Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

6
votes
2answers
394 views

What does a Firewall mean by “connect to TCP port without your permission”?

McAfee is reporting incoming network connections blocked from IPs like 198.252.206.149 (StackExchange Inc.), 54.179.231.116 (Amazon Technologies Inc.), 74.125.68.106 (Google Inc.), etc. The ports ...
0
votes
1answer
32 views

Linux iptables DNAT on incoming packet without conntrack (stateless)

In my linux box 10.20.1.1, i got two UDP apps binded on port 46000 (App A) and 36000(App B) respectively. The apps communicate with two UDP servers bindeded as 10.10.1.1:36000 (Srv X) and ...
1
vote
1answer
34 views

Block An IP Address Scanner On Mac [on hold]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
0
votes
1answer
64 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
7
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
1
vote
1answer
48 views

Segregating a Printer in my Enterprise Network

I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice. The only problem is that ...
0
votes
0answers
17 views

Firewall: Packet Filtering SMTP using the ACK flag [closed]

When considering packet filtering for SMTP and I add the source port and a Flag for ACK to the table how do I determine what the source port should be for each rule. My initial thought was to make ...
15
votes
4answers
2k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The ...
1
vote
3answers
955 views

How to prevent attacks to server

I have 3 CentOS server configured for my applications. Recently I recognized that there is so many attacks to my servers. I have so many logs about attempt to login to my servers using sshd from ...
0
votes
2answers
72 views

Inspecting every packet leaving the system for sensitive information ? [closed]

Is there a way to check every packet leaving the system for sensitive data like IP addresses, personal information (like logins) etc ? A free (and preferably open source) program which does this for ...
0
votes
2answers
42 views

using html5 websockets to bypass firewall TCP policy

I've read that html5 enables opening tcp sockets from the client side in its "websocket" feature. Firewalls as I recollect may be configured to block tcp connections initiated from "the outside" by ...
1
vote
1answer
65 views

How much of your web browsing behavior is VISIBLE to the administrators when you're behind HTTPS or VPN? [closed]

For example. If you're behind a VPN and want to get on on facebook and youtube. Will all outgoing traffic need to make a request to the firewall first? I don't really know extensively how well a ...
7
votes
3answers
3k views

Is it necessary to setup a firewall in both PC and router?

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant? For example I add a rule in the router where the PC can't use the port ...
2
votes
1answer
126 views

Understanding OpenWRT LuCI Firewall Routing with VPN

I'm still fairly new to networking, and I'm having a little trouble grasping some concepts of the proper firewall rules I need to implement for my desired setup. I'm setting up a router with OpenWRT ...
1
vote
1answer
365 views

OpenVPN and firewall configuration in LuCI

I'm trying to find the best (most secure) configuration for the firewall in OpenWRT. I'm using LuCi to configure all the stuff. I have successfully created a VPN (OpenVPN). It is supposed the best ...
3
votes
2answers
105 views

Decrypt and then re-encrypt all requests to the internet at firewall level

I don't have strong skills about this matter but I am very curious about the following communication so may I ask: One institution sent a message to all network users saying that "all requests to the ...
0
votes
3answers
131 views

What are the main reason to deploy Secure Web Gateway?

As Gartner defined, Secure Web Gateways utilize URL filtering, advanced threat defense, legacy malware protection and application control technologies to defend users from Internet-borne threats, and ...
10
votes
0answers
1k views

If you block all incoming connections, how can you still use the internet? [migrated]

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block ...
0
votes
4answers
280 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
1
vote
2answers
201 views

Persistent Connection Attempts By Akamai Technologies

I have seen this question asked in different places, but have never seen a satisfactory answer: On different computer builds, ASUS/GIGABYTE/MSI, I constantly have outgoing connections to ...
1
vote
2answers
111 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
12
votes
1answer
283 views

Should a server be considered compromised simply because a port was open?

Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy ...
1
vote
2answers
78 views

How do people typically perform security audits of firewalls?

