Concerned with software or hardware firewalls
-8
votes
0answers
39 views
IBOSS is ruining my day [closed]
iBoss blocks P@@xy and has an immediate Unrecognizable disability for https, how do I get past that? Oh and any URL changers don't work
0
votes
1answer
49 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
6
votes
3answers
124 views
Trying to firewall ports 1863, 5190
I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
...
0
votes
1answer
74 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
-3
votes
1answer
71 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
-1
votes
0answers
35 views
How to block WCF services using Firewall or any other security setting
For an application testing purpose I want to know how to block applications that are trying host http WCF host services. Could someone please point me the right place to block? I've been guessing and ...
4
votes
2answers
95 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
2
votes
2answers
88 views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
1
vote
1answer
55 views
Whats a secure firewall rules using UFW?
On my Ubuntu server I have these services running:
netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
4
votes
4answers
162 views
HTTPS firewall rule
Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall
This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
2
votes
2answers
191 views
How does a firewall help to protect a server?
Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
3
votes
3answers
97 views
Securing a network attached storage on the internet
I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.
I'd like to secure ...
-1
votes
3answers
138 views
What is the difference between a Gateway and a Firewall? [closed]
What is the difference between a Gateway and a Firewall and how do they relate to one another?
I am a developer trying to get a general understanding of network security.
-1
votes
1answer
73 views
Is there a tool I can use to see if my website is being blocked by common business content filters? [closed]
Not 100% sure this is the right site, but hey-ho,
Title sums it up, I'm getting sporadic reports from a couple of clients that people visiting bits of their sites are being blocked with a message ...
4
votes
3answers
162 views
The safest way to circumventing Iran's Internet censorship
We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy.
Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
-1
votes
2answers
106 views
Allow embedded videos while keeping youtube blocked [closed]
Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy.
How can ...
-5
votes
0answers
67 views
How can i use Torrent client to download file in Firewalled network where it has been blocked? [closed]
I am using my College wireless network to browse internet and download files via http or p2p, but recently they've blocked all those functionality including torrent. i know some paid VPN service allow ...
1
vote
2answers
59 views
Remote File Injection in ARGS blocking form updating database
I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule.
How do I stop this apart from not including URLs in the form fields or removing the http:// ...
2
votes
1answer
79 views
Barracuda antispam access to active directory in dmz : opening port or not?
I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed.
What I see on the web is people ...
4
votes
1answer
156 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
-1
votes
1answer
117 views
How to find IP Addresses that have been attacking my Computer Ports ?
I am a newbie at Info Sec, and wanted to know which IP addresses are sources of attack traffic.
Can I also find out which ports are being attacked?
Can this information be found in windows firewall? ...
2
votes
0answers
44 views
Could you attack a port without knowing what service was listening? [duplicate]
A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.
My question is this, though, if the ...
-1
votes
0answers
12 views
Sophos access a webserver from the web [migrated]
I have an web server(IIS) behind an SOPHOS UTM 9
I have setup the Web Application Firewall feature
It is a completely fresh install. No other settings have been eddied.
When I Try to access the ...
1
vote
1answer
60 views
Are there any cross platform firewall solutions with a central management platform?
Currently I have a bunch of servers scattered across a few different providers e.g. EC2, rackspace. Some boxes are Linux and some are Windows. Currently I'm finding the administration of the ...
6
votes
3answers
195 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
3
votes
1answer
192 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
3
votes
2answers
435 views
What are the TCP/UDP ports used by torrent applications?
I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
2
votes
1answer
60 views
SYN scan, determining scan vs large file upload
In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
4
votes
1answer
150 views
How to whitelist an Amazon ELB in a(ny) firewall?
We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address.
However, we are running our system behind an Amazon Elastic Load Balancer ...
-1
votes
1answer
67 views
No data going through IPsec Tunnel [closed]
I encountered the question below in an exam, which I'm trying to understand, kindly help me out to decipher this.
Question: An IPSec tunnel between two firewalls has been set up. However, no data is ...
3
votes
1answer
84 views
Why guest's connections can pass host's firewall?
I've been wondering about this.
Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall.
Why the connections made on ...
2
votes
3answers
133 views
State before getting whitelisted?
There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall.
Is there a common name for the state of the files before they ...
0
votes
1answer
76 views
allowing inbounding UDP datagram if outbound has been done [closed]
Situation:
S: Server computer.
F: Hardware device between S and end-user clients
S uses both TCP and UDP for service.
A client (C) connect to S and establish UDP virtual connection.
For knowing ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
0
votes
0answers
1k views
What program could try to reach fbstatic-a.akamaihd.net:443 continuesly? [closed]
Social networking is blocked by K9 Web Protection. The keywords "fb", "facebook" are blokked as well. However K9 continuesly pops up the following:
http://i.stack.imgur.com/FviFb.png
It says ...
2
votes
1answer
139 views
Normalizing Windows Advanced Firewall rules
How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
0
votes
1answer
194 views
icmp packets not able to reach the firewall despite of adding a specific rule, why?
I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):-
[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target ...
2
votes
3answers
308 views
Is it really better to use port 80 or 443 for outgoing traffic in order to bypass user firewall?
I recently created a reverse connection shell in C#. I tested it with some computers and I noticed that some computers connected back correctly and I established connection with them but another ...
1
vote
2answers
788 views
What justification is there for Comcast to block SMTP port 25 outbound from residential service?
Within the last week, Comcast seems to have started blocking port 25 outbound from their residential internet service.
I can sort of understand why they might justify blocking it inbound as perhaps ...
0
votes
3answers
385 views
Best practices for firewall hardware
I'm planning to implement a linux based firewall/router with at least 6 x 1Gb NIC's (network with ~300 computers/server with >=8 VLANs)
Can anybody recommend hardware best practices (reference to ...
0
votes
1answer
275 views
Websocket implication for firewalls
(I've read several questions here about websocket but apparently there's no websocket tag)
If I understand correctly websockets are using TCP trafic over port 80.
What are the implication, if any, ...
5
votes
2answers
316 views
Is this a DNS attack?
The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
0
votes
0answers
121 views
Tool too scan open ports on a firewall [closed]
How can we check which ports are open on a firewall that use header flags?
Any free tool that sends packets to the host to map these ports?
2
votes
1answer
136 views
Blacklisting during a penetration test?
So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in ...
0
votes
1answer
69 views
Situations that a firewall should use rule for all packets
When should a "match all packets" rule be used (instead of chain policy)?
I think that this should be used in real time applications like audio streaming or video broadcasting. Are there other ...
0
votes
1answer
112 views
Packet-filtering firewall evasion (Scanning)
Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
2
votes
2answers
285 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
3
votes
2answers
144 views
How to red team against firewalled architecture?
Prior Knowledge
I understand the types and differences between firewalls.
I have (what I believe to be) a relatively good mental model of a firewall.
I understand routing, iptables, signature ...
1
vote
1answer
113 views
What are the basic implementations that make a network secure from the inside\outside?
Would you consider the following to be "basic hardening items" for network equipment and servers?
VLANs
Access Control (such as NTFS permissions)
Patch Management System
Host Firewall
Anti-Virus
...
6
votes
3answers
386 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
