Tagged Questions
0
votes
1answer
72 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
2
votes
2answers
77 views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
3
votes
3answers
96 views
Securing a network attached storage on the internet
I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.
I'd like to secure ...
6
votes
3answers
187 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
0
votes
1answer
111 views
Packet-filtering firewall evasion (Scanning)
Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
2
votes
2answers
269 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
1
vote
1answer
113 views
What are the basic implementations that make a network secure from the inside\outside?
Would you consider the following to be "basic hardening items" for network equipment and servers?
VLANs
Access Control (such as NTFS permissions)
Patch Management System
Host Firewall
Anti-Virus
...
6
votes
3answers
364 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
5
votes
1answer
74 views
Are temporary blocks sufficient response to network probes?
We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
...
0
votes
1answer
132 views
How do I use two different Public IP to add a new server to the DMZ? [closed]
My network looks something like this;
INTERNET»»ROUTER»»ASA FIREWALL»»»INTERNAL NETWORK
Right now, we are using a public IP in a range like for instance of 50.224.157.105, which we are using in the ...
0
votes
3answers
266 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
2
votes
1answer
107 views
What security risks are involved with sending data over the internal network on Rackspace Cloud servers?
What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers?
Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
20
votes
7answers
4k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
1
vote
2answers
485 views
How to check if a port can be accessed from the outside
I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
3k views
How to block some websites in a small office?
I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites.
My current connection is ...
2
votes
1answer
192 views
SSL VPN placement strategies
I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations:
with firewall
within the internal network
within the DMZ
Any reference also ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
2
votes
3answers
414 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
0
votes
3answers
600 views
How to setup an internal firewall
I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
1
vote
2answers
168 views
Securing a VPN connection
I'm new to this
we want to install a new VPN connection that will be used to connect using Internet to some networks in the office
the contractor want to use a" Cisco NAC Network Module or Cisco IPS ...
3
votes
3answers
969 views
How can reverse proxies be used to bypass acceptable use policies of a company?
I am wondering how reverse proxies can be used to bypass company acceptable use policies?
What can be done to prevent it?
0
votes
2answers
118 views
Can I connect our network to the internet but only allow connections to certain servers?
At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
1
vote
1answer
121 views
Maximum protection on a computer network?
I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
7
votes
2answers
719 views
ports blocked by firewall and not the server
I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
2answers
311 views
1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab
I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers
This is my plan for a topology but I am new at this so I need help.
I am basing this off the ...
12
votes
10answers
8k views
Public DMZ network architecture
Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one:
Now that I got employed, my boss, a ...
2
votes
2answers
194 views
Project help required by a newbie!
Basically, I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic ...
4
votes
4answers
753 views
Block all BotNets and TOR addresses from accessing our site
I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
1
vote
1answer
329 views
Open source firewall with multi wan support [closed]
I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed.
...
4
votes
3answers
1k views
Why do I need a firewall on my router?
I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall.
I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
6
votes
5answers
406 views
“There's a firewall on the router into the building so you can turn the one on your computer off”
I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
2
votes
1answer
764 views
w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?
It's only an idea. I've recently logged that my server is scanned by w00tw00t tools.
I found many solutions to this, such as use of apache mod-security, fail2ban, etc..
The one I want to speak ...
2
votes
3answers
694 views
Recommendations for security gateway/firewall management tools (Juniper SRX)
I am seeking recommendations for management tools for high-end firewalls, such as the Juniper SRX3000 series. When I say "management", I mean operations, configuration management, policy management, ...
8
votes
1answer
224 views
Is Chinese great firewall white or black list based? [closed]
Is a new website blocked by default in China ?
I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed).
However a friend of a ...
0
votes
1answer
655 views
Juniper SRX210, how to make port forwarding work? [closed]
I have a PC 192.168.1.151 which needs 554 and 9001 publicly available. So I used the following configuration but it does not work. Can anyone see my mistake ?
version 10.0R3.10;
system {
...
0
votes
1answer
582 views
i, I, o, O packet inspection points inside a Check Point firewall
In a Check Point firewall, can you please explain what occurs between the POSTIN (I) and PREOUT (o) inspection points?
1
vote
1answer
473 views
Client access to domain controller
I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity.
AD Query ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
4
votes
2answers
316 views
Firewall design for big enterprise business
I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks.
For example should the network atleast have the following firewall zones?
Client ...
5
votes
1answer
565 views
I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening
So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours.
I'm on a shared port, so I'm ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
4answers
186 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
7
votes
7answers
1k views
What security implications are there for allowing outbound SSH traffic?
My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
2
votes
5answers
375 views
How do a firewall's rules for individual programs work?
I kind of know that how a firewall's rules for IP/port work, but I have no idea how a firewall deals with individual programs.
In other words, how does the firewall know a program wants to access the ...
2
votes
3answers
696 views
Use a Common Firewall for two Different Subnets
I want to implement a security scheme in a new network configuration. There are two buildings for the client:
Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0,
Gateway 10.0.0.1 ( ...
