Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

42
votes
2answers
19k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
39
votes
6answers
11k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
30
votes
5answers
6k views

Are two firewalls better than one?

Let's say that our first firewall have some vulnerability and malicious person is able to exploit it. If there's second firewall after it, she should be able to stop the attack, right? Also what will ...
30
votes
9answers
19k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
30
votes
7answers
18k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
19
votes
6answers
2k views

What is the difference between $200 and $1,000+ Firewalls?

Instead of asking about the pros and cons of specific hardware, I thought I would ask a broader question: What are the differences between really expensive and inexpensive firewalls? What extra ...
18
votes
7answers
3k views

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
17
votes
5answers
6k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
17
votes
4answers
5k views

Dangers of opening up a wide range of ports? (mosh)

Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
16
votes
12answers
24k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
16
votes
5answers
2k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
16
votes
1answer
1k views

What is a Web Application Firewall?

What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
15
votes
4answers
1k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The ...
14
votes
4answers
10k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
13
votes
5answers
907 views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
12
votes
5answers
7k views

What is the best practice for placing DataBase servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
12
votes
3answers
11k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
12
votes
2answers
3k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
11
votes
5answers
3k views

How can encrypted traffic bypass the Great Firewall of China when it is being blocked?

The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
11
votes
5answers
223 views

What are the areas to focus on to protect users and devices?

What are the areas or technologies to focus on to protect users and devices? Are patching, antivirus and firewalls still the main areas? How do you defend against attacks against vulnerabilities ...
10
votes
7answers
2k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
10
votes
6answers
678 views

Firewall philosophy

I've always been taught/believed that with a corporate firewall, you block all outgoing traffic to start, then open up only the holes you need for specific traffic. This makes sense to me from both ...
10
votes
5answers
1k views

What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?

I don't want this to be subjective, so I'll try to make the requirements as clear as possible. On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY: Using the internet ...
9
votes
4answers
920 views

Software vs Hardware Firewalls

I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall. I was just curious as to the take on Firewalls in general for a small-medium ...
9
votes
7answers
3k views

What security implications are there for allowing outbound SSH traffic?

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
9
votes
4answers
726 views

A firewall without any extra features [closed]

I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years: I disabled autorun using these tricks; I ...
8
votes
3answers
968 views

Evasion techiques for WAFs

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
8
votes
2answers
299 views

What is secure enough for web applications?

we intend to build a network in a small health center with No Internet Access it is expected to have 30 terminal machines, all machines will use an electronic medical record web application we want ...
8
votes
2answers
209 views

Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)

In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
8
votes
1answer
18k views

Wireless client isolation - how does it work, and can it be bypassed?

Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
8
votes
3answers
4k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
8
votes
2answers
2k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
8
votes
1answer
297 views

Is Chinese great firewall white or black list based? [closed]

Is a new website blocked by default in China ? I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed). However a friend of a ...
8
votes
1answer
1k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
7
votes
6answers
243 views

Why shouldn't I run other applications on a Firewall?

If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)? The only opened port to the world (wan ...
7
votes
3answers
6k views

How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
7
votes
4answers
2k views

Security Services on Edge Router vs. Standard Firewall

If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it? For instance, Core Switch --> ...
7
votes
4answers
1k views

Is blocking UDP and TCP sufficient to prevent unwanted network activity?

I want to be 100% sure that my machine only connects where and when I want it to. If I use a firewall that blocks all UDP and TCP packets but those that I explicitly allow to pass, can I be 100% sure ...
7
votes
2answers
1k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
7
votes
4answers
464 views

What kind of IT security applications do you guys run on your laptop/desktop?

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
7
votes
5answers
9k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
6
votes
6answers
6k views

How important is NAT as a security layer?

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
6
votes
5answers
924 views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
4answers
485 views

“There's a firewall on the router into the building so you can turn the one on your computer off”

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
6
votes
3answers
8k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
6
votes
4answers
770 views

How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?

I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
6
votes
2answers
2k views

Getting self-signed SSL certificates for all https connections made from some premises

Context: I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
6
votes
3answers
975 views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
2answers
69k views

What are the TCP/UDP ports used by torrent applications?

I want to block torrent traffic on my network because it is utilizing too much bandwidth and disrupted my network traffic. What port range should I use and what protocol TCP or UDP?
6
votes
4answers
581 views

Trying to firewall ports 1863, 5190

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need. But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further? ...