Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

4
votes
5answers
414 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
0
votes
2answers
109 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
0
votes
2answers
1k views

Enabling firewall for the IPv6 tunnel on Windows 2008 64-bit

I am currently on a IPv4 network. The IPv4 network is accessed by a router, which gives my machines IPv4 addresses via NAT. On one of the machines, a Windows 2008 64-bit machine, I have set up a IPv6 ...
-2
votes
1answer
978 views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
3
votes
2answers
686 views

Configure Linux to allow network activity based on binary?

On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
1
vote
1answer
2k views

How do these Windows services affect the security of Windows Firewall?

Its common to disable unneeded services in Windows 2008 R2, but sometimes I come across installations that use Windows Firewall and related services. More info: see service dependencies for Windows ...
0
votes
1answer
705 views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
3
votes
3answers
9k views

Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget? # Allow ...
8
votes
5answers
13k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
2answers
222 views

Correct way of establishing if the switch is sending syslogs?

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan nmap -sV -p514 xxx.xx.xx.xx The result came out as closed. Does this ...
0
votes
3answers
669 views

An alien packet from the switch shut down my ethernet card when using nessus?

I'm stuck in between a very bad cocktail mix of two very desperate technologies. One is Nessus and other is a Juniper EX2200. When I'm running the two together, the NIC on my HP MiniTower 6200 Pro ...
1
vote
2answers
2k views

IP Spoofing a threat?

Quick Security Question if i may. We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or ...
1
vote
2answers
277 views

Can I connect our network to the internet but only allow connections to certain servers?

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
2
votes
1answer
246 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
3
votes
2answers
1k views

Reviewing IP(s) that has been blocked by firewall / router

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list? Occasionally, the firewall guys see a high counts ...
1
vote
2answers
997 views

Firewall audit log management tools [closed]

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
1
vote
2answers
1k views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
0
votes
0answers
20 views

What are some real world examples of screened subnet firewall architecture? [duplicate]

Possible Duplicate: Public DMZ network architecture screened subnet firewall architecture has a DMZ the outisde world doesnt know about the inside network beyond DMZ and inside doesnt know ...
10
votes
1answer
3k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
2answers
608 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
25
votes
4answers
11k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
21
votes
12answers
46k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
2
votes
2answers
7k views

How secure is blocking all incoming connections on my ADSL or cable router?

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic. Assuming, for the sake of argument, no extra security is ...
0
votes
1answer
1k views

Router with good Firewall for office - total of 50 computers/devices including wifi devices [closed]

I am looking for a good Office Router that can handle good firewall rules, have logs, and ca support about 50 computers/devices connected with wire and wireless. We had different models before, and ...
2
votes
2answers
319 views

How to use an old PC as a firewall on a tight budget?

I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic that I've ...
2
votes
3answers
9k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
8
votes
3answers
6k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
1
vote
1answer
1k views

Open source firewall with multi wan support [closed]

I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed. ...
7
votes
3answers
11k views

Why do I need a firewall on my router?

I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall. I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
6
votes
4answers
564 views

“There's a firewall on the router into the building so you can turn the one on your computer off”

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
3
votes
1answer
2k views

w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?

It's only an idea. I've recently logged that my server is scanned by w00tw00t tools. I found many solutions to this, such as use of apache mod-security, fail2ban, etc.. The one I want to speak ...
2
votes
1answer
629 views

Large lan party : How to identify the users on the network?

I would like to know what are the good way to identify users on a large lan party when you manage network ? I had the idea to make the users register them self at a desk, they give us Firstname, ...
4
votes
3answers
4k views

Which of these ports are safe to leave open, which are not?

I just ran nMap against my IP address and got the following result: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https ...
3
votes
1answer
2k views

How can I find the process that is trying to use smtp to send email?

Previously I asked Who (which process) is calling curl? and I got very good answers (this answer in particular) which basically replace the curl binary with a shell script that logs each call to curl ...
1
vote
2answers
5k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
2
votes
1answer
207 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
0
votes
1answer
891 views

Cisco PIX SNMP enabled or not?

On a Cisco PIX firewall, I wanted to check if SNMP is enabled: pix# sh snmp-server no snmp-server location no snmp-server contact snmp-server community public no ...
5
votes
1answer
1k views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
0
votes
1answer
227 views

FoundStone scan + URI filtering

I have a server that is protected with a firewall with URI filtering rule. So if you go http://x.x.x.x/URIFilter/Something you will get to the server, but if you don't put URIfilter into URL or use ...
2
votes
1answer
3k views

Something causing Sonicwall to throw Smurf Amplification Attack Warning?

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...
8
votes
1answer
460 views

Is Chinese great firewall white or black list based? [closed]

Is a new website blocked by default in China ? I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed). However a friend of a ...
4
votes
1answer
214 views

firewall with cloud based malware analysis risks

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
2
votes
1answer
2k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
4
votes
1answer
7k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
5
votes
4answers
2k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
0
votes
1answer
3k views

i, I, o, O packet inspection points inside a Check Point firewall

In a Check Point firewall, can you please explain what occurs between the POSTIN (I) and PREOUT (o) inspection points?
2
votes
2answers
1k views

Why is my firewall blocking on some files but not others?

I'm behind a corporate firewall which restricts access to certain urls and most downloads. The download restriction is mainly on .exe(but it allows some exe files to be downloaded and I don't know ...
0
votes
1answer
2k views

windows security alert windows firewall has blocked some features of this program message coming for every new build of my application

I made an application which uses ftp so windows shows windows security alert windows firewall has blocked some features of this program message for every new version of my application any idea how to ...
4
votes
3answers
4k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
1
vote
1answer
839 views

Client access to domain controller

I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity. AD Query ...