In my days as a pentester, we used to use tools like Nipper, combined with manual analysis, to perform audits of firewall configurations. However, in my current company we have many different ...
4
votes
1answer
83 views

Firewalk through a Firewall on our subnet

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram: (Skip to the bottom of the following explanation for a direct list of ...
3
votes
1answer
49 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
0
votes
0answers
56 views

explorer.exe outbound (Unexplained TCP Connections)

So I've already disabled SSDP Discovery in Windows Services. I'm also not conducting any searches. I also have file indexing disabled on my system. I noticed a number of outbound connections coming ...
23
votes
3answers
21k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
1
vote
1answer
27 views

Is it a good idea to disable WHM backend and only enable it through ssh when needed?

I have recently set up a managed VPS and it came per-installed with CentOs and WHM. I have configured SSH logins to use private keys and i can SSH into the server with root privileges. I realize ...
0
votes
0answers
31 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
0
votes
2answers
66 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
1
vote
0answers
73 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
2
votes
0answers
38 views

Can NATs and firewalls blacklist IPs when trying to UDP hole punch?

I am developing a P2P application that will make use of UDP hole punch to connect two peers behind NAT. When dealing with connections between a cone and a symmetric, unpredictable NATs, however, hole ...
0
votes
1answer
43 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
2
votes
0answers
34 views

Windows Firewall single rule with multiple IP addresses vs multiple rules with single IP address [closed]

I've tried finding some resources to help me on my dilemma, but wasn't successful in my approach. So here goes: I am implementing an automated firewall manager for Windows Firewall which will ban ...
0
votes
2answers
118 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it most likely belong to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From ...
3
votes
2answers
92 views

Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN

I am testing/setting up a Thompson TG585v7 router/firewall. Results when running nmap from a computer INSIDE the LAN $ sudo nmap -O 210.86.xxx.xxx Starting Nmap 6.40 ( http://nmap.org ) at ...
3
votes
2answers
114 views

If nmap reports a port is open, does that ALSO mean a service is listening on the port?

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN. These ports are in the range 1024 through to 2500 That X54 ...
2
votes
2answers
60 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
8
votes
1answer
154 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
1
vote
0answers
90 views

open ports on a netgear N-150 router; disable SPI firewall? [closed]

How do I open all ports? At least internally, for LAN traffic from 192.168.1.x to 192.168.1.x I want all ports open. Even if it creates a security problem. thufir@doge:~$ thufir@doge:~$ nmap -p ...
4
votes
3answers
8k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
0
votes
2answers
159 views

Prevent hacking with known IP address and router information on Ubuntu 14.04 LTS [closed]

I’ve had it! It is the second time that a “hacker” (A hacker or should I say thief) has had access to my Ubuntu 14.04 LTS system. The person that I suspect has had physical access to my pc because he ...
1
vote
1answer
267 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
0
votes
2answers
2k views

Port Scan Detected and Blocked! - Bitdefender 2014

I have Bitdefender Total Security 2014 Recently I have been getting the message/alert "Port scan detected and blocked", I did not cared about it much till I getting increasing specially in a specific ...
2
votes
2answers
454 views

ASA5505 DMZ issue [closed]

I have ASA5505 , connected to the WAN on port 0 (called Vlan2), and connected to my development LAN on port 7 (Called Vlan1). I want to add DMZ, and I connected switch and servers to port 3, and ...
1
vote
1answer
35 views

Can sshd block IPs with failed attempts or is a tool like denyhosts or fail2ban necessary?

I am only indirectly familiar with denyhosts (and only just discovered fail2ban) and they certainly seem like worthwhile tools. However, after looking through the options for sshd_config I am trying ...
4
votes
3answers
6k views

Securing a network attached storage on the internet

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup. I'd like to secure ...
1
vote
1answer
512 views

How to configure Suricata to not interfere with virtual machine [closed]

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
0
votes
1answer
854 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
2
votes
1answer
61 views

Do the firewall hardware specifications have to be better than the network it protects?

If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine. If a server can't handle a DoS/DDoS attack because it consumes it's resources does this mean the firewall has ...