Concerned with software or hardware firewalls
3
votes
3answers
405 views
why blocking incoming traffic does not block chatting or VOIP
I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound ...
3
votes
2answers
141 views
Firewall on a VM
I know I could use a software firewall on the guest to achieve a situation similar to this, but is there a way to emulate a firewall (protecting multiple Guests) between a host and guests on a ...
5
votes
1answer
76 views
Are temporary blocks sufficient response to network probes?
We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
...
1
vote
4answers
260 views
Connections through Firewalls explained
I'm looking for a good explanation of how connections work through firewalls.
I've got the idea of packaging(encapsulating) some protocol inside another one as its payload when tunneling.
But what I ...
3
votes
1answer
131 views
HTTPS form submissions are blocked on corporate networks
We have an HTML form which is submitted via HTTPS. We've noticed that when the form is submitted on a home network, it seems to go through just fine. However, when the form is submitted on certain ...
2
votes
1answer
81 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
2
votes
1answer
295 views
Incoming Packet From Source Port 80
I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark:
98.126.43.174 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK]
98.126.43.174 ...
2
votes
3answers
223 views
It's necessary setup a firewall in both PC and router?
If I have the router firewall enabled, it's really necessary setup iptables in my system? Isn't it a little redundant?
For example I add a rule in the router where the PC can't use the port 12345 ...
1
vote
1answer
81 views
Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)
Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
0
votes
1answer
84 views
Weird issue with Firewall blocking NATed packets
From my SIEM I am seeing that a (we don't own the FW) Cisco ASA is blocking packets destined for the internal network (post NAT), here's what I'm seeing (IP addresses are faked due to security)
...
3
votes
2answers
95 views
Blocking executables at the firewall in the enterprise
The infrastructure team in our medium enterprise has requested blocking of all executables at the firewall. We have a firewall which is capable of DLP, so therefore this can be set up fairly easily. ...
1
vote
1answer
153 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
0
votes
0answers
240 views
Looking for OpenSource Firewall [closed]
I am working on Linux environment. I am looking for an open source firewall with code base in C/C++ or Python. Any suggestions.
0
votes
1answer
136 views
How do I use two different Public IP to add a new server to the DMZ? [closed]
My network looks something like this;
INTERNET»»ROUTER»»ASA FIREWALL»»»INTERNAL NETWORK
Right now, we are using a public IP in a range like for instance of 50.224.157.105, which we are using in the ...
2
votes
2answers
77 views
How to define different firewall rules for different users on the same machine running on Windows 7?
Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want:
1, User A ...
8
votes
5answers
1k views
How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
3
votes
2answers
349 views
How secure is opening an incoming port for a java application?
If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be ...
5
votes
2answers
245 views
How should an outgoing connection white-list be created?
I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
0
votes
0answers
22 views
Security value of restricting ports for outgoing connections [duplicate]
Possible Duplicate:
Why block outgoing network traffic with a firewall?
Please provide a clear explanation of what the value would be for this? If you have set up a firewall that blocks all ...
2
votes
2answers
134 views
Access via http to other protocols and ports!
Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall.
We know that he has developed an application (Console ...
10
votes
6answers
364 views
Firewall philosophy
I've always been taught/believed that with a corporate firewall, you block all outgoing traffic to start, then open up only the holes you need for specific traffic. This makes sense to me from both ...
0
votes
3answers
268 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
15
votes
4answers
777 views
ESET warns: Skype attempting to communicate with unknown remote computer
I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate:
The ...
1
vote
1answer
83 views
Can a router detect transitive/cascaded telnet sessions?
I'm in my LAN segment , my desktops IP is x.x.x.x ; and I'm telneting to router A with its IP y.y.y.y from x.x.x.x .Now telnet session is established between x.x.x.x and y.y.y.y I want to telnet ...
-1
votes
2answers
1k views
windows firewall disabled with Norton Internet security or Norton Smart Firewall? [closed]
My Company decide to Change antiviruses and anti-spywares and firewalls.
How to apply changes in all clients and servers safety?
Norton say: ( in this article):
When you are using Windows ...
4
votes
3answers
3k views
Best practice to block Dropbox usage
We have users sync their data at company with their home computer.
What's the best way to block it?
Block *.dropbox.com
Find out all dropbox IPs and block IPs.
For windows users, deploy GPO to ...
0
votes
3answers
655 views
why Windows Firewall in XP cannot block outbound connections
wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.
another article says: XP defends you with your traffic coming from the web but ...
3
votes
3answers
5k views
Windows Firewall - how to block inbound for all .exe files in a folder
In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
3
votes
2answers
337 views
If a port is closed how come you can still use it?
What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" ...
2
votes
1answer
108 views
What security risks are involved with sending data over the internal network on Rackspace Cloud servers?
What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers?
Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
0
votes
2answers
170 views
can a backdoor executable be used on an occupied port?
Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
20
votes
7answers
5k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
2
votes
1answer
115 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
1
vote
2answers
504 views
How to check if a port can be accessed from the outside
I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at ...
5
votes
3answers
152 views
What are the security implications of allowing unlimited size cookies?
Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size.
Are there any exploits involving large cookies?
i.e. How much more ...
1
vote
3answers
226 views
Testing Web Application Firewall Configuration (ModSecurity)
What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
4
votes
4answers
4k views
How to bypass tcpwrapped with nmap scan
I'd a scan task and I faced following result
Host is up (0.032s latency).
Scanned at 2012-10-25 16:06:38 AST for 856s
PORT STATE SERVICE VERSION
1/tcp open tcpwrapped
3/tcp open ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
3
votes
3answers
146 views
Security issues in a Dotnet Web application
I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0.
It is tracert-able. That may assist for crackers to know network ...
6
votes
1answer
611 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
4
votes
2answers
151 views
Why are simple packet filter firewalls insufficient for the protection of web applications?
I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
0
votes
0answers
79 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
32
votes
2answers
2k views
Is it a bad idea for a firewall to block ICMP?
This question was inspired by this answer which states in part:
The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).
...
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
3k views
How to block some websites in a small office?
I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites.
My current connection is ...
1
vote
2answers
202 views
Why wouldn't the reverse shell connect back using the same port that exploited the server?
The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail.
i.e
established server:ftp <-> ...
2
votes
1answer
196 views
SSL VPN placement strategies
I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations:
with firewall
within the internal network
within the DMZ
Any reference also ...
0
votes
2answers
205 views
Any open source software firewall with country based ip blocking feature? [closed]
I am looking for an open source firewall with country based ip blocking feature for Linux OS.
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
