Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

5
votes
2answers
3k views

incoming packets in server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
5
votes
5answers
718 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
5
votes
2answers
19k views

What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff. So I ...
5
votes
4answers
2k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
1answer
292 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
5
votes
2answers
713 views

Why are simple packet filter firewalls insufficient for the protection of web applications?

I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
5
votes
2answers
146 views

Security concerns allowing internet connected server to write on network server

I don't know much about network engineering since I just started becoming a programmer. The situation is, that my company has a web-interface hosted on one of our servers that is connected to the ...
5
votes
3answers
324 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
5
votes
2answers
3k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
233 views

Setup a private VPN for family in China?

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore. Is it possible to setup my own VPN (or ...
5
votes
1answer
1k views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
2answers
5k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN ...
5
votes
2answers
606 views

Security risks of leaving open a VPN connection

We have older firewalls that don't allow for scheduling up/down times of VPN connections, and we're working with a client that will need to connect to it at different times each day. What are the ...
5
votes
1answer
189 views

If all ports are closed, do I need firewall?

I often read an article which enables a firewall to secure public Wi-fi. But I think a firewall may not be needed when (like nmap said) all ports are closed. If all ports are closed, all packets ...
5
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
5
votes
2answers
425 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
1answer
1k views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
5
votes
2answers
73 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
5
votes
1answer
920 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
5
votes
2answers
378 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
2answers
889 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
2answers
4k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
5
votes
4answers
1k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
4
votes
3answers
20k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
4
votes
5answers
414 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
8answers
66k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
4
votes
3answers
14k views

How to create ssh tunnel using netcat?

I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
4
votes
3answers
4k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
4
votes
4answers
447 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only ...
4
votes
2answers
598 views

What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?

How unique is this bug? Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
4
votes
3answers
202 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
4
votes
3answers
4k views

How do I configure nmap to verify my firewall is performing stateful packet inspection?

As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
4
votes
4answers
1k views

Are firewalls required if using a VPN [closed]

If you are using a VPN to transmit data from router to router, do you still need a firewall? I am using a VPN Server to encapsulate data from one cisco router to another. Do I need to have a firewall ...
4
votes
3answers
216 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
4
votes
4answers
9k views

HTTPS firewall rule

Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
4
votes
3answers
383 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
4
votes
3answers
4k views

Which of these ports are safe to leave open, which are not?

I just ran nMap against my IP address and got the following result: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https ...
4
votes
3answers
716 views

Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance

Why should the firewall be outside the server, excepting these two items Take the performance impact of noise off of the server. Add a physical layer between devices so they can be on separate ...
4
votes
2answers
144 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
4
votes
2answers
247 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
4
votes
2answers
695 views

Configure Linux to allow network activity based on binary?

On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
4
votes
2answers
440 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
4
votes
2answers
513 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
4
votes
1answer
496 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
1answer
7k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
4
votes
2answers
628 views

Firewall design for big enterprise business

I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks. For example should the network atleast have the following firewall zones? Client ...
4
votes
2answers
5k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
4
votes
1answer
415 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
4
votes
3answers
13k views

Is it really better to use port 80 or 443 for outgoing traffic in order to bypass user firewall?

I recently created a reverse connection shell in C#. I tested it with some computers and I noticed that some computers connected back correctly and I established connection with them but another ...