned to this server. Use this dropdown box to select an IP address and the assign button below to assign the IP address selected.
9 – Assign button. Use this button to assign the selected IP address on the dropdown box as one of the IP addresses.
10 – Assign as Primary IP button. Use this button to assign the selected IP on the dropdown box as the primary IP address of this server.

After performing any action, our system will perform a reboot on the server. Please make sure all temporary files that need to be kept are saved before performing any IP assignment action

Accessing Swap IP tool

To access the Assign IP tools, go to the VM control panel.

Then click on the IP Management on the top bar, as shown in the image below.

You are now on the Assign IP tool.

Then from the sidebar, click on Swap IPv4 to access the Swap IP tool.

Swap IP Guide and More information

Swap IP tool will swap all the public IPv4 from one server to another server.

To use this tool, select a server on the second dropdown box to swap with and click on the swap IP address to perform the swap.

Please note that you can only swap IP between servers from the same region. If you wish to move a server to another region, please open a support ticket.

After performing IP swapping, our system will perform a reboot on the server. Please make sure all temporary files that need to be kept are saved before performing any IP swap

The post Evoxt IP Management Tool Guide appeared first on Evoxt.

Evoxt Layer 3 Firewall Guide

Evoxt — Sun, 31 Jul 2022 19:59:40 +0000

Layer 3 firewall is included with all servers offered by Evoxt. This will act as a defense line before inbound traffic reaches your servers. Layer 3 firewall performs slightly differently than a host-based firewall (the firewall in your server). Please spend some time understanding them.

Enabling the Firewall

Go to your VM control panel to manage the layer 3 firewall.

Then click on the Firewall on the top bar, as shown in the image below.

Introduction to the Firewall

Evoxt's Layer 3 Firewall is separated into 2 groups, IPv4 firewall, and IPv6 Firewall.
IPv4 Firewall manages all IPv4 inbound traffic, while the IPv6 firewall manages all IPv6 inbound traffic. Evoxt's Layer 3 Firewall defaults to blocking all protocol and ports when enabled. All rules added are to allow the ports or protocol through the firewall.

To get started with managing the firewall and firewall rules, click on Enable Firewall on the Firewall tab.

By default, there will be 5 firewall rules automatically added. This will be:

TCP 32768 – 65535 (This rule handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
UDP 32768 – 65535 (This rule handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
TCP 0 – 65535 with the IP range 10.0.0.0/8 (This rule allow all inbound TCP traffic from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)
UDP 0 – 65535 with the IP range 10.0.0.0/8 (This rule allow all inbound UDP traffic from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)
ICMP with the IP range 10.0.0.0/8 (This rule allow all inbound ICMP protocol or ping from servers that are located in the private network, all server that exists in the same region hosted at Evoxt)

We strongly recommend deleting the list's 2nd, 3rd, and 4th rules if private networking is unnecessary. This ensures that the server is unreachable through Evoxt's private network to protect your server from any potential malicious server in the same network.

Suppose private networking is needed and the exact set of IP addresses that the server is communicating with is known. In that case, we recommend deleting the default rules and re-adding a more specific rule.

For example, two servers are under the same region in the same network. Their IP addresses are 10.0.1.1 and 10.0.1.2, server 1 and server 2 respectively.

On server 1, only allow the second server with the IP address 10.0.1.2/32 through the firewall.
On server 2, only allow the first server with the IP address 10.0.1.1/32 through the firewall.
With this configured, only these 2 servers can communicate, blocking any potential malicious connection attempts from servers in the same network.

Note: Do not forget about the IP address mask. In this case, this will be /32 for a single IP address.

Understanding the options

After enabling the layer 3 firewall, you will be greeted with this easy-to-use firewall panel.

Below states the meaning for each of the fields and buttons:

Protocol
Protocol to allow through the firewall. Most of the protocols that will be used are TCP and UDP.
Ports
Ports to allow through the firewall. If only need to allow a single port is required, leave the second box empty. If this is a range, key in the starting port range in the first box and the ending port range in the second box.
Source
The IP address that sends information to the server or the inbound IP address. Evoxt's Layer 3 Firewall only handles inbound traffic; the source will be the incoming IP address.
Notes
Notes or Label for rules. Only alphabets, numbers, and spaces are allowed in this field.
Add
Click on this button to add a firewall rule.
Disable Firewall
Clear all firewall rules and disable the firewall.
Delete
Delete the specific firewall rule.

Common Firewall Rules Settings

Here are some screenshots of the most common firewall rules,

Allow RDP through the firewall. If your server runs on Windows, you will likely need to add this rule to remote control your server. Follow this screenshot to enable RDP through layer 3 firewall.

Allow SSH through the firewall. If your server is running on Linux based OS, you most likely will need to add this rule to remote control your server.

Allow HTTP port through the firewall. If you are running a web server or hosting a website, this is the default non-SSL port. You will most likely need this to set up a web server or website along with an HTTPS port rule.

Allow HTTPS port through the firewall. This is the default SSL port for running an HTTPS web server. You will likely need this to set up an HTTPS web server or website.

Allow connections to the database. This is the database default connection port.

Allow incoming ping requests to your server. Enable this if you want your ping request to reach your server. This is very useful for doing uptime monitoring.

However, this can potentially be dangerous. Hackers can use this protocol to check if your server is online by pinging your server's IP address and attempting to gain unauthorized access to your server. Besides that, by enabling ICMP protocol, your server will also be susceptible to some types of DDoS attacks.

Hence, if you want your server to be pingable, we strongly suggest setting a stricter IP source rule to protect your server.

