Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

1
vote
3answers
744 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
3
votes
1answer
148 views

Are Keystroke and Click Loggers Legal? [closed]

I worked with the firewall "Nobero" which is paid and bit expensive. It is a complete Network Firewall including groups policy, banning URLs and social sites. But It has a feature of tracking users' ...
3
votes
0answers
75 views

I'm looking for a decent book on network and infrastructure security [closed]

I'm currently looking for a decent book on network and infrastructure security (especially in the enterprise context). Could you point me to one or two recent books, please? Thanks a lot in advance! ...
0
votes
0answers
28 views

Firewall issues

Background I have an Android device (Minix M5) that I handed to a customer The device only does outbound connections, so no inbound traffic The customer confirmed that s/he opened up the ports ...
0
votes
1answer
54 views

Does firewall count as a subnetwork? [closed]

I need to design a network based on IP 10.1.1.0/24. I have three different subnetworks and a firewall. Does firewall count as a subnetwork? Do I need to assign some IP values to it?
4
votes
1answer
487 views

Benefits of home router behind Linux firewall?

Like a lot of people I have a simple consumer grade router at home. The setup is pretty standard: Ethernet from the cable modem --> router's WAN Given the poor track record of consumer routers ...
2
votes
3answers
628 views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
2
votes
3answers
74 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
2
votes
2answers
200 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
0answers
263 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I ...
1
vote
1answer
102 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
0
votes
2answers
713 views

VyprVPN (from GlodenFrog.com) weirdly keeps sending unauthorized suspecious data even after uninstall [closed]

Update: Check the VyprVPN's app developer answer below, seems this is okay and an uninstaller is added to new versions to prevent such issues. Original: I was working with VyprVpn a few months ago, ...
1
vote
1answer
281 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
2answers
161 views

NMap to scan a private subnetwork

I have a test network setup based on virtual machines. My host machine, a web server and the firewall is under the 192.168.0.0/24 network (gateway is 192.168.0.1); a server machine is located behind ...
0
votes
2answers
108 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
1
vote
3answers
290 views

Most secure location of database

Let's say I have a straight forward completely database driven web site application and I store my database on my web server in the DMZ. I won't be broadcasting the IP address of my database because I ...
0
votes
2answers
94 views

Does anyone know how / what this technique is called? [closed]

When using public wireless it needs you to sign in and from what I've gathered it allows you to have access to the internet and provides you with your own network and is not shared with any other ...
10
votes
1answer
4k views

Why is Windows Explorer making external connections?

McAfee is seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe ...
2
votes
1answer
347 views

Is it safe to whitelist CDN domains?

I am trying to whitelist URLs for my PC but I want to eventually roll out the rules to my small company's firewall. But I'm having trouble with CDNs since a page may load content from many distinct ...
0
votes
1answer
162 views

Do I need dedicated firewall? [closed]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
2
votes
1answer
54 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
2
votes
3answers
296 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
1
vote
1answer
123 views

Block An IP Address Scanner On Mac [closed]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
0
votes
2answers
88 views

Inspecting every packet leaving the system for sensitive information ? [closed]

Is there a way to check every packet leaving the system for sensitive data like IP addresses, personal information (like logins) etc ? A free (and preferably open source) program which does this for ...
0
votes
2answers
2k views

using html5 websockets to bypass firewall TCP policy

I've read that html5 enables opening tcp sockets from the client side in its "websocket" feature. Firewalls as I recollect may be configured to block tcp connections initiated from "the outside" by ...
1
vote
1answer
138 views

How much of your web browsing behavior is VISIBLE to the administrators when you're behind HTTPS or VPN? [closed]

For example. If you're behind a VPN and want to get on on facebook and youtube. Will all outgoing traffic need to make a request to the firewall first? I don't really know extensively how well a ...
8
votes
2answers
693 views

What does a Firewall mean by “connect to TCP port without your permission”?

McAfee is reporting incoming network connections blocked from IPs like 198.252.206.149 (StackExchange Inc.), 54.179.231.116 (Amazon Technologies Inc.), 74.125.68.106 (Google Inc.), etc. The ports ...
2
votes
1answer
6k views

Understanding OpenWRT LuCI Firewall Routing with VPN

I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT ...
3
votes
2answers
173 views

Decrypt and then re-encrypt all requests to the internet at firewall level

I don't have strong skills about this matter but I am very curious about the following communication so may I ask: One institution sent a message to all network users saying that "all requests to the ...
14
votes
1answer
458 views

Should a server be considered compromised simply because a port was open?

Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy ...
2
votes
2answers
218 views

How do people typically perform security audits of firewalls?

In my days as a pentester, we used to use tools like Nipper, combined with manual analysis, to perform audits of firewall configurations. However, in my current company we have many different ...
5
votes
1answer
1k views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
3
votes
1answer
122 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
0
votes
0answers
484 views

explorer.exe outbound (Unexplained TCP Connections)

So I've already disabled SSDP Discovery in Windows Services. I'm also not conducting any searches. I also have file indexing disabled on my system. I noticed a number of outbound connections coming ...
3
votes
3answers
209 views

Segregating a Printer in my Enterprise Network

I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice. The only problem is that ...
1
vote
1answer
120 views

Is it a good idea to disable WHM backend and only enable it through ssh when needed?

I have recently set up a managed VPS and it came per-installed with CentOs and WHM. I have configured SSH logins to use private keys and i can SSH into the server with root privileges. I realize ...
1
vote
0answers
156 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. I'...
0
votes
2answers
286 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
3
votes
1answer
149 views

Can NATs and firewalls blacklist IPs when trying to UDP hole punch?

I am developing a P2P application that will make use of UDP hole punch to connect two peers behind NAT. When dealing with connections between a cone and a symmetric, unpredictable NATs, however, hole ...
0
votes
2answers
158 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
1
vote
2answers
448 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how ...
4
votes
2answers
464 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at 2015-...
4
votes
2answers
540 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
2
votes
2answers
284 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
0
votes
2answers
405 views

Prevent hacking with known IP address and router information on Ubuntu 14.04 LTS [closed]

I’ve had it! It is the second time that a “hacker” (A hacker or should I say thief) has had access to my Ubuntu 14.04 LTS system. The person that I suspect has had physical access to my pc because he ...
1
vote
1answer
137 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
8
votes
1answer
367 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
2
votes
1answer
142 views

Do the firewall hardware specifications have to be better than the network it protects?

If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine. If a server can't handle a DoS/DDoS attack because it consumes it's resources does this mean the firewall has ...
0
votes
1answer
156 views

How to manage Cisco ASA series without management cable? [closed]

How can I manage my Cisco ASA device without the management cable? I have not set it up at all, but I have physical access to it.
4
votes
2answers
472 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP proxy/...