Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
0answers
26 views

LAN client attempting to connect to many unkown IPs on Boot [migrated]

I have a Zywall 110 Firewall. While perusing the logs I was seeing random bursts of attempted connections to unknown external IP addresses from a single LAN client computer. I noticed because I would ...
0
votes
0answers
18 views

problems in ipv6 firewall configurations [on hold]

For the below configurations, I am not able to connect the system from ip: 2606:a000:122d:113:f456:ca4d:fe2:2656.so, i removed the DROP rule from ipv4 configurations then it is allowing to ...
6
votes
4answers
658 views

Using unusual port numbers [duplicate]

Are there any security benefits to setting up the ports on your firewall to non-standard numbers? For example, using port 15 for the SQL service.
-3
votes
0answers
25 views

download file from shorten url [on hold]

we are getting shorten urls for file download from our manufacture. When we click on those urls, it is redirect to dropbox or other well knows ftp websites. these website is allowed in our network. ...
2
votes
2answers
29 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
-1
votes
0answers
16 views

Establishing a ssh connection to a server behind a stateful firewall with reverse path [closed]

It has an iptables based stateful firewall with reverse path filtering (tight). All I need is to establish an ssh connection or any other file access port. The only port open to public is 80 and 443 ...
0
votes
1answer
51 views

Is it safe to host passwordless web applications/software with web GUI in Virtual Machines

I have a Linux Mint Virtual Machine which I use quite a lot with my Windows host. I have lots of Software installed there (mostly with web GUI so I can access them from host easily). So I am ...
-1
votes
0answers
18 views

FIN Flag - Evade Firewall [duplicate]

I would want to understand how which setting a FIN Flag. That flag closes the connection. Can someone explain me how FIN Scan do it?
0
votes
0answers
23 views

Windows Firewall Log question

I have a question about log entries within my Windows Firewall log. I see these kind every now and then: #Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack ...
0
votes
1answer
112 views

A seemingly innocent program is attempting to connect online. Should I be worried?

OS: Windows 10 64-bit updated, usually used for development and Steam-CSGO. Straight to the point: Solitaire just tried to connect to the internet. Details: After tightening my firewall rules after ...
3
votes
1answer
54 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
2
votes
0answers
59 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
3
votes
2answers
43 views

Firewall UDP Packet Source Port 53 Ruleset Bypass

I have a question regarding recent PCI DSS scan performed on our network. On some of the Windows 2008 servers (physical and VM), there is a risk found "Firewall UDP Packet Source Port 53 Ruleset ...
6
votes
1answer
154 views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...
18
votes
8answers
3k views

A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?

I know my way around firewalls, but I am in no way a security expert. And recently, I am wondering how to effectively configure the outbound rules of any company's firewall. For the question's sake, ...
4
votes
4answers
225 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only ...
0
votes
0answers
46 views

Why does Windows realtime protection block specific URLs?

I have observed this strange behaviour with Windows (7 to 10). When active realtime protection is enabled, it blocks my own website. The page has nothing special (PHP and JavaScript), just good old ...
5
votes
2answers
354 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
2answers
58 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
1
vote
1answer
72 views

How to remote access a server behind firewall? [closed]

I have a server with defined IP address (it is for my own usage). I would like to use it from remote access. The server is behind a firewall. Is there a way to access it from remote computer? Is ...
4
votes
1answer
202 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
1answer
88 views

Can network admin detect an MiTM attack?

I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS). If someone on my network launches an MiTM attack on me, will the network admin be able to detect this? Does an ...
0
votes
1answer
77 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
24
votes
2answers
2k views

What does the Juniper backdoor actually allow an attacker to do?

The Juniper ScreenOS backdoor recently discovered provides administrative access to these firewalls, but in terms of access to valuable data can it actually provide an attacker with anything useful ...
1
vote
0answers
28 views

Fortigate monitoring with SNMP and Devmon template

I'm trying to monitor some aspects from our Fortigate firewall (like how many traffic goes through each tunnel) through a combination of Xymon, Devmon and SNMP. I downloaded the MIB files from the ...
1
vote
1answer
60 views

Shared Global Blacklist Trust Issue

Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the ...
4
votes
2answers
85 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
1
vote
2answers
108 views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host ...
4
votes
2answers
122 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
-1
votes
2answers
92 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
2
votes
2answers
118 views

I am not connecting to internet, do I still need the windows firewall on?

Forgive my ignorance but I am truly uncertain. Here is my situation: I have dual booted a Linux distro and Windows 7 on my machine. Windows 7 sole purpose is for gaming, that's all. I'm not planning ...
1
vote
2answers
86 views

What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?

Say I have a Windows Server (let's go with Windows Server 2012, but I'm thinking in general). It's running IIS. We have our standard website, accessible via port 80 (HTTP) and 443 (HTTPS). And let's ...
1
vote
1answer
43 views

What is the procedure to implement security zones in a production network without impacting negatively in the communications?

In an organization where there exist a network with VLANs where the communication between all VLANs is allowed we are going to install a firewall and define security zones. The security zones will ...
1
vote
1answer
56 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
3
votes
1answer
37 views

Firewall - Allow WMI internal network

I am not totally sure if this is the correct stackexchange to place this question, so just let me know if it should be somewhere else. I am looking into IT asset management systems and for these ...
-1
votes
1answer
32 views

Testing back-end firewall ruleset [duplicate]

I would like to perform a ports scan from an internal workstation to a server in the DMZ and then the other way around to get a print of incoming/outgoing firewall rules. The idea would be to open ...
0
votes
1answer
45 views

Detect HTTPS self signed certificate in (DPI) firewall

TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how? A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default ...
-1
votes
1answer
120 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
1
vote
2answers
179 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
1
vote
1answer
56 views

Debian 8 and few questions about Graphical Firewall?

I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up. ...
2
votes
3answers
88 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
4
votes
1answer
147 views

Block this DDoS attack

since more than a week my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack, ovh don't care about it but this attack is killing my server with a high CPU load (permanent ...
2
votes
1answer
72 views

Can in a VPN LAN-to-LAN one site be completely isolated from the other?

In a VPN LAN-to-LAN setting, is it possible to isolate one site from the other? I know that we can use a firewall but that would obligate us to manage specific rules in the firewall. I would like to ...
1
vote
1answer
63 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
3
votes
2answers
62 views

How to restrict access to the internet for some computers on the network?

I’d like to differentiate machines (or, possibly, users) on my small business network so that only some of them have access to the internet. The solution I’ve been using to this day is quite terrible: ...
3
votes
2answers
70 views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
1
vote
0answers
44 views

The process of using Metasploit to get in Systems [closed]

I am new in metasploit. I get the basic concept of exploiting a system or whatever your trying to do. You find a vulnerability in a system, you use an exploit or make one. Doing that on your local ...
7
votes
1answer
177 views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
2
votes
1answer
49 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
1
vote
1answer
94 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There ...