Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
0answers
24 views

Restrict outgoing network traffic by domain name (Linux)

My root goal is to be able to prevent attackers from making unauthorised outgoing connections on my server (e.g. for connect-back shells). I can achieve this by blocking all ports for outgoing ...
6
votes
2answers
442 views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
0
votes
0answers
60 views

Is there any method to prevent/trace ddos attack?

I have a debian linux server which run a few online game services. I have some competitors in this area and i think one of them is behind the ddos attacks. I have full access to the router, so I set ...
4
votes
2answers
36 views

Security concerns allowing internet connected server to write on network server

I don't know much about network engineering since I just started becoming a programmer. The situation is, that my company has a web-interface hosted on one of our servers that is connected to the ...
0
votes
2answers
58 views

Persistent Connection Attempts By Akamai Technologies

I have seen this question asked in different places, but have never seen a satisfactory answer: On different computer builds, ASUS/GIGABYTE/MSI, I constantly have outgoing connections to ...
1
vote
2answers
60 views

Security risk with using internal IP on public DNS

A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP. Publicly, company.com nameservers belong to their ...
14
votes
5answers
2k views

Does it add anything to restrict IP address?

I have an https website that is protected by a login form (username + password). Does it add anything, protection wise, if I put this website behind a firewall that only allow certain IP address?
1
vote
0answers
13 views

ModSecurity WAF - Apache Wont Restart [migrated]

I just installed Mod_Security module on my VPS server. I moved the core rules to the activated rules folder which didn't cause an error. But put these commands in my mod-security.conf file and restart ...
1
vote
0answers
10 views

how to allow a subnet to surf internet in Juniper and Cisco ASA [migrated]

how to allow a subnet to surf internet in Juniper and Cisco ASA is there an configuration example to show allow a subnet of class C IP address to surf internet in Juniper and in Cisco ASA ? assume ...
0
votes
1answer
54 views

Firewall Benchmark, Checklist, Guideline?

I'm doing some research on checklist, benchmark, hardening guidelines. And I couldn't find specific documents for security checklist for firewall. CIS had this document, but it was only for Cisco ...
2
votes
2answers
74 views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
0
votes
0answers
54 views

How to configure ettercap-ng's etter.conf to use sysctl instead of ipfw for sslstrip plugin to work on OSX Yosemite?

When I run ettercap-ng with sudo ettercap -Tq -i en1 -M arp /// I get the an error based on ipfw from the etter.conf file, like this: WARNING: ...
1
vote
1answer
52 views

Understanding nmap output / author explanation …(Scapy)

I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi. I think the example is very ...
0
votes
2answers
45 views

What are the main reason to deploy Secure Web Gateway?

As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
2
votes
1answer
87 views

Firewall and Torrent

I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using ...
1
vote
0answers
22 views

Right security architecture for SQL Server access in a distributed Windows-based system [closed]

I am designing a software product for which multiple SQL Server databases will be accessed by multiple applications residing in different Windows environments. Some of the environments are process ...
31
votes
4answers
3k views

Is there any meaning in only allowing port 80 and 443 today?

It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports ...
2
votes
2answers
80 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
1
vote
4answers
179 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets inbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
1
vote
0answers
42 views

Anything more i can do to be more safer? [closed]

Wi-fi security: WPS disabled WPA2-PSK + AES + 54.000 SECONDS(15h) Group Key Update Period UpnP disabled Spi firewall enable All ALG enable Ignore ping packet from WAN and Lan to router Default ...
4
votes
2answers
43 views

monitor port scan on the same segment

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to ...
1
vote
0answers
46 views

firewall zones for private web server

How can I configure the zones of a firewall to provide maximal security for a private web application? Here is the use case: 1.) Twenty known users will have http/https access to the web ...
0
votes
2answers
398 views

Port Scan Detected and Blocked! - Bitdefender 2014

I have Bitdefender Total Security 2014 Recently I have been getting the message/alert "Port scan detected and blocked", I did not cared about it much till I getting increasing specially in a specific ...
2
votes
1answer
81 views

Using Linux iptables to implement a stateless, packet filtering firewall

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard ...
0
votes
0answers
47 views

Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos

Hello I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server. I wanna do this using Netsh advfirewall, In Linux I use IPTables: iptables -I INPUT -p tcp --dport ...
0
votes
1answer
55 views

What is a Sonic Wall? [closed]

I found an old box in my garage and it contains a 'sonicwall' device. It looks like a huge router but I am unsure what it does. Do I hook it up between my modem and router and it somehow provides ...
0
votes
4answers
90 views

Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound and outbound

Do firewall rules have to be symmetric? That is, does a firewall have to block a particular traffic type both inbound (to the protected site) and outbound (from the site)? Why or why not? I have to ...
1
vote
1answer
41 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
51
votes
9answers
5k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
0
votes
4answers
118 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
4
votes
4answers
178 views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
2
votes
1answer
96 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
1
vote
2answers
50 views

Proper way to allow access to systems within different offices? [closed]

I have a system that sysadmins in a few of our global offices need to access. What is the best way to grant them access through our firewall to this system? I don't think that having them use static ...
-1
votes
2answers
150 views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
1
vote
1answer
106 views

Upload data from Internet to DMZ to an intranet

I've got the following situation: A web server located in a DMZ receives file uploads from web browsers. The uploaded files are stored on the web server's file system. In the next step, these files ...
1
vote
1answer
51 views

How can I keep track of the packages to check any strange behaviour [closed]

I've just realized there was a girl that asked someone to hack my computer and also my telephone (that's why WhatsApp was working strange). Right now I'm trying to protect myself at least on my ...
2
votes
4answers
79 views

Do I need antivirus for this unusual installation - or just firewall?

I'm donating an old Windows XP laptop to a school. The machine will spend its golden years doing only one thing - a process that consists of just three steps: Recording lectures and discussions ...
0
votes
1answer
56 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
0
votes
1answer
61 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
1
vote
1answer
110 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
-1
votes
2answers
63 views

Tools to check the firewall Configurations as per PCI standards [closed]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
2
votes
1answer
115 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
1
vote
1answer
139 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
1
vote
2answers
75 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
2
votes
3answers
128 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
1
vote
1answer
98 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
2
votes
0answers
221 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
0
votes
3answers
85 views

Confusion over a firewall and proxy

A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443? Also, if a firewall is to control outbound ...
0
votes
1answer
120 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
2
votes
2answers
87 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...