Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

3
votes
2answers
70 views

How to restrict access to the internet for some computers on the network?

I’d like to differentiate machines (or, possibly, users) on my small business network so that only some of them have access to the internet. The solution I’ve been using to this day is quite terrible: ...
3
votes
2answers
73 views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
1
vote
0answers
44 views

The process of using Metasploit to get in Systems [closed]

I am new in metasploit. I get the basic concept of exploiting a system or whatever your trying to do. You find a vulnerability in a system, you use an exploit or make one. Doing that on your local ...
7
votes
1answer
186 views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
2
votes
1answer
50 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
1
vote
1answer
95 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There ...
4
votes
2answers
80 views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
2
votes
2answers
75 views

A couple of questions about port scanning

I have alot of questions on my mind right now, but I'll only ask the ones that are particularily intriguing me. First off: - I port-scanned my Public IPV4 address; and it returned a few ports being ...
2
votes
1answer
43 views

Check Point SSL Certificate Interception [duplicate]

Can someone please explain how Check Point enterprise firewalls are able to read SSL traffic? My boss briefly explained that our company's firewall, which is Check Point, is able to intercept SSL ...
1
vote
0answers
36 views

Is it possible to block a debugger from connecting locally?

I work at an enterprise with enterprise-type software on my machine regarding firewalls, virus scanning, and vpns. I'm also a developer. If I'm not connected to the internet I'm not able to debug my ...
13
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
1
vote
2answers
130 views

Firewall tiered architecture and firewall brands in today's context

In the past, we were often taught that we should have at least two layers of firewalls and it was best to use different brands so that at least it would make it more difficult for hackers to ...
12
votes
4answers
291 views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
5
votes
4answers
1k views

Are firewalls required if using a VPN [closed]

If you are using a VPN to transmit data from router to router, do you still need a firewall? I am using a VPN Server to encapsulate data from one cisco router to another. Do I need to have a firewall ...
0
votes
1answer
174 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
0
votes
0answers
26 views

where can we download SourceFire log/message guide?

I need to write few alerts in SIEM based on Device:Sourcefire. Can anyone let me know from where we can download Sourcefire log/message ID as CISCO ASA firewall has it.
2
votes
1answer
113 views

What is the core purpose of a firewall on a linux server that is connected to the internet?

When I deploy new linux servers - I start off with a bare bones Ubuntu Server OS and install only the services that are needed. SSH webserver - port 80 These services have iptables rules setup to ...
2
votes
2answers
356 views

Telnet port open on my router public IPv6 address

Recently I upgraded my home router into this one. It is a cheap one, but it has features I needed: IPv6 support and Gigabit Ethernet. So I decided to give IPv6 a try. I configured a Hurricane ...
1
vote
0answers
30 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp ...
-5
votes
1answer
101 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like ...
3
votes
3answers
397 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
1
vote
1answer
72 views

Preventing outgoing Portscan/SYN/UDP Floods in the datacenter

We are a VPS hosting company that have servers housed in a datacenter in Germany. Currently we are receiving multiple take-down requests because customers are ports scanning or attacking servers ...
3
votes
2answers
253 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...
1
vote
0answers
34 views

Unfamiliar connection alert on Little Snitch

I've got a Macbook running Yosemite 10.10.5, on wifi, sharing it with three other people in the household. I currently have Avast on my Macbook (I know, I know), and its web shield works by acting as ...
1
vote
1answer
111 views

Strange IP's on my firewall log

Check the screenshot of my router firewall log below, I can see traffic originating from strange IP addresses to my public address. What are these? I've just setup this router few hours ago, am I ...
1
vote
1answer
45 views

Scope for information security in 2yrs down the lane? [closed]

I'm a fresher. Very recently I started doing Java course because of the wide opportunities we get to enter into an IT industry. Now, I've got an opportunity to work for a project that's related to ...
1
vote
1answer
108 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Win7 installed on 26 Aug'15 and fully updated). Trojan ...
2
votes
1answer
112 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
1
vote
2answers
331 views

What is the real benefit of a three tier architecture?

As per title, what is the real advantage of using three tiered architecture, where the user interface in one layer, the second layer for application and third layer for database? I can understand that ...
2
votes
2answers
36 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
10
votes
2answers
1k views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
1
vote
1answer
45 views

Using a Firewall to Trigger Truncation in DNS UDP Response

Assume I am a firewall between client and server. If the client sends a DNS query with UDP, I should response this query with set the truncated flag=1. As a result, the client will be forced to use ...
0
votes
1answer
168 views

How to block detour programs that bypass firewalls?

We setup a ISG-1000 firewall about a month ago with the goal of blocking specific URLs. Please see image file below in which there are 70EA PCs. Even though we think we blocked specific URLs, some ...
1
vote
2answers
915 views

Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or ...
3
votes
1answer
323 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
1
vote
2answers
47 views

The workings of a stateful firewall

Say I have network A and network B. I wish to SSH from network A to network B. Hence, I would set a route from network A to B, and in the stateful firewall, I will allow a rule for Network A to B at ...
2
votes
3answers
149 views

Open ports with no services binded to them

I have been wondering, if a port is open for inbound connections on the firewall yet there is no service binded to it, would that be considered a security vulnerability?
-2
votes
1answer
96 views

Random scanning or potential attack/recon? [duplicate]

If the purpose of a SYN Flood attack would be to make the target unresponsive to normal traffic, same as any other DoS, wouldn't this attack generally have been directed at a public server rather than ...
2
votes
2answers
116 views

Preventing active OS fingerprinting with iptables

I'm studying network security on my own and I have a few basic theoretical questions here. Would dropping every incoming packet at the network layer be enough to prevent active OS fingerprinting? I ...
4
votes
2answers
109 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
1
vote
0answers
86 views

how to configure naxsi to accept json format in rest apis?

For example one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with naxsi, I could not find anywhere to config naxsi ...
6
votes
5answers
383 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
1
vote
1answer
88 views

what is more secure, to have PPPoE on the modem or on the firewall

We are trying to understand what a more secure installation is: a) A modem connected to the internet with PPPoE doing a NAT to the firewall than doing a second NAT for all the devices b) A modem ...
1
vote
3answers
237 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
5answers
84 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
4
votes
2answers
188 views

Firewall egress filtering by domain

In our production environment, we are connecting to a few core external service providers though their APIs, and are required to have all other services blocked (PCI DSS). We currently have a ...
4
votes
1answer
76 views

Is there such thing as an OS “internal firewall”

I was wondering if there is such thing as an OS "internal firewall". If it exists, it must be under a different name. I am looking for a way to control which applications can talk to which other ...
0
votes
1answer
96 views

Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls

All of the material I'm reading on Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls indicates that they are inherently unique devices / applications. ...
1
vote
0answers
105 views

Web/search engine spider on local network?

I was setting up a test webserver on my local network earlier, and whilst sorting out the firewall I noticed the following in the log (/var/log/ufw.log - I'm using UFW on Ubuntu 14.04): Jul 9 ...
1
vote
2answers
81 views

Safety of routing a network to a firewall

I am studying for my CompTIA Security+ qualification and have come across the following question. Question : You are implementing a testing environment for a development team. They use several ...