IPv6 Layer 3 Firewall

IPv6's layer 3 firewall acts the same as IPv4, but it regulates inbound connection for IPv6 protocol. The control for the IPv6 firewall is the same as the IPv4 firewall, but the initial rules that will be added when the firewall is first enabled will be slightly different.

When IPv6 Firewall is enabled, 3 firewall rules are automatically added. This will be:

TCP 32768 – 65535 (Which handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
UDP 32768 – 65535 (Which handles the connection with private port, is a temporary communication hub used for Internet Protocol (IP) communications)
ICMPv6 on the IPv6 block of the server's IPv6 address is in. This is needed to ensure IPv6 is functioning properly. IPv6 requires ICMP to function properly. Hence this specific rule is added. We strongly recommend not disabling this rule.

Unlike the IPv4 firewall, there is no private IPv6 network with Evoxt, so no Private network rules are required.

Difference between Evoxt's Layer 3 Firewall and Host-based Firewall (Windows/ Linux Firewall)

On a host-based firewall, firewall software or similar programs might need to be installed on the server for the firewall to function. In contrast, Evoxt's Layer 3 Firewall does not require any software installed.
Evoxt's Layer 3 Firewall operates on the network layer, which means malicious traffic can be blocked before it reaches the server. In contrast, a host-based firewall will start processing the packet when the packet reaches the server, leading to potential security flaws. Besides that, because a layer 3 firewall does not exist in the system, a lot of traffic and processing power can be saved during a DDoS attack when the malicious packets are dropped before reaching the server.
Layer 3 firewall will provide a stronger defense than a host-based firewall because this operates on the network layer, separated from the server, which is not susceptible to tampering or backdoors.
Evoxt's Layer 3 Firewall is easy to understand and set up. In Linux operating system, setting up a firewall usually requires some comfort in CLI skills, while Evoxt's Layer 3 Firewall only takes a few clicks to get a firewall set up.
Layer 3 firewall is not "intelligent" compared to a host-based firewall because a layer 3 firewall operates on the network layer and will not understand information on the application layer. This means that firewall blocking, such as based on the application type or only allowing established connections, cannot be set. With layer 3 Firewall, a rule can only be set by using a protocol, port, or IP address only.

As you can see, there are upsides and downsides with both firewalls. To fully protect your server, we strongly recommend setting up both firewalls for maximum protection.

Common DDoS attacks that can be mitigated with Evoxt's Layer 3 Firewall

UDP Flood – Only allow the UDP ports in use through the Firewall. If access is not public, consider allowing only a specific IP address through the UDP port that is in use.
ICMP (Ping) Flood – Block ICMP Protocol to block all ping requests. This can be done by enabling the firewall, which defaults to blocking all protocol and ports.
Ping of Death – Block ICMP Protocol to block all ping requests. This can be done by enabling the firewall, which defaults to blocking all protocol and ports.

The post Evoxt Layer 3 Firewall Guide appeared first on Evoxt.

Prioritize IPv4 over IPv6 on a Windows server

Evoxt — Sat, 30 Jul 2022 19:40:14 +0000

With the new Evoxt implementation, where all new VM deployments will be assigned an IPv6 address, we have received reports from customers due to websites and servers not supporting IPv6 and causing problems.

All Windows servers will prefer IPv6 over IPv4 if IPv6 is enabled. Disabling IPv6, which is the new internet protocol, will cause your server to be not future-proof. So this guide will help you configure your Windows server network connection to prefer IPv4 over IPv6.

Change IPv4 priority on Microsoft's Network Shell

To do that, you will need to do so from CMD

1) Head to CMD, Windows Search > CMD. Alternatively, you can access it through WIN + R, then type in cmd.exe and press ok.

2) On CMD, copy these lines and paste them into CMD. This will move the priority of the IPv4 mapped address to the top, making Windows use IPv4 as the default internet protocol. ::ffff:0:0/96 is an IPv4 mapped address range, equivalent to IPv4. Created to aid in IPv4 to IPv6 transition.

netsh interface ipv6 set prefixpolicy ::ffff:0:0/96 50 4
netsh interface ipv6 set prefixpolicy ::1/128 40 0
netsh interface ipv6 set prefixpolicy ::/0 30 1
netsh interface ipv6 set prefixpolicy 2002::/16 20 2
netsh interface ipv6 set prefixpolicy 2001::/32 5 5
netsh interface ipv6 set prefixpolicy fc00::/7 3 13
netsh interface ipv6 set prefixpolicy fec0::/10 1 11
netsh interface ipv6 set prefixpolicy 3ffe::/16 1 12
netsh interface ipv6 set prefixpolicy ::/96 1 3

Now try to ping google again. Ping should default to IPv4.

Bonus:
To change IPv6 back to the default internet protocol used, use the command below and do a restart.

netsh interface ipv6 reset

Change IPv4 preference through Registry

1) Head to Registry, Windows Search > Regedit. Alternatively, you can access it through WIN + R, then type in regedit.exe and press ok.

2) Go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > Tcpip6 > Parameters (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\)

3) On the folder, right-click and create a Dword (32-bit).

4) Then, rename the entry to DisabledComponents

5) Right-click on the entry and click on modify

6) Enter 0x20 in the value data field as shown in the screenshots below, then click Ok

7) Once this is done, do a server restart.

Now try to ping google again. Ping should default to IPv4.

Bonus:
To change IPv6 back to the default internet protocol used, delete the entry (DisabledComponents) and do a server restart.

Source: https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows

If these are too complicated, you can also choose to just disable IPv6 networking entirely. However, this will disable the dual stack status and cause your server to be not future-proof. Take a look at this guide here

The post Prioritize IPv4 over IPv6 on a Windows server appeared first on Evoxt.