Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

4
votes
5answers
13k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
2
votes
0answers
23 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
0
votes
3answers
38 views

Confusion over a firewall and proxy

A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443? Also, if a firewall is to control outbound ...
1
vote
2answers
301 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
0
votes
1answer
90 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
0
votes
3answers
99 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
1
vote
1answer
21 views

Is there a trusted independent firewall review company?

I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes: There's this site called ...
2
votes
1answer
170 views

ASA5505 DMZ issue

I have ASA5505 , connected to the WAN on port 0 (called Vlan2), and connected to my development LAN on port 7 (Called Vlan1). I want to add DMZ, and I connected switch and servers to port 3, and ...
0
votes
0answers
7 views

Sonicwall GAV / DPI between VPNs [migrated]

We have multiple remote sites connected via VPN to a central site that uses a Sonicwall NSA 250 (running SonicOS Enhanced 5.8.1.15-51o). I'd like to allow the remote sites to talk to each other by ...
1
vote
0answers
23 views

Configure icefloor to prevent leaks when VPN connected

I am trying to configure icefloor firewall on OS X 10.9 so as to make sure all traffic will go through VPN. I recently notified that even with "Route all traffic through vpn" option in tunnelblick ...
2
votes
4answers
10k views

What is the difference between antivirus and firewalls

I need a brief explanation about the differences between antiviruses and firewalls
2
votes
1answer
300 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
1
vote
0answers
33 views

How can I make my computer trust a firewall web server certificate? [migrated]

Every time I log into my firewall I get a message that says: The site's security certificate is not trusted! I know this is because my firewall doesn't have an identity certificate from a ...
1
vote
1answer
41 views

Based on which criteria is this outbound traffic being blocked? Only HTTP passes, on any TCP port?

There is a server program running behind a home ADSL modem/router, at a premise that I'll call C; the program listens on TCP port 29401, and accepts connections using a custom binary, non-HTTP, ...
2
votes
3answers
5k views

What, specifically, does the Windows Firewall do?

My understanding of the situation is that, when the Windows firewall is off, every port on the computer (all 65535 of them) is fully open. This means that any application running on the computer can ...
0
votes
1answer
55 views

Firewall log entry: need help in interpretation

I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds: /var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15 utm ulogd[11342]: ...
0
votes
1answer
196 views

Foreign MRT.exe?

I was managing my firewall using AVG and I noticed this was allowed: I have north american locale, and sometimes Japanese locality(?), and that is not Japanese. It is getting through my firewall, ...
0
votes
1answer
34 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
1
vote
1answer
22 views

How can I implement a whitelist based on packet content?

At the moment I am looking for some way on Linux to have packetfilter whitelisting done but based on finegrained parameters such as packet content rather than more general parameters such as protocol ...
1
vote
1answer
439 views

Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility?

im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.
2
votes
1answer
35 views

Virtualisation: security on the host side

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only ...
0
votes
1answer
50 views

ESET detected incoming connection to Rundll32

My ESET Smart Security 7 detected incoming connection from an external computer, since Rundll32 can be run by any programs on my computer and I don't know which program is doing this, so I am ...
1
vote
1answer
29 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
4
votes
1answer
5k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
1
vote
2answers
55 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
2
votes
2answers
120 views

How common is port-knocking? [closed]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
7
votes
3answers
13k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
2
votes
1answer
48 views

Should reverse connections be used to bypass NATs?

I'm planning on doing a demonstration on how remote administrative tools work for my schools computer security club. I plan on writing a RAT in C++ and demonstrating/explaining how it works. I ran ...
0
votes
0answers
16 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
0
votes
1answer
65 views

Creating a secure home network - Which firm ware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
1
vote
1answer
38 views

How to check whether firewall allows traffic on specific port but not listening on the port [closed]

I have client / server and there is a firewall between them.The server is listening on a port and I want to check if this port is allowed by the firewall. I can only know the ports that the machine ...
0
votes
2answers
132 views

Trying to get rid of hackers who have access to all my devices

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
1answer
56 views

How do you back up cardholder data remotely without a network connection?

In the PCI DSS version 3 it says: 1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment. But in the event of hard ...
0
votes
1answer
52 views

Web browser initiating connection on non-standard ports. Should it be blocked?

I am doing some egress monitoring on my computer. Once in every few days, I would find some strange connections being logged, which I believe is initiated by the web browser through a related but not ...
-4
votes
1answer
85 views

What are the ways to block all BitTorrent clients from accessing my router? [closed]

What are all the values need to be entered in the source and destination IP address and Subnet mask in order to block the bit torrent file exchange.. i.e. blocking torrenting My router's filtering ...
1
vote
2answers
147 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
1
vote
2answers
151 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
3
votes
3answers
195 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
1
vote
1answer
986 views

Windows Firewall netsh equivalent of iptables u32 module

I have looked everywhere and I can't seem to find a netsh equivalent of the u32 module for iptables. I want to create a rule to Drop a packet that starts with a specific set of bytes. Similar to: # ...
2
votes
1answer
228 views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN ...
1
vote
1answer
66 views

Is it possible to track the email sent via BCC List using firewall or network security software?

I want to know whether is it possible to know the conversation/email sent via BCC can be identified by admin in some corporate companies? I have heard that email sent from BCC cannot be identified, ...
17
votes
12answers
27k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
1
vote
2answers
257 views

Are KIS 2014, Malewarebytes Pro and SpyBot sufficient to prevent internet attacks?

As mentionned in the title, I have KIS 2014, Malewarebyte Pro and Spybot installaed on my windows 7 (regularly updated). I regularly scan my pc for viruses and spywares and clean it with Glary ...
0
votes
1answer
121 views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
2answers
524 views

How can I use a proxy appliance as HTTP Proxy & Reverse Proxy at the same time?

I have a BlueCoat ProxySG 810 appliance and want to use it as both an HTTP Proxy Server for clients on the Inside interface of a PIX 525 Firewall (OS Version = 8.0(4)) and a Reverse Proxy Server for ...
0
votes
1answer
31 views

NAT separate firewall or other security tools

It's a conceptual question: Suppose i want to separate NAT and firewall, can it help to my security? INTERNET >>>> NAT >>>> Firewall >>> MyNetwork
6
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
4
votes
3answers
13k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
9
votes
6answers
6k views

How important is NAT as a security layer?

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
2
votes
1answer
7k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...