Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

6
votes
2answers
15k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
5
votes
4answers
31k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
5
votes
5answers
2k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
5
votes
2answers
3k views

incoming packets in server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
5
votes
5answers
723 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
5
votes
2answers
20k views

What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff. So I ...
5
votes
4answers
2k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
1answer
321 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
5
votes
2answers
720 views

Why are simple packet filter firewalls insufficient for the protection of web applications?

I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
5
votes
2answers
147 views

Security concerns allowing internet connected server to write on network server

I don't know much about network engineering since I just started becoming a programmer. The situation is, that my company has a web-interface hosted on one of our servers that is connected to the ...
5
votes
3answers
327 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
5
votes
2answers
3k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
265 views

Setup a private VPN for family in China?

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore. Is it possible to setup my own VPN (or ...
5
votes
1answer
1k views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
2answers
6k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN 13304/...
5
votes
2answers
636 views

Security risks of leaving open a VPN connection

We have older firewalls that don't allow for scheduling up/down times of VPN connections, and we're working with a client that will need to connect to it at different times each day. What are the ...
5
votes
1answer
202 views

If all ports are closed, do I need firewall?

I often read an article which enables a firewall to secure public Wi-fi. But I think a firewall may not be needed when (like nmap said) all ports are closed. If all ports are closed, all packets ...
5
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
5
votes
2answers
444 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
1answer
1k views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
5
votes
2answers
77 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
5
votes
1answer
1k views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
5
votes
2answers
378 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
2answers
896 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
2answers
4k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
5
votes
4answers
2k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
4
votes
3answers
20k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
4
votes
5answers
415 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
3answers
24k views

What is the difference between a Gateway and a Firewall? [closed]

What is the difference between a Gateway and a Firewall and how do they relate to one another? I am a developer trying to get a general understanding of network security.
4
votes
8answers
69k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
4
votes
3answers
14k views

How to create ssh tunnel using netcat?

I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
4
votes
3answers
4k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
4
votes
4answers
516 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only install/...
4
votes
2answers
601 views

What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?

How unique is this bug? Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
4
votes
3answers
212 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
4
votes
3answers
4k views

How do I configure nmap to verify my firewall is performing stateful packet inspection?

As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
4
votes
2answers
331 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
4
votes
4answers
2k views

Are firewalls required if using a VPN [closed]

If you are using a VPN to transmit data from router to router, do you still need a firewall? I am using a VPN Server to encapsulate data from one cisco router to another. Do I need to have a firewall ...
4
votes
3answers
217 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
4
votes
4answers
9k views

HTTPS firewall rule

Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
4
votes
3answers
387 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
4
votes
3answers
4k views

Which of these ports are safe to leave open, which are not?

I just ran nMap against my IP address and got the following result: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https 3389/...
4
votes
3answers
728 views

Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance

Why should the firewall be outside the server, excepting these two items Take the performance impact of noise off of the server. Add a physical layer between devices so they can be on separate ...
4
votes
2answers
166 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
4
votes
2answers
700 views

Configure Linux to allow network activity based on binary?

On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
4
votes
2answers
466 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at 2015-...
4
votes
2answers
543 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
4
votes
1answer
316 views

Blacklisting during a penetration test?

So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in ...
4
votes
1answer
497 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?