Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

1
vote
0answers
9 views

Does altering the routing table to my hub defeat the purpose of a VPN?

I am running a VPN on my server with openvpn. When running openvpn I have a shell script that runs afterwards: ip rule add from 192.168.0.19 table 128 ip route add table 128 to 192.168.0.0/24 dev ...
1
vote
1answer
69 views

Multiple instances of programs allowed in Windows Firewall

I am new to Windows Firewall. While allowing a program through Windows Firewall, I found multiple entries present for Firefox and Java. Why is that?
0
votes
1answer
32 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
1
vote
2answers
118 views

Using nmap to bypass a firewall and perform OS fingerprinting

How can I use nmap to perform operating system detection on a system which has all of its ports filtered by a firewall? Is there a way to bypass it? I have tried: syn scan, xmas scan, fragment ...
-4
votes
0answers
95 views

This guy claims no need to apply any Windows update or use Antivirus! Do you agree? [duplicate]

He said only need to block all incoming connections and use Chrome sandbox. You can read his claim and his other replies over here: ...
3
votes
2answers
234 views

Is it safe to not update Windows if you dont accept any incoming connections?

I see this guy shared his thought: How to be safe even without most updated Windows updates So he claims that as long as you do not accept any incoming connections and just use sandbox of Chrome, ...
0
votes
0answers
15 views

Cisco ASA Access List Summary / Visualisation Tool

I have a Cisco ASA firewall config with about 50 interfaces and approximately 4000 rules. I am trying to find a tool that can sort this into an easier to consume list or even a visualisation of the ...
3
votes
3answers
630 views

Suspicious VMware connections that bypass firewall

I'm running VMware 5 and I have found that when I start up VMware I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
0
votes
1answer
138 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
-1
votes
1answer
42 views

How does PeerBlock generate range descriptions?

How does PeerBlock generate the range that it displays? I thought it was through some DNS lookup, but when I do the lookup I get LeaseWeb Content Delivery Network for the attached screenshot. Instead ...
-2
votes
2answers
147 views

Why can't home internet users communicate with their peers? [closed]

As a home internet user, why does my ISP block my communication with any other client on the same subnet as mine? It is done for security obviously, but what is the risk? Update: as clarified by ...
3
votes
2answers
56 views

Why does our network firewall drop netbios-ns packets?

In our local domain environment, we use Sophos UTM to protect our network. When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
2
votes
2answers
1k views

Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or ...
6
votes
3answers
1k views

Network Vulnerability Scanner placement on network

We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard. Qualys supply a scanner appliance for the internal network scanning, which ...
7
votes
3answers
37k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
4
votes
1answer
276 views

Can a Cisco ASA 5505 block this DDoS attack?

Since more than a week ago, my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load ...
2
votes
2answers
62 views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
1
vote
1answer
92 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
6
votes
1answer
103 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
1
vote
1answer
42 views

Firewalled bots in UDP p2p botnets?

One thing that I don't understand about peer to peer botnets, is how a bot stays connected to the network considering the protocol used is UDP. Since the UDP is connectionless, and the bot is behind ...
1
vote
2answers
100 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
1
vote
1answer
64 views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
0
votes
0answers
39 views

DDoS Solution for request floods [duplicate]

What are the mitigations to protect from ddos? Is using firewall like cloudflare would help or not? My use case is just want to make sure that no one is sending flood of requests i.e. thousands per ...
1
vote
1answer
79 views

UDP DNS & Firewall

This question might be simple but please understand my lack of knowledge. I am seeing a lot of DNS packets dropped by our firewall (sophos SG125) by default rule 60001. There are three Domain ...
3
votes
0answers
73 views

Modifying shell code to bypass Windows Firewall

As part of my OSCP's training, I'm supposed to get a shell on a Win7 machine using browser's exploit (MS12-037) with Windows firewall on. I have an idea but I'm having hard time applying it. What ...
-1
votes
2answers
88 views

Determining Firewall settings (Ports, etc) for specific applications

How can we identify the network or network firewall requirements for a Desktop or Web application. Meaning what ports are required by the applications. How the Cloud and non Cloud networks communicate ...
1
vote
2answers
47 views

Is there a difference in security between an IP address white list and a domain white list with TLS?

