Tagged Questions

Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
1answer
68 views

hijacking fedora or ubuntu or windows upgrades on the fly

is It theoretically possible to hijack (I mean substitute on the fly) the fedora or ubuntu or windows packages upgrades if a cracker has owned the company's firewall/proxy ?
5
votes
5answers
532 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
1
vote
1answer
1k views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
0
votes
1answer
76 views

Level of Data Security in iOS [closed]

How secure is the data stored on iOS devices, specifically app data like notes, pictures, etc.? Are there any ways to make it more secure?
1
vote
1answer
236 views

fail2ban and iptables

Should fail2ban be the master of iptables rules? For example, should I setup my firewall rules along side the fail2ban rules, or should I have all my services configured and managed by fail2ban? ...
2
votes
0answers
103 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
3
votes
3answers
314 views

Are local firewalls necessary

Is having local firewalls enabled on machines actually necessary if you run hardware based firewalls like pfsense or a netgear fvs338 and use that to control in/out bound connections? I personally do ...
-2
votes
1answer
13k views

How to run any application through a proxy with PUTTY? [closed]

Maybe I did not search for it the right way but I could not find the solution. Maybe I am misinformed but if I understand correctly I could use PUTTY to run any Windows applications through a proxy ...
0
votes
1answer
271 views

Remote Administration Tools and firewalls

I was faced with a question a few days ago, regarding how a RAT server can reach out through the firewall and connect to the client. This was something that I've never given any thought to before, so ...
3
votes
1answer
526 views

Isolate a Virtualbox VM from local network [closed]

I have the need to isolate a virtual machine created with Virtualbox from the local network but I need to provide internet access to that machine. It is the first time that I face this kind of ...
1
vote
3answers
2k views

Is an outbound firewall connection 'safer' than an inbound

We're trying to determine if pushing data through a firewall is more safe than pulling it. The data will be from SSIS to SSIS through the firewall. An advisor here has suggested that pushing the data ...
5
votes
4answers
572 views

One time password over SMS - exposing the Authentication Server to the internet

Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The ...
6
votes
1answer
7k views

Firewall defined Akamai IP Range [closed]

With obvious dangers of opening up a wide range of ips, does anyone know how I can get a source of IP ranges for Akamai? When talking to Akamai they say 'not possible' which I find surprising. I ...
1
vote
1answer
351 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
2
votes
2answers
383 views

Firewall & TCP Traffic

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial ...
2
votes
2answers
541 views

Mixing stateless and stateful firewall rules

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this? Take the following two rule sets ...
1
vote
2answers
174 views

IPTable Security between two servers

Is using IPTables to only allow traffic between two servers considered an acceptable practice? For example TCP traffic on a defined port. I realize this is referred to as an ACL but how secure is ...
2
votes
1answer
230 views

How are IaaS Virtual Machines Isolated?

I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
2
votes
1answer
668 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
-1
votes
1answer
512 views

Is there a way to get OS X to start a VPN connection before allowing network traffic? [closed]

I'm running OS X 10.8 and have Tunnelblick set up so I can connect to my OpenVPN server at home. I've also used this at $WORK in the past. When I'm out and about and want to jump on a public network, ...
0
votes
2answers
308 views

File shares from a DMZ into an internal network

We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
1
vote
1answer
164 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be ...
1
vote
1answer
461 views

How can I better protect my LAN from Internet Hackers

My computer is connected to my Netgear router which is also the switch for my network, this in turn is connected to my cable modem which is just a bridging device. My router is blocking scans and ...
3
votes
4answers
261 views

Enforcing personal firewall for OS X

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
0
votes
1answer
670 views

What triggers a firewall to block a TCP socket?

I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
6
votes
4answers
698 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...
0
votes
1answer
522 views

Securing my firewall (both dedicated and iptables-based) [closed]

I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection". My iptables look like this: *filter # Allows all ...
-3
votes
1answer
523 views

Web GUI for Snort + ModSecurity [closed]

I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
4
votes
2answers
727 views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
3
votes
2answers
2k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
1
vote
1answer
282 views

Whats a secure firewall rules using UFW?

On my Ubuntu server I have these services running: netstat -tlnp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
4
votes
4answers
3k views

HTTPS firewall rule

Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
2
votes
2answers
393 views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
3
votes
3answers
5k views

Securing a network attached storage on the internet

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup. I'd like to secure ...
-1
votes
3answers
7k views

What is the difference between a Gateway and a Firewall? [closed]

What is the difference between a Gateway and a Firewall and how do they relate to one another? I am a developer trying to get a general understanding of network security.
4
votes
3answers
303 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
-1
votes
2answers
711 views

Allow embedded videos while keeping youtube blocked [closed]

Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy. How can ...
1
vote
2answers
306 views

Remote File Injection in ARGS blocking form updating database

I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule. How do I stop this apart from not including URLs in the form fields or removing the http:// ...
2
votes
2answers
271 views

Barracuda antispam access to active directory in dmz : opening port or not?

I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed. What I see on the web is people ...
5
votes
1answer
1k views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
-1
votes
1answer
1k views

How to find IP Addresses that have been attacking my Computer Ports ? [closed]

I am a newbie at Info Sec, and wanted to know which IP addresses are sources of attack traffic. Can I also find out which ports are being attacked? Can this information be found in windows firewall? ...
2
votes
0answers
50 views

Could you attack a port without knowing what service was listening? [duplicate]

A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports. My question is this, though, if the ...
1
vote
1answer
245 views

Are there any cross platform firewall solutions with a central management platform?

Currently I have a bunch of servers scattered across a few different providers e.g. EC2, rackspace. Some boxes are Linux and some are Windows. Currently I'm finding the administration of the ...
6
votes
3answers
1k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
4
votes
1answer
345 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
7
votes
2answers
98k views

What are the TCP/UDP ports used by torrent applications?

I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
3
votes
1answer
100 views

SYN scan, determining scan vs large file upload

In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
6
votes
1answer
2k views

How to whitelist an Amazon ELB in a(ny) firewall?

We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address. However, we are running our system behind an Amazon Elastic Load Balancer ...
3
votes
1answer
113 views

Why guest's connections can pass host's firewall?

I've been wondering about this. Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall. Why the connections made on ...
2
votes
3answers
146 views

State before getting whitelisted?

There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall. Is there a common name for the state of the files before they ...