Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

26
votes
6answers
3k views

How do you explain to experts that a Database Server should not reside in the DMZ?

Our security experts, DBAs, network team and infrastructure team are all saying it's ok to have the DB server located in the DMZ along with the HTTP server and middle-ware server. Their reason: ...
1
vote
1answer
20 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
1
vote
1answer
287 views

Attacking a server on port 80 while only port 22 is open on the firewall

There is a question bugging me a after reading on network security. Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a ...
2
votes
1answer
78 views

Setting up NAT with firewall for RDP connection

I have a vendor who needs to connect remotely to one of our servers. What I thought I would do is setup a NAT rule in our firewall. I have a public IP address that I will have translated to the local ...
1
vote
1answer
60 views

How can I implement a whitelist based on packet content?

At the moment I am looking for some way on Linux to have packet filter whitelisting done but based on fine-grained parameters such as packet content rather than more general parameters such as ...
0
votes
3answers
30 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
0
votes
1answer
35 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
0
votes
1answer
67 views

ESET detected incoming connection to Rundll32

My ESET Smart Security 7 detected incoming connection from an external computer, since Rundll32 can be run by any programs on my computer and I don't know which program is doing this, so I am ...
4
votes
4answers
140 views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
0
votes
0answers
15 views

PC in VMWARE can ping Host computer but host computer can't ping the VMWARE machine [migrated]

I'm creating PFsense lab with this diagram The Webserver can ping the outside host (PC3) but the PC3 can't ping the webserver. The firewall i'm using is PFSense. I have disabled all Window ...
2
votes
1answer
82 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
0
votes
1answer
112 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
2
votes
2answers
58 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
1
vote
2answers
48 views

Proper way to allow access to systems within different offices? [closed]

I have a system that sysadmins in a few of our global offices need to access. What is the best way to grant them access through our firewall to this system? I don't think that having them use static ...
2
votes
2answers
233 views

ASA5505 DMZ issue

I have ASA5505 , connected to the WAN on port 0 (called Vlan2), and connected to my development LAN on port 7 (Called Vlan1). I want to add DMZ, and I connected switch and servers to port 3, and ...
0
votes
4answers
12k views

What is the difference between antivirus and firewalls

I need a brief explanation about the differences between antiviruses and firewalls
1
vote
0answers
9 views

Rate-limit Apache with Blacklist and Whitelist [migrated]

I spent several hours trying to configure iptables/ufw to do this for HTTP requests handled by Apache2: White list a set of IP ranges (search engine bots) Add IPs to a 24 hour block list after X ...
-1
votes
2answers
62 views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
8
votes
1answer
20k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
2
votes
1answer
355 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
1
vote
1answer
86 views

Upload data from Internet to DMZ to an intranet

I've got the following situation: A web server located in a DMZ receives file uploads from web browsers. The uploaded files are stored on the web server's file system. In the next step, these files ...
1
vote
1answer
47 views

How can I keep track of the packages to check any strange behaviour [closed]

I've just realized there was a girl that asked someone to hack my computer and also my telephone (that's why WhatsApp was working strange). Right now I'm trying to protect myself at least on my ...
2
votes
4answers
77 views

Do I need antivirus for this unusual installation - or just firewall?

I'm donating an old Windows XP laptop to a school. The machine will spend its golden years doing only one thing - a process that consists of just three steps: Recording lectures and discussions ...
0
votes
1answer
46 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
2
votes
3answers
104 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
0
votes
1answer
219 views

Foreign MRT.exe?

I was managing my firewall using AVG and I noticed this was allowed: I have north american locale, and sometimes Japanese locality(?), and that is not Japanese. It is getting through my firewall, ...
0
votes
0answers
25 views

Disable Win FW - via WinRS? [migrated]

Security practitioner working on MCSA, trying to see what I could do with WinRS from remote, namely disabling the firewall. winrs -r:1.1.1.6 netsh firewall offline sh mode Returns that the firewall ...
0
votes
1answer
55 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
-1
votes
2answers
47 views

Tools to check the firewall Configurations as per PCI standards [closed]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
1
vote
1answer
53 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
2
votes
1answer
84 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
1
vote
1answer
65 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
2
votes
0answers
112 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
3
votes
5answers
158 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
1
vote
1answer
64 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
4
votes
5answers
14k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
0
votes
3answers
56 views

Confusion over a firewall and proxy

A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443? Also, if a firewall is to control outbound ...
1
vote
2answers
319 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
0
votes
3answers
165 views
1
vote
0answers
56 views

Configure icefloor to prevent leaks when VPN connected

I am trying to configure icefloor firewall on OS X 10.9 so as to make sure all traffic will go through VPN. I recently notified that even with "Route all traffic through vpn" option in tunnelblick ...
1
vote
1answer
50 views

Based on which criteria is this outbound traffic being blocked? Only HTTP passes, on any TCP port?

There is a server program running behind a home ADSL modem/router, at a premise that I'll call C; the program listens on TCP port 29401, and accepts connections using a custom binary, non-HTTP, ...
2
votes
3answers
5k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
0
votes
1answer
60 views

Firewall log entry: need help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds: /var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: ...
0
votes
1answer
47 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
1
vote
1answer
456 views

Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility?

im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.
2
votes
1answer
36 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
1
vote
1answer
34 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
4
votes
1answer
5k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
1
vote
2answers
80 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
2
votes
2answers
132 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...