Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

5
votes
2answers
19k views

What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff. So I ...
5
votes
4answers
2k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
2answers
707 views

Why are simple packet filter firewalls insufficient for the protection of web applications?

I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
5
votes
2answers
144 views

Security concerns allowing internet connected server to write on network server

I don't know much about network engineering since I just started becoming a programmer. The situation is, that my company has a web-interface hosted on one of our servers that is connected to the ...
5
votes
3answers
321 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
5
votes
2answers
3k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
204 views

Setup a private VPN for family in China?

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore. Is it possible to setup my own VPN (or ...
5
votes
1answer
1k views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
2answers
5k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN ...
5
votes
2answers
586 views

Security risks of leaving open a VPN connection

We have older firewalls that don't allow for scheduling up/down times of VPN connections, and we're working with a client that will need to connect to it at different times each day. What are the ...
5
votes
1answer
181 views

If all ports are closed, do I need firewall?

I often read an article which enables a firewall to secure public Wi-fi. But I think a firewall may not be needed when (like nmap said) all ports are closed. If all ports are closed, all packets ...
5
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
5
votes
2answers
411 views

Port forwarding with 0.0.0.0, any threat?

I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services. As we don't have a static public IP I used 0.0.0.0 as an external IP so the remote users can ...
5
votes
1answer
1k views

Why ESTABLISHED,RELATED for INPUT only?

In many places and tutorials I see people add this line to their iptables: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT And they do it only and only for "INPUT". What about OUTPUT and ...
5
votes
2answers
71 views

How does a firewall software intercept network communication?

I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate. Basically, a packet filter is a loadable kernel module that is inserted into the network ...
5
votes
1answer
853 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
5
votes
2answers
378 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
5
votes
2answers
878 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
2answers
4k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
5
votes
4answers
1k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
4
votes
4answers
30k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
4
votes
3answers
20k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
4
votes
5answers
414 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
8answers
64k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
4
votes
3answers
14k views

How to create ssh tunnel using netcat?

I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
4
votes
3answers
4k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
4
votes
4answers
385 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only ...
4
votes
2answers
591 views

What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?

How unique is this bug? Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
4
votes
3answers
197 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
4
votes
3answers
4k views

How do I configure nmap to verify my firewall is performing stateful packet inspection?

As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
4
votes
1answer
272 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
4
votes
4answers
1k views

Are firewalls required if using a VPN [closed]

If you are using a VPN to transmit data from router to router, do you still need a firewall? I am using a VPN Server to encapsulate data from one cisco router to another. Do I need to have a firewall ...
4
votes
3answers
215 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
4
votes
4answers
9k views

HTTPS firewall rule

Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
4
votes
3answers
382 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
4
votes
3answers
4k views

Which of these ports are safe to leave open, which are not?

I just ran nMap against my IP address and got the following result: PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 80/tcp open http 443/tcp open https ...
4
votes
3answers
705 views

Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance

Why should the firewall be outside the server, excepting these two items Take the performance impact of noise off of the server. Add a physical layer between devices so they can be on separate ...
4
votes
2answers
131 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
4
votes
2answers
199 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
4
votes
2answers
405 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
4
votes
2answers
495 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
4
votes
2answers
3k views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
4
votes
1answer
482 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
1answer
7k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
4
votes
2answers
625 views

Firewall design for big enterprise business

I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks. For example should the network atleast have the following firewall zones? Client ...
4
votes
2answers
4k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
4
votes
1answer
415 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
4
votes
3answers
13k views

Is it really better to use port 80 or 443 for outgoing traffic in order to bypass user firewall?

I recently created a reverse connection shell in C#. I tested it with some computers and I noticed that some computers connected back correctly and I established connection with them but another ...
4
votes
1answer
351 views

Placing a firewall—without creating a new subnetwork

I have a couple of networks that have multiple IP addresses, and where I have absolutely no choice as to the equipment used for the network's edge router (the device that connects both to the LAN and ...