Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

7
votes
6answers
260 views

Why shouldn't I run other applications on a Firewall?

If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)? The only opened port to the world (wan ...
7
votes
4answers
3k views

Security Services on Edge Router vs. Standard Firewall

If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it? For instance, Core Switch --> ...
7
votes
2answers
456 views

What does a Firewall mean by “connect to TCP port without your permission”?

McAfee is reporting incoming network connections blocked from IPs like 198.252.206.149 (StackExchange Inc.), 54.179.231.116 (Amazon Technologies Inc.), 74.125.68.106 (Google Inc.), etc. The ports ...
7
votes
4answers
4k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
7
votes
3answers
3k views

Is it necessary to setup a firewall in both PC and router?

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant? For example I add a rule in the router where the PC can't use the port ...
7
votes
2answers
290 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
7
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
7
votes
1answer
3k views

How to whitelist an Amazon ELB in a(ny) firewall?

We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address. However, we are running our system behind an Amazon Elastic Load Balancer ...
7
votes
2answers
210 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
6
votes
5answers
1k views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
4answers
530 views

“There's a firewall on the router into the building so you can turn the one on your computer off”

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
6
votes
2answers
3k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
6
votes
4answers
964 views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
6
votes
3answers
2k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
4answers
887 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
6
votes
3answers
355 views

When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?

When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
6
votes
3answers
8k views

Why do I need a firewall on my router?

I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall. I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
6
votes
1answer
4k views

How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?

In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
6
votes
3answers
513 views

Firewall says that a program that I'm developing is trying to connect to the Internet

I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever. I'm a software engineer but not ...
6
votes
2answers
2k views

I'm getting lots of unfamiliar connection attempts, what do I do?

I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places ...
6
votes
4answers
507 views

What kind of IT security applications do you guys run on your laptop/desktop? [closed]

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
6
votes
1answer
12k views

Firewall defined Akamai IP Range [closed]

With obvious dangers of opening up a wide range of ips, does anyone know how I can get a source of IP ranges for Akamai? When talking to Akamai they say 'not possible' which I find surprising. I ...
6
votes
2answers
232 views

Firewall on a VM

I know I could use a software firewall on the guest to achieve a situation similar to this, but is there a way to emulate a firewall (protecting multiple Guests) between a host and guests on a ...
6
votes
1answer
2k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
6
votes
2answers
887 views

How do experienced users test stateful firewall?

How do experienced users test stateful firewall with TCP/IPv6? My test case includes: echo reply without request tcp ack without syn Are there any more test cases, especially with IPv6?
6
votes
4answers
27k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
6
votes
2answers
12k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
5
votes
5answers
5k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
5
votes
5answers
1k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
5answers
624 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
5
votes
2answers
16k views

What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff. So I ...
5
votes
4answers
1k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
5answers
19k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
5
votes
2answers
93 views

Security concerns allowing internet connected server to write on network server

I don't know much about network engineering since I just started becoming a programmer. The situation is, that my company has a web-interface hosted on one of our servers that is connected to the ...
5
votes
4answers
676 views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
5
votes
3answers
284 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
5
votes
2answers
2k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
1answer
954 views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
3answers
640 views

Can a web server be secured with just a firewall?

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
5
votes
2answers
357 views

Security risks of leaving open a VPN connection

We have older firewalls that don't allow for scheduling up/down times of VPN connections, and we're working with a client that will need to connect to it at different times each day. What are the ...
5
votes
1answer
929 views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
5
votes
2answers
367 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
2answers
764 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
2answers
3k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
4
votes
3answers
17k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
4
votes
5answers
401 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
3answers
7k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
2answers
2k views

incoming packets in server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
4
votes
2answers
479 views

What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?

How unique is this bug? Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
4
votes
4answers
2k views

Is Windows Firewall suitable for running in a production environment?

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough? I'm running a VPS with Rackspace on their cloud ...