Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

60
votes
6answers
24k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
41
votes
9answers
49k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
31
votes
4answers
40k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
68
votes
2answers
72k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
14
votes
6answers
14k views

How important is NAT as a security layer?

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
1
vote
2answers
706 views

Attacking a server on port 80 while only port 22 is open on the firewall

There is a question bugging me a after reading on network security. Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a ...
39
votes
9answers
57k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
15
votes
5answers
20k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
29
votes
7answers
8k views

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
18
votes
2answers
6k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
14
votes
2answers
216k views

What are the TCP/UDP ports used by torrent applications?

I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
8
votes
5answers
7k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
6
votes
2answers
14k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
4
votes
2answers
199 views

Blacklisting IP addresses — when should we take action?

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
21
votes
12answers
47k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
19
votes
5answers
3k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
25
votes
4answers
11k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
8
votes
3answers
2k views

Evasion techiques for WAFs

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
5
votes
2answers
4k views

How should an outgoing connection white-list be created?

I see my previous question was closed as duplicate of Why block outgoing network traffic with a firewall?. The answers that everyone agree with mention the value of blocking outgoing connections (to ...
1
vote
2answers
2k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
57
votes
9answers
7k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
34
votes
5answers
12k views

Are two firewalls better than one?

Let's say that our first firewall have some vulnerability and malicious person is able to exploit it. If there's second firewall after it, she should be able to stop the attack, right? Also what will ...
19
votes
5answers
76k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
17
votes
5answers
2k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
17
votes
1answer
3k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
10
votes
2answers
6k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
4
votes
3answers
197 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
4
votes
4answers
30k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
14
votes
6answers
1k views

Firewall philosophy

I've always been taught/believed that with a corporate firewall, you block all outgoing traffic to start, then open up only the holes you need for specific traffic. This makes sense to me from both ...
13
votes
7answers
3k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
7
votes
3answers
36k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
6
votes
3answers
12k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
2
votes
2answers
204 views

How do people typically perform security audits of firewalls?

In my days as a pentester, we used to use tools like Nipper, combined with manual analysis, to perform audits of firewall configurations. However, in my current company we have many different ...
1
vote
5answers
85k views

How to effectivily block torrents on my network?

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
13
votes
2answers
26k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
10
votes
1answer
3k views

Why is Windows Explorer making external connections?

McAfee is seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe ...
9
votes
3answers
12k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
8
votes
3answers
6k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
7
votes
3answers
4k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
5
votes
4answers
1k views

What problems if any are caused by opening a port in the firewall that no program listens on?

I have a port forwarded and open in the firewall that I sometimes use to play games with friends over the internet. The game server doesn't run 24/7, only when I'm actually playing is something ...
4
votes
4answers
385 views

Can you use two hardware firewalls?

There is a rule that says "don't use/install more than one firewalls on one computer " (software firewalls to be exact) which means if you have a network and it has five computers you can only ...
3
votes
2answers
103 views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
3
votes
1answer
516 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
3
votes
1answer
119 views

IPsec: Is AH in tunnel mode secure?

I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and ...
2
votes
2answers
1k views

Firewall & TCP Traffic

I have a question regarding network firewalls and TCP traffic. When a firewall rule is set to block either inbound traffic, outbound traffic, or both on a port, does that only apply to initial ...
2
votes
2answers
7k views

How secure is blocking all incoming connections on my ADSL or cable router?

My router, an up-to-date ADSL Fritz!Box 7340 router with a fixed leased IP address, has been configured to block all incoming traffic. Assuming, for the sake of argument, no extra security is ...
1
vote
2answers
492 views

Security risk with using internal IP on public DNS

A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP. Publicly, company.com nameservers belong to their ...
0
votes
2answers
7k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
0
votes
1answer
3k views

What is the difference between SYN cookie, SYN cache, and SYN proxy?

I am trying to understand some techniques regarding SYN flood prevention and there are three terms I couldn't find a clear explanation of. The terms that are confusing me are: SYN Proxy SYN Cache ...