Hot answers tagged

8

... because firewall does not have trusted root certificates. The firewall does have a set of trusted root certificates. They are not necessarily exactly the same as the client has in the browser but there will be overlap for the commonly used CA. And it might even be intentional to let the firewall trust less CA then the browser does.


3

A firewall is just some device or software which filters the network traffic. This can be done at the packet level (usually called packet filter firewall (PFL) or layer 3,4 firewall) but also at the application level (usually called application level firewall (ALG), secure web/mail gateway (SG, SWG...) or similar). You'll often find both PFL and ALG ...


3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


2

set the firewall to BLOCK ALL TRAFIC... If you manage to set the firewall to block all incoming and outgoing traffic then you cut off the access for the attacker as long as the firewall is set in this mode. But note that if the attacker is already on your system he might have installed software to monitor the system and can later retrieve the collected ...


2

There are a number of ways that people attempt to mitigate these attacks. External Prevent spam filter from allowing MIME types frequently associated with malware (it's highly unlikely there is a business relevant reason to send .exe or .bat files for instance) Use Anti-Virus as .exe's can be detected even after several rounds of encoding. Preferably you'...


2

Depending on the type product you are asking about and the environment you are trying to defend there are several pluses and minuses. Some potential pluses depending on the product: Pluses: 1.) This isn't the norm but if you are talking about managed firewall services the product may have integration with larger analytic databases which allow the ...


2

If you really, really want to use only the firewall, your best bid is to copy/paste this list manually in your firewall since this is your only option of blocking adult-content from Firewall! As other may have advised, OpenDNS, is good option regarding different packages of filtration. Note, some have reported that openDNS does not always provide the best ...


2

You need to rely on someone else's judgement. If you just don't want to install 3rd party software, you can switch your DNS to OpenDNS, register an account and rely on their filtering. Refer to FamilyShield Parental Controls for more information. Other than that you can use Windows native parental controls, however there is some controversy about privacy, ...


2

Your best bet may be to head over to OpenDNS.com and setup your network interfaces to block sites by category according to your preferences. You simply replace your current DNS ips with 208.67.220.220 and 208.67.222.222. It's a free, maintenance free solution that additionally offers some protection against the DNS attacks that we are seeing frequently today....


1

First and foremost you can adopt a firewall policy of "allow what's needed, block the rest". That will only go so far because your malicious outgoing link may take advantage of a hole you have poked in the firewall. Enterprise grade products will "hook" certain functions like connect(). By hooking the function an analysis engine determines if the connection ...


1

You'd be surprised how successful something like this can be - especially for a typical user who may not have any security controls in place. Also, I would argue that if you are able to convince a user to execute code you have provided, a malicious exploit is probably not even necessary - (i.e. "Microsoft Tech Support calls" that obtain remote access to ...


1

If an attacker has managed to install software on your PC, that software can initiate a connection to an outside system, unless you have configured your firewall to block outgoing traffic as well. This connection can carry back data to your PC, even through your firewall, the same way a web browser receives data from a web server. And if you block outgoing ...


1

All Linux and BSD-based firewalls are just a management UI over their respective IS kernel's firewall feature. If you want remote access and scripting functions, you can use standard remote management and scripting tools of the base OS, namely, SSH and shell scripts. The firewall products that support web administration can also be remotely accessed by ...


1

In the drawing below you have three networks which are connected though a firewall. The role of the firewall is to limit the traffic between these networks. Limiting the traffic means that you can decide that only traffic going to a certain port (say, 22) is allowed, how often you can connect to a given host from another one etc. There is nothing special ...


1

Is it an actual piece of hardware? (I have seen both hardware and software online). as you stated, it can be both. Windows has a built in firewall ... but there are also hardware devices that are dedicated to the task (usually for larger networks) How do firewalls work in tandem with Active Directory? Um, it doesn't? Unless I am missing something ...


1

You can choose to encrypt internal traffic with a lower-key certificate. And it's also advised to position your load balancer as near as possible to your servers to prevent sniffing or man-in-middle attacks. SSL termination can be done at the Load Balancer to offload CPU intensive jobs away from web servers. If the LB brand you have chosen can do certain ...


1

To be honest it is smart to filter some outbound ICMP both router level and software firewall level as a extra layer of security. It my not be pertinent to stopping a DoS or DDoS but malicious people still use ICMP to try and retrieve as much information about a network as possible before they attempt to breach it. I am not saying they ONLY use ICMP but ...



Only top voted, non community-wiki answers of a minimum length are eligible