Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

2
votes
2answers
623 views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
1answer
398 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
0
votes
1answer
406 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
4
votes
3answers
2k views

Effectively limiting outgoing firewall traffic to frequently-changing IPs

PCI DSS 1.2.1 states: Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. Verify that all other inbound and outbound traffic is ...
8
votes
2answers
4k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
2
votes
3answers
1k views

Firewall Migration: NetScreen NS500 to FortiGate [closed]

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
3
votes
1answer
310 views

Why strip accept-encoding?

It seems that there are multiple "security" products which strip or mangle 'Accept-encoding' headers, thus forcing non-compressed responses from HTTP servers. I've been trying to imagine if there's ...
9
votes
3answers
2k views

Evasion techiques for WAFs

Are there any documented techniques for evading Web application firewall for testing WAF rule configurations?
2
votes
2answers
360 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
0
votes
1answer
187 views

How to secure unprotected Telnet Server on Droid 3

I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
-1
votes
1answer
2k views

How to bypass firewall protection to hack windows server 2003? [closed]

I am trying to hack windows server 2003 sp2, i can see a lot of services running on target, there is also a lot of backdoors listing on ports like netbus, remote-everything .... But Firewall (as i ...
1
vote
1answer
330 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
1
vote
2answers
158 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
2
votes
3answers
6k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
3
votes
2answers
4k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
1
vote
1answer
444 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
1
vote
2answers
1k views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
3answers
2k views

How to setup an internal firewall

I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
13
votes
2answers
27k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
1
vote
1answer
241 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
2answers
335 views

Securing a VPN connection

I'm new to this we want to install a new VPN connection that will be used to connect using Internet to some networks in the office the contractor want to use a" Cisco NAC Network Module or Cisco IPS ...
-1
votes
1answer
308 views

What do current generation firewalls lack?

Are current generation firewalls ( both commercial and open source) good enough to combat current generation attacks (of course when properly configured) ? By large , what do current generation ...
3
votes
3answers
3k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
4
votes
5answers
415 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
0
votes
2answers
110 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
0
votes
2answers
1k views

Enabling firewall for the IPv6 tunnel on Windows 2008 64-bit

I am currently on a IPv4 network. The IPv4 network is accessed by a router, which gives my machines IPv4 addresses via NAT. On one of the machines, a Windows 2008 64-bit machine, I have set up a IPv6 ...
-2
votes
1answer
1k views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
4
votes
2answers
704 views

Configure Linux to allow network activity based on binary?

On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
1
vote
1answer
2k views

How do these Windows services affect the security of Windows Firewall?

Its common to disable unneeded services in Windows 2008 R2, but sometimes I come across installations that use Windows Firewall and related services. More info: see service dependencies for Windows ...
0
votes
1answer
730 views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
3
votes
3answers
9k views

Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget? # Allow ...
8
votes
5answers
14k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
2answers
238 views

Correct way of establishing if the switch is sending syslogs?

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan nmap -sV -p514 xxx.xx.xx.xx The result came out as closed. Does this ...
0
votes
3answers
676 views

An alien packet from the switch shut down my ethernet card when using nessus?

I'm stuck in between a very bad cocktail mix of two very desperate technologies. One is Nessus and other is a Juniper EX2200. When I'm running the two together, the NIC on my HP MiniTower 6200 Pro ...
1
vote
2answers
3k views

IP Spoofing a threat?

Quick Security Question if i may. We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or ...
1
vote
2answers
284 views

Can I connect our network to the internet but only allow connections to certain servers?

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
2
votes
1answer
253 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
3
votes
2answers
1k views

Reviewing IP(s) that has been blocked by firewall / router

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list? Occasionally, the firewall guys see a high counts ...
1
vote
2answers
1k views

Firewall audit log management tools [closed]

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
1
vote
2answers
1k views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
0
votes
0answers
20 views

What are some real world examples of screened subnet firewall architecture? [duplicate]

Possible Duplicate: Public DMZ network architecture screened subnet firewall architecture has a DMZ the outisde world doesnt know about the inside network beyond DMZ and inside doesnt know ...
10
votes
1answer
3k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
2answers
621 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
25
votes
4answers
12k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
21
votes
12answers
49k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
1
vote
2answers
7k views

How secure is blocking all incoming connections on my ADSL or cable router?

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic. Assuming, for the sake of argument, no extra security is ...
0
votes
1answer
1k views

Router with good Firewall for office - total of 50 computers/devices including wifi devices [closed]

I am looking for a good Office Router that can handle good firewall rules, have logs, and ca support about 50 computers/devices connected with wire and wireless. We had different models before, and ...
2
votes
2answers
327 views

How to use an old PC as a firewall on a tight budget?

I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic that I've ...
2
votes
3answers
10k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...