Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

1
vote
0answers
29 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
1
vote
2answers
57 views

What is the real benefit of a three tier architecture?

As per title, what is the real advantage of using three tiered architecture, where the user interface in one layer, the second layer for application and third layer for database? I can understand that ...
2
votes
2answers
30 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
9
votes
2answers
706 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
-2
votes
0answers
51 views

Can I block HTTP and HTTPS traffic that is going to non-common ports? [closed]

Is there a way to block HTTP and HTTPS traffic over ports that are over 1000? If so how can I do that with either firewall rules or content filtering? Reason being: Crypto is getting dropped through ...
1
vote
1answer
24 views

Using a Firewall to Trigger Truncation in DNS UDP Response

Assume I am a firewall between client and server. If the client sends a DNS query with UDP, I should response this query with set the truncated flag=1. As a result, the client will be forced to use ...
0
votes
1answer
67 views

How to block detour programs that bypass firewalls?

We setup a ISG-1000 firewall about a month ago with the goal of blocking specific URLs. Please see image file below in which there are 70EA PCs. Even though we think we blocked specific URLs, some ...
1
vote
2answers
181 views

Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or ...
3
votes
1answer
90 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
1
vote
2answers
31 views

The workings of a stateful firewall

Say I have network A and network B. I wish to SSH from network A to network B. Hence, I would set a route from network A to B, and in the stateful firewall, I will allow a rule for Network A to B at ...
3
votes
3answers
129 views

Open ports with no services binded to them

I have been wondering, if a port is open for inbound connections on the firewall yet there is no service binded to it, would that be considered a security vulnerability?
0
votes
0answers
11 views

Blocking all remote connections - Cisco LRT214 [migrated]

Recently had a SYN Flood attack on my home office. The attack was stopped by our Cisco LRT214. Most of the configs are manufacturer default. Any way to simply disable all remote connections without ...
-3
votes
0answers
71 views

SYN Flood attack on private user - steps for post-analysis?

The firewall in question, used in a secured home office, reported a series of SYN Flood matches on various requests coming in over a ten-second period. The IP and country of origin changed with every ...
-2
votes
1answer
70 views

Random scanning or potential attack/recon? [duplicate]

If the purpose of a SYN Flood attack would be to make the target unresponsive to normal traffic, same as any other DoS, wouldn't this attack generally have been directed at a public server rather than ...
2
votes
2answers
60 views

Preventing active OS fingerprinting with iptables

I'm studying network security on my own and I have a few basic theoretical questions here. Would dropping every incoming packet at the network layer be enough to prevent active OS fingerprinting? I ...
0
votes
0answers
8 views

What is the correct mask to use with 224.0.0.0? [migrated]

What is the best mask to use to allow computers to use the multicast IP address 224.0.0.0? I've only seen IP addresses using the lower 8 bits, in my case I just see 22 and 251. So my firewall uses ...
3
votes
2answers
48 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
1
vote
0answers
36 views

how to configure naxsi to accept json format in rest apis?

For example one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with naxsi, I could not find anywhere to config naxsi ...
6
votes
5answers
323 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
1
vote
1answer
38 views

what is more secure, to have PPPoE on the modem or on the firewall

We are trying to understand what a more secure installation is: a) A modem connected to the internet with PPPoE doing a NAT to the firewall than doing a second NAT for all the devices b) A modem ...
1
vote
3answers
132 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
5answers
73 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
1
vote
1answer
52 views

Firewall egress filtering by domain

In our production environment, we are connecting to a few core external service providers though their APIs and are required to have all other services blocked (PCI DSS). We currently have a firewall ...
4
votes
1answer
66 views

Is there such thing as an OS “internal firewall”

I was wondering if there is such thing as an OS "internal firewall". If it exists, it must be under a different name. I am looking for a way to control which applications can talk to which other ...
0
votes
1answer
41 views

Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls

All of the material I'm reading on Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls indicates that they are inherently unique devices / applications. ...
1
vote
0answers
68 views

Web/search engine spider on local network?

