Tagged Questions

Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
1answer
32 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
1
vote
1answer
26 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.
-1
votes
2answers
35 views

Tools to check the firewall Configurations as per PCI standards [on hold]

How do you audit the Firewall rules and configuration policies as per PCI standard. What are the tools used for it.
2
votes
1answer
45 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
1
vote
1answer
35 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
0
votes
1answer
20 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
2
votes
2answers
74 views

Where to place a vulnerability scanner within a data center

There is currently a debate in my office on the best location to place a vulnerability scanner (a distributed scanner - Rapid7 Nexpose, using scan engines) within a data center. I see two options: ...
1
vote
1answer
45 views

Strange TCP traffic on Mac OS X from 'rdmd'

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions: rdmd 85842 0 9u IPv4 0xca0e547f0a118fdb 0t0 TCP ...
2
votes
0answers
59 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
0
votes
3answers
43 views

Confusion over a firewall and proxy

A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443? Also, if a firewall is to control outbound ...
0
votes
1answer
93 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
1
vote
1answer
23 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
0
votes
3answers
112 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
0answers
7 views

Sonicwall GAV / DPI between VPNs [migrated]

We have multiple remote sites connected via VPN to a central site that uses a Sonicwall NSA 250 (running SonicOS Enhanced 5.8.1.15-51o). I'd like to allow the remote sites to talk to each other by ...
1
vote
0answers
29 views

Configure icefloor to prevent leaks when VPN connected

I am trying to configure icefloor firewall on OS X 10.9 so as to make sure all traffic will go through VPN. I recently notified that even with "Route all traffic through vpn" option in tunnelblick ...
1
vote
0answers
33 views

How can I make my computer trust a firewall web server certificate? [migrated]

Every time I log into my firewall I get a message that says: The site's security certificate is not trusted! I know this is because my firewall doesn't have an identity certificate from a ...
1
vote
1answer
42 views

Based on which criteria is this outbound traffic being blocked? Only HTTP passes, on any TCP port?

There is a server program running behind a home ADSL modem/router, at a premise that I'll call C; the program listens on TCP port 29401, and accepts connections using a custom binary, non-HTTP, ...
0
votes
1answer
55 views

Firewall log entry: need help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds: /var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: ...
1
vote
1answer
47 views

How can I implement a whitelist based on packet content?

At the moment I am looking for some way on Linux to have packet filter whitelisting done but based on fine-grained parameters such as packet content rather than more general parameters such as ...
0
votes
1answer
38 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
1
vote
1answer
444 views

Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility?

im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.
2
votes
1answer
35 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
1
vote
1answer
29 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
1
vote
2answers
60 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
2
votes
2answers
124 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
2
votes
1answer
49 views

Should reverse connections be used to bypass NATs?

I'm planning on doing a demonstration on how remote administrative tools work for my schools computer security club. I plan on writing a RAT in C++ and demonstrating/explaining how it works. I ran ...
0
votes
0answers
16 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
0
votes
1answer
69 views

Creating a secure home network - Which firm ware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
0
votes
2answers
138 views

Trying to get rid of hackers who have access to all my devices

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
1answer
56 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...
0
votes
1answer
52 views

Web browser initiating connection on non-standard ports. Should it be blocked?

I am doing some egress monitoring on my computer. Once in every few days, I would find some strange connections being logged, which I believe is initiated by the web browser through a related but not ...
1
vote
1answer
41 views

How to check whether firewall allows traffic on specific port but not listening on the port [closed]

I have client / server and there is a firewall between them.The server is listening on a port and I want to check if this port is allowed by the firewall. I can only know the ports that the machine ...
-4
votes
1answer
98 views

What are the ways to block all BitTorrent clients from accessing my router? [closed]

What are all the values need to be entered in the source and destination IP address and Subnet mask in order to block the bit torrent file exchange.. i.e. blocking torrenting My router's filtering ...
1
vote
2answers
159 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
3
votes
3answers
195 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
2
votes
1answer
304 views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN ...
1
vote
1answer
68 views

Is it possible to track the email sent via BCC List using firewall or network security software?

I want to know whether is it possible to know the conversation/email sent via BCC can be identified by admin in some corporate companies? I have heard that email sent from BCC cannot be identified, ...
0
votes
1answer
139 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
0
votes
1answer
32 views

NAT separate firewall or other security tools

It's a conceptual question: Suppose i want to separate NAT and firewall, can it help to my security? INTERNET >>>> NAT >>>> Firewall >>> MyNetwork
1
vote
2answers
155 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
1
vote
5answers
109 views

Firewall rules by URL

is there a solution to create FW rules by URL instead of IP for inbound traffic? For example a.example.com and b.example.com are the same IP on the DNS, but they are different sites, is there a ...
0
votes
2answers
243 views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
1
vote
2answers
105 views

How does Network Address Translation (NAT) increase firewall effectiveness

Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not? How ...
2
votes
1answer
853 views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
1
vote
1answer
125 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
2
votes
2answers
621 views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
4
votes
1answer
95 views

DMZ Firewall settings

I am involved in project where I have to install a new server for a new application to a preexisting production network. The new server shall sit in the DMZ and two controllers will sit on the ...
0
votes
2answers
123 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
0answers
35 views

Is it possible to covertly tunnel data using L3DSR? (or any other TCP or IP layer hack)

I asked this question on ServerFault regarding how a Netscaler embeds low level data in a TCP packet, round-trips it, and then uses that data to loadbalance the user. Similar to DNS Tunneling, I ...
31
votes
5answers
6k views

Are two firewalls better than one?

Let's say that our first firewall have some vulnerability and malicious person is able to exploit it. If there's second firewall after it, she should be able to stop the attack, right? Also what will ...