Concerned with software or hardware firewalls
6
votes
3answers
115 views
Trying to firewall ports 1863, 5190
I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
...
0
votes
1answer
43 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
0
votes
1answer
72 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
1
vote
2answers
485 views
How to check if a port can be accessed from the outside
I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at ...
-3
votes
1answer
63 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
5
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
-1
votes
0answers
31 views
How to block WCF services using Firewall or any other security setting
For an application testing purpose I want to know how to block applications that are trying host http WCF host services. Could someone please point me the right place to block? I've been guessing and ...
2
votes
2answers
77 views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
3
votes
2answers
91 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
1
vote
1answer
51 views
Whats a secure firewall rules using UFW?
On my Ubuntu server I have these services running:
netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
4
votes
4answers
158 views
HTTPS firewall rule
Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall
This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
2
votes
2answers
190 views
How does a firewall help to protect a server?
Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
3
votes
3answers
96 views
Securing a network attached storage on the internet
I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.
I'd like to secure ...
2
votes
1answer
139 views
Normalizing Windows Advanced Firewall rules
How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
1
vote
2answers
58 views
Remote File Injection in ARGS blocking form updating database
I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule.
How do I stop this apart from not including URLs in the form fields or removing the http:// ...
-1
votes
3answers
134 views
What is the difference between a Gateway and a Firewall? [closed]
What is the difference between a Gateway and a Firewall and how do they relate to one another?
I am a developer trying to get a general understanding of network security.
-1
votes
1answer
70 views
Is there a tool I can use to see if my website is being blocked by common business content filters? [closed]
Not 100% sure this is the right site, but hey-ho,
Title sums it up, I'm getting sporadic reports from a couple of clients that people visiting bits of their sites are being blocked with a message ...
4
votes
3answers
156 views
The safest way to circumventing Iran's Internet censorship
We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy.
Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
-1
votes
2answers
91 views
Allow embedded videos while keeping youtube blocked [closed]
Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy.
How can ...
6
votes
3answers
493 views
Evasion techiques for WAFs
Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
2
votes
3answers
222 views
It's necessary setup a firewall in both PC and router?
If I have the router firewall enabled, it's really necessary setup iptables in my system? Isn't it a little redundant?
For example I add a rule in the router where the PC can't use the port 12345 ...
4
votes
1answer
147 views
How to whitelist an Amazon ELB in a(ny) firewall?
We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address.
However, we are running our system behind an Amazon Elastic Load Balancer ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
-5
votes
0answers
65 views
How can i use Torrent client to download file in Firewalled network where it has been blocked? [closed]
I am using my College wireless network to browse internet and download files via http or p2p, but recently they've blocked all those functionality including torrent. i know some paid VPN service allow ...
4
votes
1answer
146 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
2
votes
1answer
74 views
Barracuda antispam access to active directory in dmz : opening port or not?
I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed.
What I see on the web is people ...
-1
votes
1answer
114 views
How to find IP Addresses that have been attacking my Computer Ports ?
I am a newbie at Info Sec, and wanted to know which IP addresses are sources of attack traffic.
Can I also find out which ports are being attacked?
Can this information be found in windows firewall? ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
20
votes
7answers
4k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
2
votes
0answers
44 views
Could you attack a port without knowing what service was listening? [duplicate]
A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.
My question is this, though, if the ...
-1
votes
0answers
11 views
Sophos access a webserver from the web [migrated]
I have an web server(IIS) behind an SOPHOS UTM 9
I have setup the Web Application Firewall feature
It is a completely fresh install. No other settings have been eddied.
When I Try to access the ...
1
vote
1answer
59 views
Are there any cross platform firewall solutions with a central management platform?
Currently I have a bunch of servers scattered across a few different providers e.g. EC2, rackspace. Some boxes are Linux and some are Windows. Currently I'm finding the administration of the ...
6
votes
3answers
187 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
3
votes
1answer
190 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
8
votes
5answers
1k views
How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
3
votes
2answers
395 views
What are the TCP/UDP ports used by torrent applications?
I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
2
votes
1answer
58 views
SYN scan, determining scan vs large file upload
In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
6
votes
1answer
587 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
6
votes
3answers
2k views
Proxy vs. Firewall
I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
1
vote
2answers
767 views
What justification is there for Comcast to block SMTP port 25 outbound from residential service?
Within the last week, Comcast seems to have started blocking port 25 outbound from their residential internet service.
I can sort of understand why they might justify blocking it inbound as perhaps ...
-1
votes
1answer
65 views
No data going through IPsec Tunnel [closed]
I encountered the question below in an exam, which I'm trying to understand, kindly help me out to decipher this.
Question: An IPSec tunnel between two firewalls has been set up. However, no data is ...
3
votes
1answer
84 views
Why guest's connections can pass host's firewall?
I've been wondering about this.
Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall.
Why the connections made on ...
2
votes
3answers
133 views
State before getting whitelisted?
There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall.
Is there a common name for the state of the files before they ...
1
vote
3answers
2k views
windows firewall turns OFF automatically
It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
2
votes
2answers
243 views
What compliance framework is appropriate for firewalls
As a more corpose vulnerability assessment and penetration test, one step of our activity is to review from a security perspective the policy of some firewall.
In our society we have a deep ...
0
votes
1answer
75 views
allowing inbounding UDP datagram if outbound has been done [closed]
Situation:
S: Server computer.
F: Hardware device between S and end-user clients
S uses both TCP and UDP for service.
A client (C) connect to S and establish UDP virtual connection.
For knowing ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
3
votes
2answers
328 views
If a port is closed how come you can still use it?
What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" ...
2
votes
2answers
153 views
Does an equivalent for netconf exist in the Cisco ASA world?
I'm looking for a method to send instructions to a Cisco ASA without writing scripts to execute on the CLI over SSH. Cisco doesn't seem to support netconf or xml-pi on the physical ASAs (only their ...