I was setting up a test webserver on my local network earlier, and whilst sorting out the firewall I noticed the following in the log (/var/log/ufw.log - I'm using UFW on Ubuntu 14.04): Jul 9 ...
1
vote
2answers
66 views

Safety of routing a network to a firewall

I am studying for my CompTIA Security+ qualification and have come across the following question. Question : You are implementing a testing environment for a development team. They use several ...
3
votes
1answer
63 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
-1
votes
1answer
31 views

What is the difference between ASA 5505 Security Appliance and without Security Appliance

Considering the two devices, ASA 5505 Security Appliance and without Security Appliance. What are the differences between having security appliance and without security appliance? I can not find the ...
1
vote
3answers
152 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
3
votes
1answer
95 views

Are Keystroke and Click Loggers Legal? [closed]

I worked with the firewall "Nobero" which is paid and bit expensive. It is a complete Network Firewall including groups policy, banning URLs and social sites. But It has a feature of tracking users' ...
2
votes
0answers
56 views

I'm looking for a decent book on network and infrastructure security [closed]

I'm currently looking for a decent book on network and infrastructure security (especially in the enterprise context). Could you point me to one or two recent books, please? Thanks a lot in advance! ...
0
votes
0answers
19 views

Firewall issues

Background I have an Android device (Minix M5) that I handed to a customer The device only does outbound connections, so no inbound traffic The customer confirmed that s/he opened up the ports ...
0
votes
1answer
48 views

Does firewall count as a subnetwork? [closed]

I need to design a network based on IP 10.1.1.0/24. I have three different subnetworks and a firewall. Does firewall count as a subnetwork? Do I need to assign some IP values to it?
4
votes
1answer
143 views

Benefits of home router behind Linux firewall?

Like a lot of people I have a simple consumer grade router at home. The setup is pretty standard: Ethernet from the cable modem --> router's WAN Given the poor track record of consumer routers ...
1
vote
3answers
152 views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
2
votes
3answers
55 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
0
votes
1answer
58 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
0
votes
0answers
56 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I ...
0
votes
0answers
81 views

How secure are Ubiquiti Networks UniFi AP's restricted subnets?

I have a UniFI AP and create a quest network with subnet restriction 192.168.0.0/16. My local network is in 192.168.178.0/24. The gateway is 192.168.178.1. My question is: Is there a way that quests ...
1
vote
1answer
76 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
0
votes
0answers
46 views

Software Defined Perimeter assumptions, properties, deployment scenarios

Since 2013, the Cloud Security Alliance has been working on an open protocol and open source code base for a "Software Defined Perimeter" (SDP). But the whitepaper at SDP Specification v1.0 : Cloud ...
1
vote
2answers
239 views

VyprVPN (from GlodenFrog.com) weirdly keeps sending unauthorized suspecious data even after uninstall [closed]

Update: Check the VyprVPN's app developer answer below, seems this is okay and an uninstaller is added to new versions to prevent such issues. Original: I was working with VyprVpn a few months ago, ...
0
votes
0answers
39 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
1
vote
0answers
79 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
2answers
95 views

NMap to scan a private subnetwork

I have a test network setup based on virtual machines. My host machine, a web server and the firewall is under the 192.168.0.0/24 network (gateway is 192.168.0.1); a server machine is located behind ...
0
votes
2answers
65 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
2
votes
3answers
196 views

Most secure location of database

Let's say I have a straight forward completely database driven web site application and I store my database on my web server in the DMZ. I won't be broadcasting the IP address of my database because I ...
0
votes
2answers
86 views

Does anyone know how / what this technique is called? [closed]

When using public wireless it needs you to sign in and from what I've gathered it allows you to have access to the internet and provides you with your own network and is not shared with any other ...
9
votes
1answer
2k views

Why is Windows Explorer making external connections?

I'm seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe 4052 ...