This website has been down for a couple of days, but only because I’ve moved house, and had to switch my phone service/ISP to a house that didn’t have a live phone line.
Last night I unboxed the tech, plugged it all in, switched it on and Robert’s your mother’s brother…
It all worked.
I have a file of these. And a file of NTL/Virgin Media activities.
I’ve just upgraded the NAS operating system from DSM4.3 to DSM5.0
There are a number of changes, but the biggest obvious one is the UI, which now looks like this:
Jazzed up, huh?
When you crack open the bonnet and look inside, you notice that the changes go beyond the visual.
The new operating system drops MySQL out of the picture, and switches to MariaDB.
Why?
Since MySQL got bought up by Oracle, a growing number of people have become concerned that the brilliant free database that drives so many internet functions might stop being free (or might get taken off the market altogether by Oracle, and replaced with a paid-for product).
These people (the concerned ones) took foundation components from the MySQL product, added some updated thinking, and produced MariaDB.
I was understandably nervous about accepting the DSM upgrade. I use MySQL to run database functions, and use it to interface with .php front-ends. I also use MySQL to run security functions on the NAS, and content indexing features.
So this evening I backed everything up, took a deep breath and hit the upgrade button.
The NAS did its upgrade thing, rebooted itself and popped back up.
The WordPress intranet site (yeah, pretty geeky, huh?) popped straight back up and the first thing I noticed was how fast it was.
I poked around in the phpMyAdmin control panel to make sure that everything was still there, and doing what it should be.
All of the MySQL databases (I’m currently running five) had been converted to MariaDB.
I could access the databases through the GUI and could execute SELECT and UPDATE and DELETE statements in the SQL panel.
I could also import and export databases, and build new tables and drop tables at will.
And yes, it all seemed to be much quicker than it had been, when the back-end environment was MySQL.
In fact it looked so quick that I have opened port 80 on my router again, and brought this blog back from Arizona, and am currently hosting it on my NAS (not on HP Server A or HP Server B).
Just, you know, for a laugh.
Well, as you might remember, having migrated all of the self-hosted websites to the Arizona host from the Rugby infrastructure (so there are no domains pointing to the static IP address here), I closed port 80 on the router.
That was a week ago.
This evening, just for a laugh, I opened port 80 on the router. You have to remember that there are no domains hosted in Rugby, so there can be nothing pointing to a domain inside the router.
As soon as I saved the new #open port 80# config on the router, the port 80 calls started appearing:
So, it’s safe to assume that all of these (and probably most of the historic) port 80 calls are routing to the static IP address configured inside the router, not to any domain name.
Interesting.
The router log does, it seems, record some activity, but not all, even though all ports are now closed in the primary firewall.
The router log continues to show the MAC addresses of the devices that attach to it (chiefly my phone and laptops), it also records non-specific port activity, like this:
Someone in the Netherlands seems to be trying to bring my system down, but with no ports open, all that’s happening is my router is recording the external activity (and promptly ignoring it).
Interesting.
And, for reasons that I’ll go in to another time, I thought ‘Well, I’ve got half an hour, why not migrate those websites off the HP Server array, over to Arizona, and shut Port 80 on my router?’
So I did.
I took local copies of the five MySQL databases, created five new MySQL databases in Arizona, imported the appropriate copies of the local MySQL databases in to each of the appropriate new MySQL databases, FTPd the five .php environments to the five new webspaces, made myself a cup of tea, and then pointed the IP and NameServers for each of the five domain names from the HP Server address, over to the Arizona address.
Then I shut my local router to all internet traffic.
I’ll review the router log tonight; it’ll be interesting reading because I don’t know if it will record all failed attempts in the same way that it recorded all successful attempts.
I’ll also check the NAS access log (as it acts as DHCP server).
My internal LAN (NAS/DHCP server, plus HP Server A, and HP Server B) are all still accessible to me from within my network.
The downside of this is that I can’t perform remote admin on the NAS, HP Server A, or HP Server B, while I have all ports shut down on the router.
Well, I’ll keep an eye on the server log, and maybe I’ll open up just the one port I need for remote access.
We’ll see.
Not only is port 110 closed on the router, but the IP address 211.103.207.222 is banned for life by my secondary firewall.
And yet still the persistent Chinese bot continues its fruitless quest:
After thinking about it for at least a couple of weeks, I’ve decided that I’m going to migrate the port 80 environments off HP Server A on to my Arizona platform.
I’m going to leave port 80 open on the router.
I’m doing this because I want to see what will happen.
I have been assuming that the current port 80 traffic is coming in on a hosted domain (or coming in on all of the hosted domains), but the more I think about it the more uncertain I get.
I have no problem with port 80 traffic, obv.
I’m just intrigued about it.
I want to know more about it.
I want to know everything about it.
So one weekend early next month I’m going to migrate the websites from HP Server A to Arizona.
Then I’m going to pull up a chair and watch the port 80 traffic.
Just to see what happens.
Here’s a random thought that occurred to me, on my way to work this morning (VFR, if you’re interested).
What would happen to all those weird port calls if I shut port 80 on my firewall?
They would get bounced, obv.
They would probably get an ‘unreachable’ error.
But would they go away (in something like six months)?
I’m tempted to give it a shot.
Of course, I’d have to move the hosted domains to another location, but I’ve already proven (and documented here) how easy that is.
And it would take maybe 15 minutes to migrate the websites (and their databases) that I host to another place.
But what difference would there be, do you suppose, between my firewall/router logs now, and my firewall/router logs six months after I closed port 80?
I’m sufficiently intrigued as to be considering the idea.
When I see this kind of behaviour, I start to wonder… WTF?
