Translated using DeepL

Machine-translated page for increased accessibility for English questioners.

Page in original, Czech language.

Restrictions on access to the MU Faculty of Informatics network

Access to the faculty network is restricted in order to enhance its security. Put simply, there are three basic access groups (with increasing levels of trust and the number of accessible services):

  • from the Internet
  • from the university network: from addresses in themuni.cz domain, i.e. from the address ranges147.251.0.0/16 or2001:718:801::/48
  • from the faculty network: from addresses in thefi.muni.cz domain, i.e. from the address ranges 147.251.42–53.0/24,147.251.58.0/24,172.16.0.0/12 or 2001:718:801:200::/56

You can access the university network by using the university VPN. You can access the faculty network by using the faculty VPN (or the university VPN) or by using SSH tunnels (see below; the university VPN is not sufficient) or see also general remote access to services. Private networks (172.20.0.0/12) are routed and accessible only within the FI network.

The FI network is segmented and controlled by a firewall, typically at the boundaries defined for IPv4 Class C blocks (147.251.n.0/24) and for IPv6 at the boundaries of the/64subnet (2001:718:801:2nn::/64). Generally, all privileged ports on all machines are blocked.

For any requests regarding changes to the faculty firewall, please contact unix@fi.muni.cz .

Examples of service availability

Accessible from outside:

  • SSH, IMAP(S), POP3(S) on Aisu and Anxura
  • SMTP with enforced authentication onrelay.fi.muni.cz

Available only from the MU network:

Available only from the FI network (or parts thereof):

SSH on ports 80 and 443

If your internet service provider blocks communication on port 22, for FI staff (and others with access to Anxur) we offer the option to connect via ports 80 and 443:

home$ ssh -p 80 login@anxur-ssh.fi.muni.cz

Tunnelling via SSH

If you need to connect to a service that is only accessible from the faculty or university network, you can use the features provided by SSH: SOCKS proxy, port forwarding, jump hosts. See, for example, the documentation for ArchLinux or Gentoo for instructions on how to use them.

For these purposes, you can use Aisy, for example. Brief examples:

# port forwarding
home$ ssh -L 13306:db.fi.muni.cz:3306 login@aisa.fi.muni.cz
home$ mysql -h localhost -p 13306 -u login -p

# jump hosts
home$ ssh -J login@aisa.fi.muni.cz login@nymfeMNN.fi.muni.cz

Blocking IP addresses

To protect the services provided by the FI MU network, attempts to access blocked ports on blocked or non-existent machines are monitored. If a machine repeatedly accesses prohibited ports on prohibited machines, its behaviour is assessed as an attempt at unauthorised intrusion into the FI MU, and access from that machine to the FI MU network (including access to the IS MU) is completely blocked, usually for 24 hours. In the event of repeated incidents, the block is made permanent.

A further blocking and blacklisting system is also operated at university level.

What to do if you are blocked

If you think your IP address has been blocked, please refer to the IS guide to find out the technical details. When requesting unblocking, always include your external IP address .

If you are only experiencing problems with www.fi.muni.cz and is.muni.cz, check whether the blockis on the faculty firewall. Also check for widespread unavailability of services on the FI side: FI Status. Faculty administrators can, upon request, assess the block and lift it if necessary.

If you are certain that the issue is not one of those described in the paragraph above, it is likely that access is being blocked by the university firewall. Please contact (only) it@muni.cz .