Concerned with software or hardware firewalls
1
vote
4answers
70 views
Enforcing personal firewall for OS X
We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
-4
votes
0answers
23 views
Port forwarding woes [closed]
I have a dilemma on my hands and I'm looking for ideas or opinions on what else I can do in this regard.
I use port forwarding with my ISP to access my security systems (DVR) in the store through ...
5
votes
2answers
6k views
What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff.
So I ...
20
votes
6answers
5k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
-3
votes
0answers
54 views
How to tell if your internet is being filtered? [closed]
In his recent interview, Edward Snowden states that Hong Kong's internet isn't being firewalled more than "any other western nation." I take that to mean that the United States government filters our ...
0
votes
1answer
45 views
How are IaaS Virtual Machines Isolated?
I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
1
vote
1answer
79 views
Why are some ports reported as closed by nmap?
I was scanning a machine from inside the same LAN which is running and up to date Windows XP Home Edition which I suspect may be running some malware.
The target machine has an up to date antivirus ...
0
votes
0answers
23 views
Is there a way to block all internet traffic for a user with windows firewall? [migrated]
I have an application that always runs under a dedicated local user account. I want to block all inbound and outbound traffic for that local user account. The other user accounts on the machine need ...
-1
votes
1answer
66 views
Is there a way to get OS X to start a VPN connection before allowing network traffic? [closed]
I'm running OS X 10.8 and have Tunnelblick set up so I can connect to my OpenVPN server at home. I've also used this at $WORK in the past.
When I'm out and about and want to jump on a public network, ...
-1
votes
1answer
47 views
File shares from a DMZ into an internal network
We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to ...
-1
votes
1answer
28 views
Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?
From the FreeBSD handbook: "Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be logged, ...
0
votes
1answer
83 views
How can I better protect my LAN from Internet Hackers
My computer is connected to my Netgear router which is also the switch for my network, this in turn is connected to my cable modem which is just a bridging device.
My router is blocking scans and ...
-2
votes
0answers
63 views
fail2ban banning the IP but gives access [closed]
I am trying to setup fail2ban to work with UFW (Uncomplicated Firewall). Fail2ban bans the IP after 3 failed login attempts, but doesn't block the IP from logging within the bantime period.
...
6
votes
3answers
539 views
Evasion techiques for WAFs
Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
-8
votes
0answers
51 views
IBOSS is ruining my day [closed]
iBoss blocks P@@xy and has an immediate Unrecognizable disability for https, how do I get past that? Oh and any URL changers don't work
4
votes
1answer
233 views
How did my homepage get changed in IE?
I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
6
votes
3answers
151 views
Trying to firewall ports 1863, 5190
I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
...
0
votes
1answer
64 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
0
votes
1answer
90 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
1
vote
2answers
539 views
How to check if a port can be accessed from the outside
I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at ...
-3
votes
1answer
109 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
6
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
2
votes
2answers
196 views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
4
votes
2answers
108 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
1
vote
1answer
65 views
Whats a secure firewall rules using UFW?
On my Ubuntu server I have these services running:
netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program ...
4
votes
4answers
179 views
HTTPS firewall rule
Setting up Firewall rule for HTTPS websites on basic stateless packet filter firewall
This seems like a stupid question, but how do I set up a firewall rule to allow HTTPS on a basic packet filter ...
2
votes
2answers
195 views
How does a firewall help to protect a server?
Since a potential attacker will exploit the services that are already open to public by firewall rules, how will a firewall help to protect my server from attackers?
3
votes
3answers
123 views
Securing a network attached storage on the internet
I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup.
I'd like to secure ...
2
votes
1answer
147 views
Normalizing Windows Advanced Firewall rules
How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
1
vote
2answers
63 views
Remote File Injection in ARGS blocking form updating database
I am getting a page forbidden because mod_security blocks it with Remote File Injection in ARGS rule.
How do I stop this apart from not including URLs in the form fields or removing the http:// ...
-1
votes
3answers
174 views
What is the difference between a Gateway and a Firewall? [closed]
What is the difference between a Gateway and a Firewall and how do they relate to one another?
I am a developer trying to get a general understanding of network security.
-1
votes
1answer
90 views
Is there a tool I can use to see if my website is being blocked by common business content filters? [closed]
Not 100% sure this is the right site, but hey-ho,
Title sums it up, I'm getting sporadic reports from a couple of clients that people visiting bits of their sites are being blocked with a message ...
4
votes
3answers
183 views
The safest way to circumventing Iran's Internet censorship
We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy.
Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
-1
votes
2answers
158 views
Allow embedded videos while keeping youtube blocked [closed]
Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy.
How can ...
2
votes
3answers
231 views
It's necessary setup a firewall in both PC and router?
If I have the router firewall enabled, it's really necessary setup iptables in my system? Isn't it a little redundant?
For example I add a rule in the router where the PC can't use the port 12345 ...
4
votes
1answer
192 views
How to whitelist an Amazon ELB in a(ny) firewall?
We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address.
However, we are running our system behind an Amazon Elastic Load Balancer ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
4
votes
1answer
204 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
2
votes
1answer
98 views
Barracuda antispam access to active directory in dmz : opening port or not?
I have a Barracuda Antispam unit and look to use recipient validation with active directory to stop sending NDRs (non-delivery reports) when we are being spammed.
What I see on the web is people ...
-1
votes
1answer
145 views
How to find IP Addresses that have been attacking my Computer Ports ?
I am a newbie at Info Sec, and wanted to know which IP addresses are sources of attack traffic.
Can I also find out which ports are being attacked?
Can this information be found in windows firewall? ...
14
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
2
votes
0answers
44 views
Could you attack a port without knowing what service was listening? [duplicate]
A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.
My question is this, though, if the ...
1
vote
1answer
64 views
Are there any cross platform firewall solutions with a central management platform?
Currently I have a bunch of servers scattered across a few different providers e.g. EC2, rackspace. Some boxes are Linux and some are Windows. Currently I'm finding the administration of the ...
6
votes
3answers
232 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
3
votes
1answer
199 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
8
votes
5answers
1k views
How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
3
votes
2answers
985 views
What are the TCP/UDP ports used by torrent applications?
I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
2
votes
1answer
60 views
SYN scan, determining scan vs large file upload
In a system attempting to detect SYN scans, one technique is to analyze the rate of change of (network packets sent from victim host per second). Processes such as uploading a large file would not be ...
7
votes
1answer
674 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
6
votes
3answers
2k views
Proxy vs. Firewall
I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
