Concerned with software or hardware firewalls
5
votes
2answers
6k views
What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff.
So I ...
5
votes
3answers
152 views
What are the security implications of allowing unlimited size cookies?
Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size.
Are there any exploits involving large cookies?
i.e. How much more ...
5
votes
1answer
2k views
How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?
In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
5
votes
2answers
915 views
Firewall Configuration Audits
I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
1answer
565 views
I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening
So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours.
I'm on a shared port, so I'm ...
5
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
5
votes
2answers
316 views
Is this a DNS attack?
The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
2answers
367 views
What are the risks associated with relying on IPSec IP Filtering?
When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox).
Because IPSec Filtering is not stateful, ...
5
votes
1answer
75 views
Are temporary blocks sufficient response to network probes?
We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
...
5
votes
2answers
242 views
How should an outgoing connection white-list be created?
I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
4
votes
3answers
3k views
Best practice to block Dropbox usage
We have users sync their data at company with their home computer.
What's the best way to block it?
Block *.dropbox.com
Find out all dropbox IPs and block IPs.
For windows users, deploy GPO to ...
4
votes
4answers
9k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
4
votes
5answers
327 views
Why wasn't the flame malware flagged by firewalls?
Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
5answers
398 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
4
votes
4answers
666 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
4answers
689 views
Security concerns from publicly visible Hudson & Jenkins servers?
A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
4
votes
2answers
943 views
incoming packets in server
I have enabled iptables logging for packets coming from the outside
-A INPUT ! -s 192.168.218.0/24 -j LOG
Now i am seeing lots of incoming packets from unknown addresses
Jun 5 14:54:56 localhost ...
4
votes
3answers
1k views
Why do I need a firewall on my router?
I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall.
I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
4
votes
3answers
2k views
How do I configure nmap to verify my firewall is performing stateful packet inspection?
As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
4
votes
4answers
162 views
HTTPS firewall rule
Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall
This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
4
votes
3answers
162 views
The safest way to circumventing Iran's Internet censorship
We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy.
Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
4
votes
2answers
150 views
Why are simple packet filter firewalls insufficient for the protection of web applications?
I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
4
votes
2answers
95 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
4
votes
4answers
3k views
How to bypass tcpwrapped with nmap scan
I'd a scan task and I faced following result
Host is up (0.032s latency).
Scanned at 2012-10-25 16:06:38 AST for 856s
PORT STATE SERVICE VERSION
1/tcp open tcpwrapped
3/tcp open ...
4
votes
1answer
214 views
How did my homepage get changed in IE?
I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
4answers
766 views
Block all BotNets and TOR addresses from accessing our site
I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
4
votes
1answer
3k views
Fail2Ban does not ban failed root login attempt
I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
4
votes
2answers
317 views
Firewall design for big enterprise business
I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks.
For example should the network atleast have the following firewall zones?
Client ...
4
votes
3answers
243 views
Firewall says that a program that I'm developing is trying to connect to the Internet
I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever.
I'm a software engineer but not ...
4
votes
1answer
174 views
Placing a firewall—without creating a new subnetwork
I have a couple of networks that have multiple IP addresses, and where I have absolutely no choice as to the equipment used for the network's edge router (the device that connects both to the LAN and ...
4
votes
1answer
998 views
Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?
I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
4
votes
2answers
2k views
How do you properly setup Tor on Windows 7?
How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
2answers
478 views
Network Vulnerability Scanner placement on network
We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard.
Qualys supply a scanner appliance for the internal network scanning, which ...
4
votes
4answers
924 views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
4
votes
2answers
828 views
Cisco ASA Security Contexts: Any Real World Installs?
We are looking at deploying a Cisco ASA 5520-I am looking at the security contexts feature, and was wondering if anyone has deployed their ASA in this way, and how it is working out for them.
Have ...
4
votes
1answer
156 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
4
votes
1answer
390 views
IP address filtering vs web application security
We have a web application behind a firewall that requires no user authentication.
If we open up access to this application via the firewall to a small list of IP addresses what is the risk of ...
4
votes
1answer
150 views
How to whitelist an Amazon ELB in a(ny) firewall?
We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address.
However, we are running our system behind an Amazon Elastic Load Balancer ...
4
votes
1answer
177 views
firewall with cloud based malware analysis risks
Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
3
votes
8answers
3k views
How to block some websites in a small office?
I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites.
My current connection is ...
3
votes
3answers
999 views
is it worth to implement a firewall on a web server you control?
I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
3
votes
3answers
972 views
How can reverse proxies be used to bypass acceptable use policies of a company?
I am wondering how reverse proxies can be used to bypass company acceptable use policies?
What can be done to prevent it?
3
votes
4answers
189 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
1answer
84 views
Why guest's connections can pass host's firewall?
I've been wondering about this.
Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall.
Why the connections made on ...
3
votes
4answers
724 views
Is Windows Firewall suitable for running in a production environment?
Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?
I'm running a VPS with Rackspace on their cloud ...
3
votes
2answers
333 views
If a port is closed how come you can still use it?
What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" ...
3
votes
3answers
800 views
Which of these ports are safe to leave open, which are not?
I just ran nMap against my IP address and got the following result:
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http
443/tcp open https
...
3
votes
2answers
547 views
Reverse shell connections
Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.
Would not most servers restrict outgoing ...
3
votes
2answers
144 views
How to red team against firewalled architecture?
Prior Knowledge
I understand the types and differences between firewalls.
I have (what I believe to be) a relatively good mental model of a firewall.
I understand routing, iptables, signature ...
