Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
0answers
57 views

Why does Windows realtime protection block specific URLs?

I have observed this strange behaviour with Windows (7 to 10). When active realtime protection is enabled, it blocks my own website. The page has nothing special (PHP and JavaScript), just good old ...
5
votes
2answers
403 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
2answers
71 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
1
vote
1answer
168 views

How to remote access a server behind firewall? [closed]

I have a server with defined IP address (it is for my own usage). I would like to use it from remote access. The server is behind a firewall. Is there a way to access it from remote computer? Is ...
4
votes
1answer
270 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
1answer
107 views

Can network admin detect an MiTM attack?

I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS). If someone on my network launches an MiTM attack on me, will the network admin be able to detect this? Does an ...
0
votes
1answer
189 views

If I set http.sslVerify to false in git, then will the connection be secure?

If I set "http.sslVerify false"(in .gitconfig file) in git, then will the connection be secure? In between, we are using pfsense firewall and squid+squidgaurd for web-filtering. Is this a good path ...
24
votes
2answers
2k views

What does the Juniper backdoor actually allow an attacker to do?

The Juniper ScreenOS backdoor recently discovered provides administrative access to these firewalls, but in terms of access to valuable data can it actually provide an attacker with anything useful ...
1
vote
0answers
49 views

Fortigate monitoring with SNMP and Devmon template

I'm trying to monitor some aspects from our Fortigate firewall (like how many traffic goes through each tunnel) through a combination of Xymon, Devmon and SNMP. I downloaded the MIB files from the ...
1
vote
1answer
66 views

Shared Global Blacklist Trust Issue

Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the ...
4
votes
2answers
128 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
1
vote
2answers
304 views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host ...
4
votes
2answers
195 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
-1
votes
2answers
156 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
2
votes
2answers
122 views

I am not connecting to internet, do I still need the windows firewall on?

Forgive my ignorance but I am truly uncertain. Here is my situation: I have dual booted a Linux distro and Windows 7 on my machine. Windows 7 sole purpose is for gaming, that's all. I'm not planning ...
1
vote
2answers
152 views

What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?

Say I have a Windows Server (let's go with Windows Server 2012, but I'm thinking in general). It's running IIS. We have our standard website, accessible via port 80 (HTTP) and 443 (HTTPS). And let's ...
1
vote
1answer
44 views

What is the procedure to implement security zones in a production network without impacting negatively in the communications?

In an organization where there exist a network with VLANs where the communication between all VLANs is allowed we are going to install a firewall and define security zones. The security zones will ...
1
vote
1answer
76 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
3
votes
1answer
41 views

Firewall - Allow WMI internal network

I am not totally sure if this is the correct stackexchange to place this question, so just let me know if it should be somewhere else. I am looking into IT asset management systems and for these ...
0
votes
1answer
76 views

Detect HTTPS self signed certificate in (DPI) firewall

TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how? A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default ...
-1
votes
1answer
132 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
1
vote
2answers
201 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
1
vote
1answer
70 views

Debian 8 and few questions about Graphical Firewall?

I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up. ...
2
votes
3answers
121 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
4
votes
1answer
218 views

Block this DDoS attack

since more than a week my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack, ovh don't care about it but this attack is killing my server with a high CPU load (permanent ...
2
votes
1answer
95 views

Can in a VPN LAN-to-LAN one site be completely isolated from the other?

In a VPN LAN-to-LAN setting, is it possible to isolate one site from the other? I know that we can use a firewall but that would obligate us to manage specific rules in the firewall. I would like to ...
1
vote
1answer
66 views

SSL certs signed by different CA

Have a question on SSL certs signed by different CA. in the past, my web server cert is signed with CA1 and it was also imported into the web app firewall for SSL traffic monitoring. Now, I have ...
3
votes
2answers
85 views

How to restrict access to the internet for some computers on the network?

I’d like to differentiate machines (or, possibly, users) on my small business network so that only some of them have access to the internet. The solution I’ve been using to this day is quite terrible: ...
3
votes
2answers
102 views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
1
vote
0answers
47 views

The process of using Metasploit to get in Systems [closed]

I am new in metasploit. I get the basic concept of exploiting a system or whatever your trying to do. You find a vulnerability in a system, you use an exploit or make one. Doing that on your local ...
7
votes
1answer
264 views

Vulnerabilities of pure NAT without firewall

Following some of the comments on this question, I was curious about the security vulnerabilities of NAT. There are similar threads here and here but they discuss router vulnerabilities rather than ...
1
vote
1answer
61 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
1
vote
1answer
120 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There ...
3
votes
2answers
105 views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
1
vote
2answers
90 views

A couple of questions about port scanning

I have alot of questions on my mind right now, but I'll only ask the ones that are particularily intriguing me. First off: - I port-scanned my Public IPV4 address; and it returned a few ports being ...
2
votes
1answer
72 views

Check Point SSL Certificate Interception [duplicate]

Can someone please explain how Check Point enterprise firewalls are able to read SSL traffic? My boss briefly explained that our company's firewall, which is Check Point, is able to intercept SSL ...
1
vote
0answers
38 views

Is it possible to block a debugger from connecting locally?

I work at an enterprise with enterprise-type software on my machine regarding firewalls, virus scanning, and vpns. I'm also a developer. If I'm not connected to the internet I'm not able to debug my ...
12
votes
5answers
2k views

How does a network admin block the reverse SSH in company?

Given firewall inbound: all are blocked outbound: allow port 80, 443 Problem colleagues are still able to ssh to home device by port 80/443, and establish a reverse ssh tunnel from company to ...
0
votes
2answers
158 views

Firewall tiered architecture and firewall brands in today's context

In the past, we were often taught that we should have at least two layers of firewalls and it was best to use different brands so that at least it would make it more difficult for hackers to ...
11
votes
4answers
354 views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
4
votes
4answers
1k views

Are firewalls required if using a VPN [closed]

If you are using a VPN to transmit data from router to router, do you still need a firewall? I am using a VPN Server to encapsulate data from one cisco router to another. Do I need to have a firewall ...
0
votes
1answer
233 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
0
votes
0answers
31 views

where can we download SourceFire log/message guide?

I need to write few alerts in SIEM based on Device:Sourcefire. Can anyone let me know from where we can download Sourcefire log/message ID as CISCO ASA firewall has it.
2
votes
1answer
124 views

What is the core purpose of a firewall on a linux server that is connected to the internet?

When I deploy new linux servers - I start off with a bare bones Ubuntu Server OS and install only the services that are needed. SSH webserver - port 80 These services have iptables rules setup to ...
2
votes
2answers
419 views

Telnet port open on my router public IPv6 address

Recently I upgraded my home router into this one. It is a cheap one, but it has features I needed: IPv6 support and Gigabit Ethernet. So I decided to give IPv6 a try. I configured a Hurricane ...
1
vote
0answers
31 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp ...
-4
votes
1answer
131 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like ...
3
votes
3answers
489 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
1
vote
1answer
115 views

Preventing outgoing Portscan/SYN/UDP Floods in the datacenter

We are a VPS hosting company that have servers housed in a datacenter in Germany. Currently we are receiving multiple take-down requests because customers are ports scanning or attacking servers ...
3
votes
2answers
298 views

how can an attacker access a system through a compromised router?

Let's say an attacker gained access to the admin panel of a home router with port 21, 23 and 80 open. I mean the attacker has full control over the router, thus being able to port forward, etc... ...