Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

2
votes
3answers
651 views

Firewall Migration: NetScreen NS500 to FortiGate [closed]

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
3
votes
1answer
136 views

Why strip accept-encoding?

It seems that there are multiple "security" products which strip or mangle 'Accept-encoding' headers, thus forcing non-compressed responses from HTTP servers. I've been trying to imagine if there's ...
8
votes
3answers
873 views

Evasion techiques for WAFs

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
2
votes
2answers
259 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
0
votes
1answer
136 views

How to secure unprotected Telnet Server on Droid 3

I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
-1
votes
1answer
1k views

How to bypass firewall protection to hack windows server 2003? [closed]

I am trying to hack windows server 2003 sp2, i can see a lot of services running on target, there is also a lot of backdoors listing on ports like netbus, remote-everything .... But Firewall (as i ...
1
vote
1answer
189 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
1
vote
2answers
133 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
1
vote
3answers
4k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
1
vote
1answer
239 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
1
vote
2answers
619 views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
3answers
1k views

How to setup an internal firewall

I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
4
votes
2answers
5k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
7
votes
1answer
16k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
1
vote
1answer
201 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
2answers
209 views

Securing a VPN connection

I'm new to this we want to install a new VPN connection that will be used to connect using Internet to some networks in the office the contractor want to use a" Cisco NAC Network Module or Cisco IPS ...
-1
votes
1answer
258 views

What do current generation firewalls lack?

Are current generation firewalls ( both commercial and open source) good enough to combat current generation attacks (of course when properly configured) ? By large , what do current generation ...
3
votes
3answers
1k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
4
votes
5answers
379 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
0
votes
2answers
94 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
0
votes
2answers
582 views

Enabling firewall for the IPv6 tunnel on Windows 2008 64-bit

I am currently on a IPv4 network. The IPv4 network is accessed by a router, which gives my machines IPv4 addresses via NAT. On one of the machines, a Windows 2008 64-bit machine, I have set up a IPv6 ...
-2
votes
1answer
611 views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
3
votes
2answers
328 views

Configure Linux to allow network activity based on binary?

On Windows, rules can be added to the firewall to allow/deny network traffic based on which binary is sending/receiving the data. Can this be done on a Linux box, and if not, why not? Is it a bad ...
1
vote
1answer
1k views

How do these Windows services affect the security of Windows Firewall?

Its common to disable unneeded services in Windows 2008 R2, but sometimes I come across installations that use Windows Firewall and related services. More info: see service dependencies for Windows ...
0
votes
1answer
428 views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
2
votes
3answers
6k views

Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget? # Allow ...
7
votes
5answers
8k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
2answers
102 views

Correct way of establishing if the switch is sending syslogs?

I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan nmap -sV -p514 xxx.xx.xx.xx The result came out as closed. Does this ...
-1
votes
3answers
473 views

An alien packet from the switch shut down my ethernet card when using nessus?

I'm stuck in between a very bad cocktail mix of two very desperate technologies. One is Nessus and other is a Juniper EX2200. When I'm running the two together, the NIC on my HP MiniTower 6200 Pro ...
1
vote
2answers
1k views

IP Spoofing a threat?

Quick Security Question if i may. We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or ...
0
votes
2answers
161 views

Can I connect our network to the internet but only allow connections to certain servers?

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
1
vote
1answer
174 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
2
votes
3answers
752 views

Reviewing IP(s) that has been blocked by firewall / router

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list? Occasionally, the firewall guys see a high counts ...
1
vote
2answers
653 views

Firewall audit log management tools

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
1
vote
2answers
747 views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
0
votes
0answers
16 views

What are some real world examples of screened subnet firewall architecture? [duplicate]

Possible Duplicate: Public DMZ network architecture screened subnet firewall architecture has a DMZ the outisde world doesnt know about the inside network beyond DMZ and inside doesnt know ...
8
votes
2answers
1k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
2answers
404 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
17
votes
4answers
4k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
16
votes
12answers
21k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
1
vote
2answers
4k views

How secure is blocking all incoming connections on my ADSL or cable router?

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic. Assuming, for the sake of argument, no extra security is ...
0
votes
1answer
733 views

Router with good Firewall for office - total of 50 computers/devices including wifi devices [closed]

I am looking for a good Office Router that can handle good firewall rules, have logs, and ca support about 50 computers/devices connected with wire and wireless. We had different models before, and ...
2
votes
2answers
224 views

Project help required by a newbie!

Basically, I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic ...
1
vote
3answers
3k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
6
votes
4answers
2k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
1
vote
1answer
502 views

Open source firewall with multi wan support [closed]

I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed. ...
5
votes
3answers
4k views

Why do I need a firewall on my router?

I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall. I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
6
votes
4answers
478 views

“There's a firewall on the router into the building so you can turn the one on your computer off”

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
2
votes
1answer
1k views

w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?

It's only an idea. I've recently logged that my server is scanned by w00tw00t tools. I found many solutions to this, such as use of apache mod-security, fail2ban, etc.. The one I want to speak ...