Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

3
votes
2answers
3k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
3
votes
1answer
101 views

SYN scan, determining scan vs large file upload

In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
3
votes
1answer
423 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
3
votes
1answer
185 views

Why strip accept-encoding?

It seems that there are multiple "security" products which strip or mangle 'Accept-encoding' headers, thus forcing non-compressed responses from HTTP servers. I've been trying to imagine if there's ...
3
votes
2answers
474 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
3
votes
1answer
598 views

IP address filtering vs web application security

We have a web application behind a firewall that requires no user authentication. If we open up access to this application via the firewall to a small list of IP addresses what is the risk of ...
3
votes
1answer
888 views

Firewall rules to block unwanted protocols on given ports

Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?: i only want to allow these connections [on the output chain]: on port 53 output only allow udp - dns on ...
3
votes
4answers
427 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
3
votes
2answers
2k views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
3
votes
4answers
289 views

Enforcing personal firewall for OS X

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
3
votes
3answers
6k views

Securing a network attached storage on the internet

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup. I'd like to secure ...
3
votes
1answer
560 views

HTTPS form submissions are blocked on corporate networks

We have an HTML form which is submitted via HTTPS. We've noticed that when the form is submitted on a home network, it seems to go through just fine. However, when the form is submitted on certain ...
3
votes
1answer
1k views

w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?

It's only an idea. I've recently logged that my server is scanned by w00tw00t tools. I found many solutions to this, such as use of apache mod-security, fail2ban, etc.. The one I want to speak ...
3
votes
1answer
719 views

Mac sending hundreds of packets to gateway

I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet ...
2
votes
4answers
20k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
2
votes
6answers
851 views

How do I prevent data from leaving my network?

I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching. What are the options ...
2
votes
2answers
502 views

How does a firewall help to protect a server?

Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
2
votes
3answers
6k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
2
votes
3answers
2k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
2
votes
4answers
1k views

Best way to push data to a client without being blocked by firewall

I'm asking this question here since I think people on this forum probably have the best knowledge of firewalls and routers. Say I'm designing a multi-player game and I want to push data to the client ...
2
votes
2answers
348 views

Identify if files are being transferred from my computer over the internet

This may seem like a silly question to most, but... I recently has some spyware infected on my machine, which I have since gotten rid of. Using a couple of scanners (that come recommended on various ...
2
votes
2answers
198 views

Access via http to other protocols and ports!

Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall. We know that he has developed an application (Console ...
2
votes
2answers
300 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
2
votes
5answers
3k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
2
votes
2answers
456 views

Firewall & TCP Traffic

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial ...
2
votes
2answers
3k views

IPTables default security rules for a gateway/router?

On a router such as dd-wrt or tomato, what would be some default iptables rules? I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
2
votes
2answers
43 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
2
votes
3answers
636 views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
2
votes
3answers
842 views

Why block network ports?

There was another good question here on why you should block outgoing traffic: Why block outgoing network traffic with a firewall? But I was hoping to get an answer on why it is a good idea to block ...
2
votes
3answers
980 views

Reviewing IP(s) that has been blocked by firewall / router

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list? Occasionally, the firewall guys see a high counts ...
2
votes
1answer
387 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
2
votes
2answers
249 views

Are there “LAN IPs” on the internet?

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
2
votes
2answers
1k views

Benefits of REJECT over DROP on a single PC

Recently I learned about the difference between DROP and REJECT in a firewall. I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
2
votes
1answer
207 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
2
votes
2answers
1k views

Why is my firewall blocking on some files but not others?

I'm behind a corporate firewall which restricts access to certain urls and most downloads. The download restriction is mainly on .exe(but it allows some exe files to be downloaded and I don't know ...
2
votes
2answers
1k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
2
votes
1answer
1k views

Incoming Packet From Source Port 80

I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark: 98.126.43.174 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK] 98.126.43.174 ...
2
votes
1answer
193 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
2
votes
2answers
405 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
2
votes
2answers
436 views

Why wouldn't the reverse shell connect back using the same port that exploited the server?

The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail. i.e established server:ftp <-> ...
2
votes
3answers
973 views

Firewall Migration: NetScreen NS500 to FortiGate [closed]

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
2
votes
1answer
59 views

Do the firewall hardware specifications have to be better than the network it protects?

If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine. If a server can't handle a DoS/DDoS attack because it consumes it's resources does this mean the firewall has ...
2
votes
1answer
99 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
2
votes
3answers
161 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
2
votes
1answer
41 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
2
votes
3answers
414 views

Suspicious VMWare connections that bypass firewall

I'm running VMWare 5 and I have found that when I start up VMWare I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
2
votes
1answer
262 views

How are IaaS Virtual Machines Isolated?

I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
2
votes
1answer
850 views

Why are some ports reported as closed by nmap?

I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware. The target machine has an up to date antivirus ...
2
votes
2answers
3k views

What is more risky? Database Server in DMZ or Trusted Network?

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently. Assume the following A web server is being used for ...