1
vote
1answer
67 views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
0
votes
2answers
66 views

Could a router protect our network or need we use an hardware firewall?

I am at a small firm (12 PC on the internal network). We use this network architecture now: Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs) ...
0
votes
1answer
81 views

Dual Firewall DMZ

We've just learnt about firewalls and DMZ and I'm struggling to understand how are these actually implemented ? The architecture we've learned was something like this: Let's say that we have a ...
1
vote
4answers
106 views

Comprehensive audit of firewall - is Internet truly not accessible?

We have many Linux servers in several co-locations over the world. By design, these machines generally should not be able to access the Internet. Depending on location and role, some sites may have ...
1
vote
0answers
86 views

Proxy via pfSense and exclusions for DNS

I have posted this to NetworkEngineering.SE, as that seems the more suitable audience for this question. I will leave this question open here but am happy to see it closed. I just did not want to ...
0
votes
1answer
93 views

How can an out-of-the-box (Windows) server not be secure? [closed]

Background: I'm considering switching from shared web hosting to VPS for added security. However - managed VPS's costs much more than unmanaged ones. So, assuming: I secured my website against any ...
1
vote
3answers
234 views

Best practice for accessing management port of firewall

I'm in the process of setting up a bunch of servers at the other end of the world (well, 8 hours travel time) in a colocation place. The servers and firewall all have a remote management port (KVM, ...
2
votes
3answers
249 views

Suspicious VMWare connections that bypass firewall

I'm running VMWare 5 and I have found that when I start up VMWare I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
3
votes
2answers
278 views

Using only a firewall, how do I protect a database server from be exposed?

If I had two firewalls, I could put a web server within a DMZ and then with the second firewall restrict the access to the DB server. However, If I only have one firewall, how could I accomplish ...
-1
votes
1answer
72 views

Benefit of having strict ACLs [closed]

My company uses strict ACLs for the connection between two boxes. What are the benefits of these?
1
vote
1answer
246 views

Limit BitTorrent Sync connections to a specific network

Is it possible to limit BitTorrent Sync connections to a a specific network using the client software? Right now the closest I can come up with would be IP limitations imposed on each client using a ...
2
votes
5answers
909 views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
0
votes
3answers
10k views

How to effectivily block torrents on my network?

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
5
votes
5answers
439 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
1
vote
1answer
607 views

Does a network behind a NAT\modem firewall need a firewall?

Would it be justified for a business that is behind a SOHO router\WIFI to run a firewall such as PFSense, or is the firewalling capabilities in the router "good enough". For the most part the router ...
3
votes
3answers
227 views

Are local firewalls necessary

Is having local firewalls enabled on machines actually necessary if you run hardware based firewalls like pfsense or a netgear fvs338 and use that to control in/out bound connections? I personally do ...
1
vote
1answer
414 views

Isolate a Virtualbox VM from local network [closed]

I have the need to isolate a virtual machine created with Virtualbox from the local network but I need to provide internet access to that machine. It is the first time that I face this kind of ...
2
votes
1answer
179 views

How are IaaS Virtual Machines Isolated?

I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments. How are IaaS Virtual Machines network isolated from ...
0
votes
1answer
293 views

Securing my firewall (both dedicated and iptables-based) [closed]

I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection". My iptables look like this: *filter # Allows all ...
2
votes
2answers
1k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
3
votes
3answers
2k views

Securing a network attached storage on the internet

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup. I'd like to secure ...
6
votes
3answers
769 views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
12
votes
4answers
9k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
1
vote
1answer
189 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
2
votes
2answers
2k views

What is more risky? Database Server in DMZ or Trusted Network?

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently. Assume the following A web server is being used for ...
1
vote
1answer
225 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
12
votes
3answers
8k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
6
votes
2answers
145 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
0
votes
3answers
352 views

Some issues with iptables and nmap

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default. However I can use HTTP or SSH, so that ...
0
votes
1answer
157 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...
2
votes
1answer
162 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
29
votes
9answers
15k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
1
vote
2answers
1k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
2
votes
1answer
5k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
37
votes
2answers
14k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
2
votes
2answers
280 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
20k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
3
votes
1answer
302 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
4
votes
3answers
2k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like: ...
2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
1
vote
3answers
1k views

How to setup an internal firewall

I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
1
vote
2answers
207 views

Securing a VPN connection

I'm new to this we want to install a new VPN connection that will be used to connect using Internet to some networks in the office the contractor want to use a" Cisco NAC Network Module or Cisco IPS ...
3
votes
3answers
1k views

How can reverse proxies be used to bypass acceptable use policies of a company?

I am wondering how reverse proxies can be used to bypass company acceptable use policies? What can be done to prevent it?
2
votes
3answers
6k views

Config Server Firewall: What Outgoing ports need to be open for wget and apt-get install?

I am just configuring CSF and I have to specify my outbound ports here. I am trying to close as many as possible leaving only what I need open, however what do I need to leave open for wget? # Allow ...
0
votes
2answers
161 views

Can I connect our network to the internet but only allow connections to certain servers?

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
1
vote
1answer
173 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
8
votes
2answers
1k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
2answers
400 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
16
votes
12answers
21k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...