We just replaced one of our Juniper SRX series firewalls with one of these little pfSense boxes and wouldn’t you know one of our own snort rules blocked us. Here’s how we got back in:

Gain access to the pfSense shell. We could have walked over to the box but that involved standing up, placing one foot infront of the other and repeating again and again. Bah, who needs all that.

We SSHd to another machine, and from that machine we SSHd to a machine behind our firewall, and from that we SSHd to the LAN IP associated with our firewall. We logged in, chose option 8 (Local Shell), and did the following:

pfctl -t snort2c -T show

This will show you all the IPs that have been blocked by triggering a snort rule

Then run this to remove you IP

pfctl -t snort2c -T delete xxx.xxx.xxx.xxx

You should add your own IPs to the whitelist to prevent this from happening again.

Here’s a working solution:

location ~ \.(jpg|jpeg|bmp|jif|bmp|gif|png)$ {
                root   /path/to/public_html/;
                valid_referers server_names none blocked;
                if ($invalid_referer) {
                return 403;
                }
            }

Some sites will need to allow some other sites to link to their images. If this is the case you can use the following rewrites – just modify and add domains as required

location ~ \.(jpg|jpeg|bmp|jif|bmp|gif|png)$ {
                root   /path/to/public_html/;
                valid_referers server_names none blocked www.theothersite.com *.theothersite.com;
                if ($invalid_referer) {
                return 403;
                }
            }

server {
            listen   80;
            server_name  my.uncorrupted.net;
            rewrite ^/(.*) https://my.uncorrupted.net/$1 permanent;
       }

server {
            listen   443;
            server_name my.uncorrupted.net;
            access_log /xxx/xxx/xxx/logs/access.log;
            error_log /xxx/xxx/xxx/logs/error.log;
	    	ssl on;
	    	ssl_certificate /xxx/xxx/xxx/.ssl/cert.pem;
	    	ssl_certificate_key /xxx/xxx/xxx/.ssl/key.pem;

            location /  {
                        root   /xxx/xxx/xxx/public_html/;
                        index  index.html index.php;
		    }

			location = /announcements {
        				rewrite ^  /announcements.php  last;
    		}

    		location /announcements/ {
        				rewrite  ^/announcements/([0-9]+)/[A-Za-z0-9_-]+\.html$ /announcements.php?id=$1 last;
    		}

    		location = /downloads {
        				rewrite ^  /downloads.php  last;
    		}

    		location /downloads/ {
        				rewrite ^/downloads/([0-9]+)/([^/]*)$ /downloads.php?action=displaycat&catid=$1 last;
    		}
			location = /knowledgebase {
       					rewrite ^  /knowledgebase.php  last;
    		}
			location /knowledgebase/ {
        				rewrite  ^/knowledgebase/([0-9]+)/[A-Za-z0-9_-]+\.html$ /knowledgebase.php?action=displayarticle&id=$1 last;
        				rewrite  ^/knowledgebase/([0-9]+)/([^/]*)$ /knowledgebase.php?action=displaycat&catid=$1 last;
    		}

            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            location ~ \.php$ {
            			fastcgi_pass 127.0.0.1:9000;
            			fastcgi_index index.php;
            			include /usr/local/nginx/conf/fastcgi_params;
            			fastcgi_param SCRIPT_FILENAME /xxx/xxx/xxx/public_html/$fastcgi_script_name;
            }
}

Gest of luck – if you run into any issues write us a comment and we’ll see if we can help you work it out.

Requirements:

• Terminal (SSH) access to your new and old web servers
• An SSH client (I recommend Putty)
• A text editor for modifying the dump.sql file we’re going to create (I recommend Aptana Stuido because it performs well when opening large (20+MB) text files)

During the migration process you’ll be copying/pasting paths a lot, so open up a new text document in Aptana and paste the following into it:

Old Server Info:
Path to public_html = /replace/with/real/path/
Wordpress DB Name = replace_Me
Wordpress DB User Name = replace_MeToo
Wordpress DB Password = NewSecretPassword

New Server Info:
Path to public_html = /home//domains/example.com/public_html/
Wordpress DB Name = replace_Me
Wordpress DB User Name = replace_MeToo
Wordpress DB Password = NewSecretPassword

Now open Putty and make a connection to your old server. Once you’re logged in, cd (change directory) into the public_html directory.
Type:

pwd

Paste the output into your text file. This is the path to public_html on the old server.

Log into your control panel and create a new database, copy the DB Name, User Name, & Password and paste it into your text document.

Back to Putty… you should still be inside your old hosts public_html directory. Type these commands:

cd ..
tar cvzf backup.tgz public_html
mv backup.tgz public_html

So, we moved up one directory and created a gzipped tar archive of your entire public_html folder. I choose to gzip the entire folder because if you’re in the directory and pass it the * operator it will skip hidden files (like .htaccess files), which we definitely want to leave in place. We also moved the backup file into your public_html folder so we can download it from the new server.

Open up another putty window and connect to your new server. cd into your public_html directory (@ Uncorrupted it is ~/domains/example.com/public_html/)
Let’s do some cleanup:

 rm -f index.html logo.jpg

Download and extract the backup file:

wget http://example.com/backup.tgz
tar zxvf backup.tgz
cd public_html
mv * ..

So, we downloaded the backup, extracted it, moved into the folder it created (public_html) and moved all the files out. We still need to move any relevant hidden files, so:

ls -la
mv .htaccess ..
mv
cd ..
rm -rf public_html

So now you’re back inside the real public_html directory on the new host. Grab the path and add it to your text file:

pwd

Lets tell WordPress which database to use and the username/password combo needed to open it:

nano wp-config.php

Find: define(‘DB_NAME’, ‘…’); Replace … with the DB Name in your text document
Find define(‘DB_USER’, ‘…’); Replace … with the User Name in your text document
Find define(‘DB_PASSWORD’, ‘…’); Replace … with the Password in your text document

Once you’re done editing the file, press + o to save the changes and + x to exit.

Let’s go back the the other Putty window (your old host) and dump the MySQL database – replace the DB info with the DB info from your text document.

cd public_html
mysqldump -u -p  > dump.txt

Download the text file to your computer and open it up with Aptana. We need to replace the path info throughout the database so click on Edit -> Find/Replace
In the find block, paste your old path to public_html and in the new block paste your new path to public_html. Make sure the Wrap Search check box is checked and click Replace All. Save the text document and upload it into your public_html directory on the new server.

Import the text file into your new MySQL DB:

mysql -u -p  < dump.txt

At this point, WordPress should be working. All of your posts, comments, media, etc should be working just as they were on your old host. You can test everything by editing the hosts file on your PC

Go to: C:\Windows\System32\drivers\etc and open up the hosts file with a text editor, go to the end of the file and type the IP address of your new server, press tab & type your domain name, save the document, close your web browser, and clean your DNS cache (click start, click run type ipconfig /flushdns & press enter). Next, open your browser and go to your site – everything should work. When you’re done testing, delete the lines you added to your hosts file and then save/close it.

At this point, all that’s left to do is change the DNS servers for your site and point them at the DNS servers provided by your new host. Some folks will continue to hit your old site and some will start hitting your new site. Within a couple days all your visitors will be hitting the new one. Keep in mind that it may be a while before you hit the new server too – that’s just the way DNS works. If you want to hit it instantly, check out my post about OpenDNS