Concerned with software or hardware firewalls
3
votes
2answers
91 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
3
votes
2answers
383 views
What are the TCP/UDP ports used by torrent applications?
I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
3
votes
3answers
384 views
why blocking incoming traffic does not block chatting or VOIP
I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound ...
3
votes
2answers
187 views
Configure Linux to allow network activity based on binary?
On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
3
votes
2answers
4k views
Disabling windows firewall remotely
i use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?
3
votes
1answer
188 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
3
votes
2answers
140 views
Firewall on a VM
I know I could use a software firewall on the guest to achieve a situation similar to this, but is there a way to emulate a firewall (protecting multiple Guests) between a host and guests on a ...
3
votes
2answers
333 views
How secure is opening an incoming port for a java application?
If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be ...
3
votes
1answer
598 views
I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?
(Is this too application specific? It seems like a reasonable question that would be useful to other people...)
So, I've got this ASA in front of a network that I didn't set up. It's been ...
3
votes
3answers
146 views
Security issues in a Dotnet Web application
I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0.
It is tracert-able. That may assist for crackers to know network ...
3
votes
2answers
231 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
3
votes
2answers
282 views
What criteria do you use for evaluating Client-Side / Endpoint security products?
What features are important to you in client-side AV and Firewall products?
Who benefits from these features? Managment, the end user, helpdesk.
Are there features that are being 'sold' by the ...
3
votes
1answer
95 views
Why strip accept-encoding?
It seems that there are multiple "security" products which strip or mangle 'Accept-encoding' headers, thus forcing non-compressed responses from HTTP servers.
I've been trying to imagine if there's ...
3
votes
2answers
311 views
1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab
I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers
This is my plan for a topology but I am new at this so I need help.
I am basing this off the ...
3
votes
1answer
323 views
Why ESTABLISHED,RELATED for INPUT only?
In many places and tutorials I see people add this line to their iptables:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
And they do it only and only for "INPUT". What about OUTPUT and ...
3
votes
1answer
391 views
Firewall rules to block unwanted protocols on given ports
Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?:
i only want to allow these connections [on the output chain]:
on port 53 output only allow udp - dns
on ...
3
votes
3answers
96 views
Securing a network attached storage on the internet
I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.
I'd like to secure ...
3
votes
1answer
127 views
HTTPS form submissions are blocked on corporate networks
We have an HTML form which is submitted via HTTPS. We've noticed that when the form is submitted on a home network, it seems to go through just fine. However, when the form is submitted on certain ...
3
votes
3answers
5k views
Windows Firewall - how to block inbound for all .exe files in a folder
In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
3
votes
1answer
385 views
Mac sending hundreds of packets to gateway
I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet ...
2
votes
5answers
375 views
How do a firewall's rules for individual programs work?
I kind of know that how a firewall's rules for IP/port work, but I have no idea how a firewall deals with individual programs.
In other words, how does the firewall know a program wants to access the ...
2
votes
6answers
235 views
How do I prevent data from leaving my network?
I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching.
What are the options ...
2
votes
2answers
189 views
How does a firewall help to protect a server?
Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
2
votes
3answers
2k views
How to create ssh tunnel using netcat?
I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
2
votes
4answers
486 views
Best way to push data to a client without being blocked by firewall
I'm asking this question here since I think people on this forum
probably have the best knowledge of firewalls and routers.
Say I'm designing a multi-player game and I want to push data to the client ...
2
votes
2answers
133 views
Access via http to other protocols and ports!
Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall.
We know that he has developed an application (Console ...
2
votes
3answers
413 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
2
votes
2answers
180 views
Web Application Firewall Rules
For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
2
votes
3answers
501 views
Reviewing IP(s) that has been blocked by firewall / router
Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list?
Occasionally, the firewall guys see a high counts ...
2
votes
3answers
222 views
It's necessary setup a firewall in both PC and router?
If I have the router firewall enabled, it's really necessary setup iptables in my system? Isn't it a little redundant?
For example I add a rule in the router where the PC can't use the port 12345 ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
2
votes
2answers
645 views
Why is my firewall blocking on some files but not others?
I'm behind a corporate firewall which restricts access to certain urls and most downloads. The download restriction is mainly on .exe(but it allows some exe files to be downloaded and I don't know ...
2
votes
1answer
133 views
Blacklisting during a penetration test?
So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in ...
2
votes
1answer
115 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
2
votes
2answers
175 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
2
votes
1answer
196 views
How did my homepage get changed in IE?
I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
2
votes
3answers
301 views
Firewall Migration: NetScreen NS500 to FortiGate [closed]
I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
2
votes
3answers
298 views
Is it really better to use port 80 or 443 for outgoing traffic in order to bypass user firewall?
I recently created a reverse connection shell in C#. I tested it with some computers and I noticed that some computers connected back correctly and I established connection with them but another ...
2
votes
2answers
267 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
2
votes
1answer
283 views
Incoming Packet From Source Port 80
I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark:
98.126.43.174 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK]
98.126.43.174 ...
2
votes
3answers
398 views
Effectively limiting outgoing firewall traffic to frequently-changing IPs
PCI DSS 1.2.1 states:
Restrict inbound and outbound traffic to that which is necessary for
the cardholder data environment.
Verify that all other inbound and outbound traffic is ...
2
votes
2answers
194 views
Project help required by a newbie!
Basically, I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic ...
2
votes
3answers
691 views
Recommendations for security gateway/firewall management tools (Juniper SRX)
I am seeking recommendations for management tools for high-end firewalls, such as the Juniper SRX3000 series. When I say "management", I mean operations, configuration management, policy management, ...
2
votes
1answer
607 views
Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?
If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
2
votes
1answer
58 views
SYN scan, determining scan vs large file upload
In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
2
votes
3answers
133 views
State before getting whitelisted?
There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall.
Is there a common name for the state of the files before they ...
2
votes
1answer
106 views
What security risks are involved with sending data over the internal network on Rackspace Cloud servers?
What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers?
Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
2answers
275 views
Anomaly based web application Firewall
How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
2answers
75 views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