It seems to me that an IP address white list relies on easily spoofed information, while a domain white list, if it forces TLS, at least, relies on the validity of the certificate systems. I may be ...
1
vote
1answer
81 views

How does a malicious user connect to a private network?

I have followed these instructions for setting up a couple of servers to have private networking. It ends by saying "It is important to secure your private networking interface the same way you would ...
2
votes
1answer
159 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Windows 7 installed on 26 Aug'15 and fully updated). Trojan ...
2
votes
2answers
101 views

How to block I2P and Freenet to my network?

I am trying to find a way to block I2P and Freenet darknets in a corporate network. Does anyone know a way to block them (on firewall)? Do I need to close particular ports or block entry nodes (like ...
1
vote
1answer
77 views

Question about IPv6, NAT, firewall, port forwarding, upnp and security

In the next months/years my ISP might give me IPv6 for my home connection. But what are the security implications? Will local network servers/embedded devices be accessible from the whole internet? ...
2
votes
1answer
49 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
2
votes
1answer
80 views

What are the security implications of autorun and external drives?

I have some questions about the security implications of accessing internal and external storage since I cant find any more information on it from what I've read. I have read about a variety of ...
1
vote
2answers
122 views

Shared Office Network Security - VPNs, Firewalls, and systems

First, let me premise this post with the fact that I am completely new to network security. I have done a fair bit of reading up, but I am certainly by no means a professional. If anything I say here ...
7
votes
5answers
31k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
10
votes
4answers
11k views

How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
2
votes
2answers
38 views

Why do ALGs restrict traffic on a given TCP port based on the protocol?

My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
1
vote
2answers
737 views

Attacking a server on port 80 while only port 22 is open on the firewall

There is a question bugging me a after reading on network security. Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a ...
2
votes
2answers
197 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
-2
votes
4answers
79 views

Zero-day malware protection [closed]

What is the best approach in defending your company against zero-day malware? Is there a firewall/system to do that? Is it good to run every file in a sandbox and to track activity of the sandbox?
0
votes
2answers
54 views

Protection against file distributed malware

Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware ...
3
votes
1answer
42 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to white list all the APIs and static resources of an application. Although from the security ...
1
vote
1answer
46 views

Best appraoch to test inhouse firewall effectiveness

We have Fortigate 100D that has antivirus profiles enabled like SMPT, POP3 and IMAP. How one could make sure that the antivirus is working as expected ? For instance it seems that Fortigate has ...
5
votes
1answer
924 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
3
votes
1answer
30 views

Why can't nmap identify the danted(socks5) service on non-standard port?

I'm testing nmap's abilities, I started a socks5 proxy server with danted, and started it on port 10090 I tried the following command, and expect it to tell me port 10090 runs a socks server, nmap ...
5
votes
2answers
235 views

Setup a private VPN for family in China?

I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore. Is it possible to setup my own VPN (or ...
2
votes
1answer
61 views

If a firewall deletes DOS packets before they reach the designated application. Is it then possible to break trough the firewall with a DDOS attack?

My Question is that if a Firewall blocks for example a DOS attack of UDP packets. Is it then possible to "break" or take up the capacity of a server by sending enough packets trough a DDOS attack? or ...
9
votes
6answers
7k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
0
votes
2answers
81 views

Using Two Different Brands of Security Tools To Block Backdoors

There's this idea of using 2 brands of firewalls both inline that is usually brought up: {Internet}<-->FW(A)<-->FW(B)<-->{Internal Network} Or using 2 algorithms: {Plain ...