Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

-6
votes
1answer
49 views

Am I Being Hacked? [on hold]

A little long story follow me. I have had a weird experience with my pc in the past couple of days. It happened to me like a year ago. It was that my pc would open some weird trolling website every ...
0
votes
0answers
13 views

Open source software that does virtualised emulation like Fireeye and Palo Alto networks [on hold]

Fireeye Palo Alto networks and the number of other next-generation firewall vendor's provide virtualised sandbox emulation feature where an unknown file type will be executed in a virtualised sandbox ...
2
votes
1answer
32 views

Network Architecture for CTF-scenario [on hold]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
0
votes
0answers
71 views

Isolating Computer on Home Network Using Multiple Routers

My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent ...
2
votes
0answers
21 views

How to enable Windows firewall to log attempts to connect to closed (not listenting) ports? [migrated]

We have some servers with Windows firewall and logging enabled for dropped connections. We observe that when we do a port scan with nmap, the log (pfirewall.log) only reports attempts to connect ...
0
votes
0answers
23 views

How does a firewall protect against denial of service attack? [duplicate]

I do not know much about firewalls etc, but I am curious as to how a firewall protects against Denial of service attacks. My understanding is that, sending a lot of requests(more than the server ...
5
votes
1answer
147 views

If all ports are closed, do I need firewall?

I often read an article which enables a firewall to secure public Wi-fi. But I think a firewall may not be needed when (like nmap said) all ports are closed. If all ports are closed, all packets ...
4
votes
1answer
52 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
0
votes
0answers
26 views

LAN client attempting to connect to many unkown IPs on Boot [migrated]

I have a Zywall 110 Firewall. While perusing the logs I was seeing random bursts of attempted connections to unknown external IP addresses from a single LAN client computer. I noticed because I would ...
0
votes
0answers
18 views

problems in ipv6 firewall configurations [closed]

For the below configurations, I am not able to connect the system from ip: 2606:a000:122d:113:f456:ca4d:fe2:2656.so, i removed the DROP rule from ipv4 configurations then it is allowing to ...
6
votes
4answers
668 views

Using unusual port numbers [duplicate]

Are there any security benefits to setting up the ports on your firewall to non-standard numbers? For example, using port 15 for the SQL service.
2
votes
2answers
30 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
0
votes
1answer
52 views

Is it safe to host passwordless web applications/software with web GUI in Virtual Machines

I have a Linux Mint Virtual Machine which I use quite a lot with my Windows host. I have lots of Software installed there (mostly with web GUI so I can access them from host easily). So I am ...
-1
votes
0answers
18 views

FIN Flag - Evade Firewall [duplicate]

I would want to understand how which setting a FIN Flag. That flag closes the connection. Can someone explain me how FIN Scan do it?
0
votes
0answers
25 views

Windows Firewall Log question

I have a question about log entries within my Windows Firewall log. I see these kind every now and then: #Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack ...
0
votes
1answer
113 views

A seemingly innocent program is attempting to connect online. Should I be worried?

OS: Windows 10 64-bit updated, usually used for development and Steam-CSGO. Straight to the point: Solitaire just tried to connect to the internet. Details: After tightening my firewall rules after ...
3
votes
1answer
54 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
2
votes
0answers
61 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
3
votes
2answers
50 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
6
votes
1answer
161 views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...
18
votes
8answers
3k views

A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?

I know my way around firewalls, but I am in no way a security expert. And recently, I am wondering how to effectively configure the outbound rules of any company's firewall. For the question's sake, ...
4
votes
4answers
232 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only ...
0
votes
0answers
46 views

Why does Windows realtime protection block specific URLs?

I have observed this strange behaviour with Windows (7 to 10). When active realtime protection is enabled, it blocks my own website. The page has nothing special (PHP and JavaScript), just good old ...
5
votes
2answers
357 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
2answers
59 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
1
vote
1answer
77 views

How to remote access a server behind firewall? [closed]

I have a server with defined IP address (it is for my own usage). I would like to use it from remote access. The server is behind a firewall. Is there a way to access it from remote computer? Is ...
4
votes
1answer
209 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
1answer
90 views

Can network admin detect an MiTM attack?

I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS). If someone on my network launches an MiTM attack on me, will the network admin be able to detect this? Does an ...
0
votes
1answer
82 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
24
votes
2answers
2k views

What does the Juniper backdoor actually allow an attacker to do?

The Juniper ScreenOS backdoor recently discovered provides administrative access to these firewalls, but in terms of access to valuable data can it actually provide an attacker with anything useful ...
1
vote
0answers
28 views

Fortigate monitoring with SNMP and Devmon template

I'm trying to monitor some aspects from our Fortigate firewall (like how many traffic goes through each tunnel) through a combination of Xymon, Devmon and SNMP. I downloaded the MIB files from the ...
1
vote
1answer
60 views

Shared Global Blacklist Trust Issue

Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the ...
4
votes
2answers
89 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
1
vote
2answers
113 views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host ...
4
votes
2answers
125 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
-1
votes
2answers
95 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
2
votes
2answers
118 views

I am not connecting to internet, do I still need the windows firewall on?

Forgive my ignorance but I am truly uncertain. Here is my situation: I have dual booted a Linux distro and Windows 7 on my machine. Windows 7 sole purpose is for gaming, that's all. I'm not planning ...
1
vote
2answers
91 views

What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?

Say I have a Windows Server (let's go with Windows Server 2012, but I'm thinking in general). It's running IIS. We have our standard website, accessible via port 80 (HTTP) and 443 (HTTPS). And let's ...
1
vote
1answer
43 views

What is the procedure to implement security zones in a production network without impacting negatively in the communications?

In an organization where there exist a network with VLANs where the communication between all VLANs is allowed we are going to install a firewall and define security zones. The security zones will ...
1
vote
1answer
56 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
3
votes
1answer
37 views

Firewall - Allow WMI internal network

I am not totally sure if this is the correct stackexchange to place this question, so just let me know if it should be somewhere else. I am looking into IT asset management systems and for these ...
-1
votes
1answer
33 views

Testing back-end firewall ruleset [duplicate]

I would like to perform a ports scan from an internal workstation to a server in the DMZ and then the other way around to get a print of incoming/outgoing firewall rules. The idea would be to open ...
0
votes
1answer
47 views

Detect HTTPS self signed certificate in (DPI) firewall

TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how? A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default ...
-1
votes
1answer
120 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
1
vote
2answers
183 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
1
vote
1answer
59 views

Debian 8 and few questions about Graphical Firewall?

I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up. ...
2
votes
3answers
90 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
4
votes
1answer
161 views

Block this DDoS attack

since more than a week my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack, ovh don't care about it but this attack is killing my server with a high CPU load (permanent ...
2
votes
1answer
75 views

Can in a VPN LAN-to-LAN one site be completely isolated from the other?

In a VPN LAN-to-LAN setting, is it possible to isolate one site from the other? I know that we can use a firewall but that would obligate us to manage specific rules in the firewall. I would like to ...
1
vote
1answer
63 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...