Concerned with software or hardware firewalls
32
votes
2answers
2k views
Is it a bad idea for a firewall to block ICMP?
This question was inspired by this answer which states in part:
The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).
...
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
22
votes
7answers
7k views
Why do people tell me not to use VLANs for security?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
20
votes
7answers
5k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
17
votes
6answers
1k views
Port Knocking is it a good idea?
Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
16
votes
6answers
1k views
What is the difference between $200 and $1,000+ Firewalls?
Instead of asking about the pros and cons of specific hardware, I thought I would ask a broader question: What are the differences between really expensive and inexpensive firewalls? What extra ...
15
votes
4answers
776 views
ESET warns: Skype attempting to communicate with unknown remote computer
I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate:
The ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
13
votes
5answers
1k views
To firewall or not to firewall?
There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
12
votes
10answers
8k views
Public DMZ network architecture
Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one:
Now that I got employed, my boss, a ...
12
votes
5answers
391 views
Neural networks & anomaly detection
Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
12
votes
1answer
607 views
What is a Web Application Firewall?
What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
10
votes
6answers
364 views
Firewall philosophy
I've always been taught/believed that with a corporate firewall, you block all outgoing traffic to start, then open up only the holes you need for specific traffic. This makes sense to me from both ...
10
votes
7answers
1k views
Egress filtering on an office network?
With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
10
votes
5answers
201 views
What are the areas to focus on to protect users and devices?
What are the areas or technologies to focus on to protect users and devices?
Are patching, antivirus and firewalls still the main areas?
How do you defend against attacks against vulnerabilities ...
10
votes
4answers
2k views
Dangers of opening up a wide range of ports? (mosh)
Why do we generally configure firewalls to filter out all traffic that we don't specifically allow? Is this just an extra layer of security for defense-in-depth that buys us nothing if we are not ...
10
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
9
votes
4answers
822 views
What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?
I don't want this to be subjective, so I'll try to make the requirements as clear as possible.
On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:
Using the internet ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
9
votes
2answers
338 views
A firewall without any extra features
I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:
I disabled autorun using these tricks;
I ...
8
votes
4answers
594 views
Software vs Hardware Firewalls
I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall.
I was just curious as to the take on Firewalls in general for a small-medium ...
8
votes
5answers
1k views
How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic. The only way to get encrypted traffic through the ...
8
votes
2answers
285 views
What is secure enough for web applications?
we intend to build a network in a small health center with No Internet Access
it is expected to have 30 terminal machines, all machines will use an electronic medical record web application
we want ...
8
votes
2answers
200 views
Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)
In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
8
votes
1answer
225 views
Is Chinese great firewall white or black list based? [closed]
Is a new website blocked by default in China ?
I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed).
However a friend of a ...
7
votes
6answers
214 views
Why shouldn't I run other applications on a Firewall?
If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?
The only opened port to the world (wan ...
7
votes
3answers
3k views
How to listen to all ports (UDP and TCP) or make them all appear open (linux)
I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
7
votes
7answers
1k views
What security implications are there for allowing outbound SSH traffic?
My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
7
votes
4answers
1k views
Security Services on Edge Router vs. Standard Firewall
If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it?
For instance, Core Switch --> ...
7
votes
4answers
418 views
What kind of IT security applications do you guys run on your laptop/desktop?
I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
7
votes
2answers
727 views
ports blocked by firewall and not the server
I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
6
votes
6answers
2k views
How important is NAT as a security layer?
I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory ...
6
votes
5answers
406 views
“There's a firewall on the router into the building so you can turn the one on your computer off”
I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
6
votes
3answers
513 views
Evasion techiques for WAFs
Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
6
votes
4answers
560 views
How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?
I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
6
votes
2answers
790 views
Getting self-signed SSL certificates for all https connections made from some premises
Context:
I'm currently working as an expat for my company in a country where the Internet is notably untrustworthy. It made the headlines a few months ago for stealing facebook, twitter and gmail ...
6
votes
3answers
196 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
3answers
254 views
When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration?
When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns ...
6
votes
3answers
127 views
Trying to firewall ports 1863, 5190
I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
...
6
votes
3answers
391 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
6
votes
2answers
2k views
I'm getting lots of unfamiliar connection attempts, what do I do?
I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places ...
6
votes
3answers
2k views
Proxy vs. Firewall
I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
6
votes
1answer
610 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
6
votes
1answer
4k views
Wireless client isolation - how does it work, and can it be bypassed?
Many SOHO routers these days support a feature called "wireless client isolation", or similar. What this is supposed to do, in principle, is to limit the connectivity between wireless clients ...
6
votes
2answers
194 views
What tools are available for distributing and syncing firewall rule-sets to multiple devices?
I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive ...
6
votes
2answers
407 views
How do experienced users test stateful firewall?
How do experienced users test stateful firewall with TCP/IPv6?
My test case includes:
echo reply without request
tcp ack without syn
Are there any more test cases, especially with IPv6?
6
votes
2answers
4k views
What is best practice for separation of trusted zones from a DMZ with a single firewall?
At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
5
votes
2answers
328 views
What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?
How unique is this bug?
Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
