Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
0answers
1 view

Strange ip's on firewall log

Check the image on my routers firewall log i can see traffic from strange ip address to my public address. what are these? i just setup this router few hours ago, am i been hacked or part of DoS ...
0
votes
0answers
3 views

Firewall Throughputs [migrated]

I am looking at purchasing a new UTM/Firewall device for the sole purpose of bandwidth control/utilization and guest modes. I have the following terms that are troubling and I would like someone to ...
0
votes
1answer
34 views

Scope for information security in 2yrs down the lane? [on hold]

I'm a fresher. Very recently I started doing Java course because of the wide opportunities we get to enter into an IT industry. Now, I've got an opportunity to work for a project that's related to ...
1
vote
0answers
19 views

SSH: Only allow known IPs [migrated]

I want to allow only a known IP address block to SSH into our servers. I have Windows Server 2012, R2, CentOS 7 and Ubuntu 12 and 14. What is the best practice for each OS to accomplish this?
1
vote
1answer
44 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Win7 installed on 26 Aug'15 and fully updated). Trojan ...
-3
votes
0answers
34 views

Any One Who Can Bypass Web Sultan Webapplication Firewall [on hold]

Any One Here in this Panel Who Can bypass this WebSultan xss based firewall link: http://anonkhan.host56.com
1
vote
1answer
43 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
0
votes
1answer
61 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
1
vote
2answers
60 views

What is the real benefit of a three tier architecture?

As per title, what is the real advantage of using three tiered architecture, where the user interface in one layer, the second layer for application and third layer for database? I can understand that ...
0
votes
3answers
3k views

Should I restrict Core Networking firewall rules in Windows server?

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80. Now in my firewall I only have ...
2
votes
2answers
31 views

Profile applications from traffic analysis

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons. I want to know if it is possible ...
10
votes
2answers
723 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
13
votes
4answers
45k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
1
vote
1answer
25 views

Using a Firewall to Trigger Truncation in DNS UDP Response

Assume I am a firewall between client and server. If the client sends a DNS query with UDP, I should response this query with set the truncated flag=1. As a result, the client will be forced to use ...
2
votes
2answers
250 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
0
votes
1answer
70 views

How to block detour programs that bypass firewalls?

We setup a ISG-1000 firewall about a month ago with the goal of blocking specific URLs. Please see image file below in which there are 70EA PCs. Even though we think we blocked specific URLs, some ...
1
vote
2answers
207 views

Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?

Even with all the privacy, sync, and p2p settings off, using an offline account, I don't feel safe using Windows 10 for a business. I would like to restrict its ability to communicate to Microsoft (or ...
3
votes
1answer
92 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
-2
votes
1answer
71 views

Random scanning or potential attack/recon? [duplicate]

If the purpose of a SYN Flood attack would be to make the target unresponsive to normal traffic, same as any other DoS, wouldn't this attack generally have been directed at a public server rather than ...
1
vote
2answers
32 views

The workings of a stateful firewall

Say I have network A and network B. I wish to SSH from network A to network B. Hence, I would set a route from network A to B, and in the stateful firewall, I will allow a rule for Network A to B at ...
5
votes
2answers
4k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN ...
32
votes
4answers
8k views

Is there any meaning in only allowing port 80 and 443 today?

It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports ...
1
vote
1answer
56 views

Firewall egress filtering by domain

In our production environment, we are connecting to a few core external service providers though their APIs and are required to have all other services blocked (PCI DSS). We currently have a firewall ...
2
votes
4answers
28k views

What is the difference between antivirus and firewalls

I need a brief explanation about the differences between antiviruses and firewalls
2
votes
1answer
128 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
3
votes
3answers
133 views

Open ports with no services binded to them

I have been wondering, if a port is open for inbound connections on the firewall yet there is no service binded to it, would that be considered a security vulnerability?
1
vote
3answers
156 views

What is the simplest way for a Proxy/UTM to block HTTPS traffic using URL filtering?

