Concerned with software or hardware firewalls
6
votes
2answers
2k views
I'm getting lots of unfamiliar connection attempts, what do I do?
I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places ...
5
votes
1answer
2k views
How is tunnelling SSH through Poxytunnel/HTTPS different from doing it through SSL with Stunnel?
In an answer to What is the difference between SSL, TLS, and HTTPS, it's said that HTTPS is HTTP over SSL/TLS. That is, an SSL/TLS connection is established first, and then normal HTTP data is ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
3
votes
4answers
186 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
3
votes
3answers
246 views
Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance
Why should the firewall be outside the server, excepting these two items
Take the performance impact of noise off of the server.
Add a physical layer between devices so they can be on separate ...
4
votes
5answers
396 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
3
votes
2answers
537 views
Reverse shell connections
Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.
Would not most servers restrict outgoing ...
1
vote
1answer
677 views
Power friendly home router, firewall, IDS/IPS setup?
For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly?
I used to have a shelf full systems doing various ...
7
votes
7answers
1k views
What security implications are there for allowing outbound SSH traffic?
My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
2
votes
5answers
375 views
How do a firewall's rules for individual programs work?
I kind of know that how a firewall's rules for IP/port work, but I have no idea how a firewall deals with individual programs.
In other words, how does the firewall know a program wants to access the ...
2
votes
3answers
695 views
Use a Common Firewall for two Different Subnets
I want to implement a security scheme in a new network configuration. There are two buildings for the client:
Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0,
Gateway 10.0.0.1 ( ...
5
votes
2answers
6k views
What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff.
So I ...
1
vote
3answers
1k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
6
votes
2answers
4k views
What is best practice for separation of trusted zones from a DMZ with a single firewall?
At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
4
votes
1answer
174 views
Placing a firewall—without creating a new subnetwork
I have a couple of networks that have multiple IP addresses, and where I have absolutely no choice as to the equipment used for the network's edge router (the device that connects both to the LAN and ...
3
votes
2answers
231 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
4
votes
4answers
9k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
4
votes
2answers
932 views
incoming packets in server
I have enabled iptables logging for packets coming from the outside
-A INPUT ! -s 192.168.218.0/24 -j LOG
Now i am seeing lots of incoming packets from unknown addresses
Jun 5 14:54:56 localhost ...
7
votes
6answers
213 views
Why shouldn't I run other applications on a Firewall?
If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?
The only opened port to the world (wan ...
1
vote
2answers
299 views
Is the level of traffic normal against my blocked ports?
I was recommended by my brother to direct the question here about the level of traffic I get against several of my blocked ports.
I run pfsense 1.2.3, router in bridge.
Behind pfsense I have:
1x ...
0
votes
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
5
votes
2answers
904 views
Firewall Configuration Audits
I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
2answers
363 views
What are the risks associated with relying on IPSec IP Filtering?
When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox).
Because IPSec Filtering is not stateful, ...
6
votes
2answers
782 views
Getting self-signed SSL certificates for all https connections made from some premises
Context:
I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
4
votes
4answers
919 views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
4
votes
4answers
662 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
9
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
7
votes
4answers
418 views
What kind of IT security applications do you guys run on your laptop/desktop?
I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
6
votes
3answers
254 views
When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?
When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
4
votes
3answers
1k views
How do I configure nmap to verify my firewall is performing stateful packet inspection?
As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our ...
3
votes
1answer
391 views
Firewall rules to block unwanted protocols on given ports
Does somebody has an idea, that what kind of iptables/pf rule must i use to achieve this?:
i only want to allow these connections [on the output chain]:
on port 53 output only allow udp - dns
on ...
8
votes
4answers
590 views
Software vs Hardware Firewalls
I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall.
I was just curious as to the take on Firewalls in general for a small-medium ...
2
votes
2answers
243 views
What compliance framework is appropriate for firewalls
As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall.
In our society we have a deep ...
3
votes
2answers
4k views
Disabling windows firewall remotely
i use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?
13
votes
5answers
1k views
To firewall or not to firewall?
There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
7
votes
4answers
1k views
Security Services on Edge Router vs. Standard Firewall
If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it?
For instance, Core Switch --> ...
9
votes
4answers
811 views
What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?
I don't want this to be subjective, so I'll try to make the requirements as clear as possible.
On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:
Using the internet ...
3
votes
1answer
598 views
I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?
(Is this too application specific? It seems like a reasonable question that would be useful to other people...)
So, I've got this ASA in front of a network that I didn't set up. It's been ...
22
votes
7answers
7k views
Why do people tell me not to use VLANs for security?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
4
votes
2answers
823 views
Cisco ASA Security Contexts: Any Real World Installs?
We are looking at deploying a Cisco ASA 5520-I am looking at the security contexts feature, and was wondering if anyone has deployed their ASA in this way, and how it is working out for them.
Have ...
8
votes
2answers
285 views
What is secure enough for web applications?
we intend to build a network in a small health center with No Internet Access
it is expected to have 30 terminal machines, all machines will use an electronic medical record web application
we want ...
17
votes
6answers
1k views
Port Knocking is it a good idea?
Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
9
votes
2answers
334 views
A firewall without any extra features
I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:
I disabled autorun using these tricks;
I ...
0
votes
1answer
414 views
JUNIPER Junos Pulse - how to apply policy to device
we'd like setup and use Juniper Junos Pulse at iphone and ipad for access to Corporate mail.
we have juniper SA, prepare policy, but Question: how to apply policy for device?
8
votes
2answers
200 views
Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)
In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
6
votes
4answers
560 views
How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?
I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
3
votes
2answers
282 views
What criteria do you use for evaluating Client-Side / Endpoint security products?
What features are important to you in client-side AV and Firewall products?
Who benefits from these features? Managment, the end user, helpdesk.
Are there features that are being 'sold' by the ...
6
votes
2answers
193 views
What tools are available for distributing and syncing firewall rule-sets to multiple devices?
I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
10
votes
7answers
1k views
Egress filtering on an office network?
With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
