Hot answers tagged

40

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


17

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


6

Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice. Think of it like terrorism-- Timothy McVeigh detonates a bomb in Oklahoma. You ban all white men from America. Does that really stop the problem? The majority of actual attacks I've seen come from botnets and/or anonymous ...


4

Due to architectural necessity, Web Application Firewalls (WAFs) protect against attacks at other layers as well. However, these protections are largely incidental and not comprehensive. Let me illustrate this with some examples: Presentation Layer - let's assume that the application to be protected uses TLS. If so, the WAF device must by definition* ...


4

Google is an external service, connecting into your server. A web server's firewall will normally be configured to allow this. You are trying to connect out from your server, which may well be blocked, since most web servers don't need that ability. You don't need it, for example, to include a Twitter feed (that's client side loaded), to upload files to your ...


4

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate between the two. According to my concept, they're both a flow of http packets so they should not be differentiable. I presume they are intercepting your traffic ...


2

Your question of why the forward rule doesn't work is essentially a networking question, so I'll explain using an analogy. Imagine there are three people involved in the sending of a letter - Alice, Bob, and you. Alice wants to get a message to Bob, but using you as a middleman (proxy). Alice could use one of two techniques: Method 1: Write a letter ...


1

No. Incoming ports should only be whitelisted when the computer is intentionally providing a service to the outside world (e.g. web server, RDP, etc.). Yes, inspecting the traffic is the only way unless you already have an exhaustive list of software running on the machine and know which ports it relies on. However, this is generally not necessary for home ...


1

Why SourceForge's administrators block my web by a firewall? The answer on StackOverflow explains it all really. Previously, SourceForge allowed outgoing requests and this was abused, so they no longer allow it. Why Google can get some data from my website, as HTML page, easily? Because Google is not behind SourceForge's firewall (obviously) and ...


1

Speaking from experience, I have both a couple of PfSense fws and a Debian 8 with IPsec VPN+iptables. Putting all together, you would take more or less the same time. The advantage of PfSense is that you setup it once, and it is pretty much set and forget, aside the updates. The Debian box takes much more time refining the setup and maintaining. As for ...


1

All the systems I have seen (either dedicated, appliance-like ones, or "helpers" in normal distributions) boil down to building an iptables configuration. The advantage of going though them is that you do not absolutely have, right away, to understand all the details when you use a default, well documented example configuration. What you look for instance ...


1

Just to add my two cents' worth... Years since this question was first posted, I've had this problem with BitDefender starting this week (now running BitDefender Internet Security 2016). Today I had port scans from IP's (apparently) located in the UK (same as me), Spain, and Iran. I could not understand why, when behind a router with the firewall enabled, ...



Only top voted, non community-wiki answers of a minimum length are eligible