I'm building a UTM using ubuntu, How can I block HTTPS traffic using URL filtering? (For example I want to block https://facebook.com) I'm using Squid as a transparent proxy server. Solutions I don't ...
-3
votes
0answers
71 views

SYN Flood attack on private user - steps for post-analysis?

The firewall in question, used in a secured home office, reported a series of SYN Flood matches on various requests coming in over a ten-second period. The IP and country of origin changed with every ...
0
votes
0answers
11 views

Blocking all remote connections - Cisco LRT214 [migrated]

Recently had a SYN Flood attack on my home office. The attack was stopped by our Cisco LRT214. Most of the configs are manufacturer default. Any way to simply disable all remote connections without ...
3
votes
1answer
118 views

Segregating a Printer in my Enterprise Network

I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice. The only problem is that ...
2
votes
2answers
61 views

Preventing active OS fingerprinting with iptables

I'm studying network security on my own and I have a few basic theoretical questions here. Would dropping every incoming packet at the network layer be enough to prevent active OS fingerprinting? I ...
3
votes
5answers
345 views

Enforcing personal firewall for OS X

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
0
votes
0answers
8 views

What is the correct mask to use with 224.0.0.0? [migrated]

What is the best mask to use to allow computers to use the multicast IP address 224.0.0.0? I've only seen IP addresses using the lower 8 bits, in my case I just see 22 and 251. So my firewall uses ...
-1
votes
4answers
5k views

why Windows Firewall in XP cannot block outbound connections [closed]

wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones. another article says: XP defends you with your traffic coming from the web but ...
7
votes
3answers
336 views

What tools are available for distributing and syncing firewall rule-sets to multiple devices?

I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
1
vote
0answers
37 views

how to configure naxsi to accept json format in rest apis?

For example one of my APIs is: Post request: /api/v0/login body: { "username":"xxx@ggg.com", "password":"eeeee" } I want to secure this API with naxsi, I could not find anywhere to config naxsi ...
3
votes
2answers
50 views

When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?

This answer says there are a few ways of dealing with a blocked packet at a firewall: At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive ...
4
votes
3answers
10k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
6
votes
5answers
323 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
1
vote
1answer
39 views

what is more secure, to have PPPoE on the modem or on the firewall

We are trying to understand what a more secure installation is: a) A modem connected to the internet with PPPoE doing a NAT to the firewall than doing a second NAT for all the devices b) A modem ...
1
vote
3answers
137 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
-1
votes
2answers
7k views

VPN blocked ports problem

I use VPN quite often in public places where I don't want anyone to read my web traffic. However, some public places have firewalls that block ports required to establish a VPN connection (I usually ...
1
vote
5answers
75 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
4
votes
1answer
69 views

Is there such thing as an OS “internal firewall”

I was wondering if there is such thing as an OS "internal firewall". If it exists, it must be under a different name. I am looking for a way to control which applications can talk to which other ...
0
votes
1answer
42 views

Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls

All of the material I'm reading on Proxy Firewalls, Content Inspection, Application Layer Firewalls & Web Application Firewalls indicates that they are inherently unique devices / applications. ...
6
votes
3answers
29k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
1
vote
0answers
71 views

Web/search engine spider on local network?

I was setting up a test webserver on my local network earlier, and whilst sorting out the firewall I noticed the following in the log (/var/log/ufw.log - I'm using UFW on Ubuntu 14.04): Jul 9 ...
2
votes
1answer
108 views

Is it safe to whitelist CDN domains?

I am trying to whitelist URLs for my PC but I want to eventually roll out the rules to my small company's firewall. But I'm having trouble with CDNs since a page may load content from many distinct ...
1
vote
2answers
66 views

Safety of routing a network to a firewall

I am studying for my CompTIA Security+ qualification and have come across the following question. Question : You are implementing a testing environment for a development team. They use several ...
3
votes
1answer
63 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...